remove the signing configuration - #60
Merged
Merged
Conversation
It was added to fix a homebrew install that did not run, and it did not fix it: a bare executable has nowhere to staple a notarization ticket, and an unstapled one did not satisfy gatekeeper on macos 26.5. Shipping a formula rather than a cask is what fixed it, by not being quarantined in the first place. What was left behind was thirty lines that did nothing. The notarize block was off unless a certificate was configured and no certificate was configured; preflight checked for five secrets that were never set; the release job carried them into an environment that never read them. Dead configuration that looks live is worse than none, because the next person to read it has to work out which. The explanation stays in the README, since why notarizing is not the answer here is worth knowing before somebody tries it again, and it now says what was actually tested rather than more than that: every attempt within ten minutes of the ticket being issued. A longer run was never completed. Verified by building the darwin config with no signing environment at all: goreleaser runs no signing step and writes the same formula. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WcPAJjNzG6bqy2FKqKKY1v
There was a problem hiding this comment.
🟡 Changes recommended
There are still user-facing strings in README/workflow that incorrectly reference “cask” despite the PR’s stated switch to “formula,” which should be corrected for consistency and troubleshooting accuracy.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Removes the unused macOS signing/notarization configuration from the release pipeline and updates the release documentation to reflect the current Homebrew formula approach (instead of a cask), reducing misleading “dead” configuration.
Changes:
- Removed the GoReleaser
notarizesigning/notary block from the Darwin GoReleaser config. - Removed the GitHub Actions preflight step that checked (and passed through) macOS signing secrets that are no longer used.
- Updated README release documentation to refer to a single required secret and to “Homebrew formula” (with one remaining cask reference noted in review comments).
File summaries
| File | Description |
|---|---|
| README.md | Updates release documentation wording (required secret, formula vs cask, notarization explanation). |
| .goreleaser/.goreleaser.darwin.yml | Removes unused macOS notarization/signing configuration from the darwin GoReleaser config. |
| .github/workflows/release.yml | Removes unused macOS signing-secret preflight checks and secret passthrough in the release job. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
33
to
35
| if [ -z "$RELEASE_TOKEN" ]; then | ||
| echo "::error::RELEASE_TOKEN secret is not set. Releases need a personal access token with repo scope on both jonhadfield/certreader and jonhadfield/homebrew-certreader, because the darwin build pushes the cask update to the tap and the built-in GITHUB_TOKEN cannot write to another repository." | ||
| exit 1 |
Comment on lines
626
to
629
| Platform builds run in parallel, so a release takes about as long as its slowest target rather than | ||
| the sum of all five. A prerelease tag (one containing a hyphen, such as `v1.0.0-rc1`) is published as | ||
| a prerelease and does not update the homebrew cask. | ||
| a prerelease and does not update the homebrew formula. | ||
|
|
The release workflow's own error message, which somebody troubleshooting would paste, and the sentence in the README describing what a release does. Both described the tap being updated with a cask, which stopped being true one release ago. The other mentions are about casks on purpose: how to replace one that is already installed, and why certreader is not shipped as one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WcPAJjNzG6bqy2FKqKKY1v
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The signing config was added to fix a Homebrew install that did not run, and it did not fix it. A bare executable has nowhere to staple a notarization ticket, and an unstapled one did not satisfy Gatekeeper on macOS 26.5. Shipping a formula rather than a cask is what fixed it (#59), by not being quarantined in the first place.
What was left behind was ~30 lines that did nothing:
notarize:block, off unless a certificate was configured — and none wasDead configuration that looks live is worse than none, because the next person to read it has to work out which it is.
kept
The "why a formula and not a cask" explanation stays — why notarizing is not the answer here is worth knowing before someone tries it again. Its claim is now bounded to what was actually tested: every attempt within ten minutes of the ticket being issued. A longer run was never completed, so the README no longer implies it could never work.
also fixed in passing
### required secrets→### required secret, sinceRELEASE_TOKENis the only one againverification
Built the darwin config with no signing environment at all: GoReleaser runs no signing step, exits 0, and writes the same formula —
bin.install "certreader", correct per-arch GitHub URLs.Config and docs only; no release needed.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WcPAJjNzG6bqy2FKqKKY1v