Code-sign and notarize macOS builds #7

Activity

1. killerwolf

   added

   enhancementNew feature or requestNew feature or request

   on Aug 20, 2026
2. killerwolf commented on Aug 20, 2026

   

   killerwolf

   on Aug 20, 2026

   OwnerAuthor

   More actions

   Confirmed with a real reproduction — this is now blocking auto-update, not just the first-launch Gatekeeper warning.

   Running the installed v1.1.0 from a terminal while it picked up v1.3.0:

   Update has already been downloaded to .../pending/QuickToss-1.3.0-arm64.zip
   Creating proxy server for native Squirrel.Mac ...
   Download completed to: file:///...ShipIt/update.ng4DQpC/...zip
   [Error: Code signature at URL file:///...ShipIt/update.ng4DQpC/QuickToss.app/ did not pass validation:
    le code n'a pas de ressources mais la signature indique qu'elles doivent être présentes] {
     code: -1,
     domain: 'SQRLCodeSignatureErrorDomain'
   }
   

   The download and checksum stages succeed — Squirrel.Mac rejects the bundle at the signature-validation step, right before swapping it in.

   Observed symptoms this explains:

   • arm64: the update toast vanished — the error event fires shortly after update-downloaded.
   • x64: the toast stayed but "Restart" did nothing — quitAndInstall() hands off to Squirrel, which fails the same validation.

   So auto-update cannot work at all until the app is signed with a Developer ID and notarized. There's no supported way to bypass Squirrel.Mac's signature check on macOS.
3. killerwolf

   added a commit that references this issue on Aug 20, 2026

   fix(update): notify about updates instead of failing to install them

   ...

   abc6f5d
4. killerwolf commented on Sep 10, 2026

   

   killerwolf

   on Sep 10, 2026

   OwnerAuthor

   More actions

   Still open and still the right ask, but the mechanics changed in 2.0 (ADR 0002) — worth recording so nobody picks this up against the old description.

   What no longer applies:

   • Squirrel.Mac and electron-updater are gone. The signature problems described here — Squirrel rejecting the downloaded bundle on arm64, electron-updater unable to read a signature for the running app on x64 — were properties of that updater, not of the app.
   • ~/Library/Logs/QuickToss/auto-updater.log no longer exists. There is no updater framework to log.
   • The hardened-runtime entitlements are gone. Signing needed com.apple.security.cs.allow-jit and allow-unsigned-executable-memory for V8, which are exactly the exceptions that weaken the hardened runtime. A Rust binary with no JavaScript engine needs neither, so notarization should be a cleaner proposition than it was.

   What still applies:

   • The app is signed ad-hoc (codesign --sign - in scripts/bundle.sh), not with a Developer ID, and isn't notarized. Users still need xattr -cr /Applications/QuickToss.app once.
   • In-place updates still can't be done safely, so the app only checks for a newer version and links to the release page.

   What's smaller now: the download went from ~110 MB to ~6 MB. Notarization uploads and staples a much smaller artifact, and if in-place updates ever land, the download is no longer the reason not to.