Sign up
View stargazersSign up
Commits

SHIPPING.md

Shipping Amped (Part 2 — notarize & distribute)

The signed build is already notarization-ready (Developer ID, Hardened Runtime, secure timestamp, no get-task-allow). What's left is notarizing it with Apple. Do this when you're ready to hand the app to anyone else.

One-time setup

  1. Create an app-specific password: appleid.apple.com → Sign-In & Security → App-Specific Passwords. Copy it.
  2. Store a notarytool credential profile named Amped (matches NOTARY_PROFILE in .env):
    sh
    1xcrun notarytool store-credentials "Amped" \
    2 --apple-id "YOUR_APPLE_ID_EMAIL" \
    3 --team-id 82K3YC8HVF \
    4 --password "PASTE-THE-APP-SPECIFIC-PASSWORD"

Every release

sh
1cd /Users/gustaf/Repos/Gustaf/amped
2./build.sh # Developer ID signed (reads .env)
3./notarize.sh # zip → notarytool submit --wait → stapler staple → verify

Ends with ✅ Notarized & stapled. Hand out the stapled dist/Amped.app (zip it, or wrap in a DMG).

GitHub releases

Pushing to main runs .github/workflows/release.yml, which builds an unsigned app and attaches Amped-<version>.zip to a GitHub Release. No Apple secrets. See docs/RELEASING.md.

Notarized, self-replacing updates are not part of that workflow. The steps above are for a local notarized build when you want one.

If notarization fails

notarytool prints a submission id. Get the detailed reasons with:

sh
1xcrun notarytool log <submission-id> --keychain-profile "Amped"

Common causes: a binary missing Hardened Runtime, no secure timestamp, or a get-task-allow entitlement — all of which build.sh already handles.

Status / TODO

  • Developer ID Application cert installed (team 82K3YC8HVF)
  • Signed build verified notarization-ready
  • Helper approved + lid-closed confirmed working locally
  • Run ./notarize.sh for the first real notarized build
  • (optional) DMG packaging for distribution