mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-24 12:42:49 +00:00
rcourtman
b74789fcc6
On 2 Oct 2026 v6.4.6-rc.1 failed notarization because the Apple developer agreement was unsigned, about an hour into the release. The maintainer's nightly release rehearsal now dispatches release-signing-preflight.yml from main on a hosted macos-15 runner. It imports the Developer ID certificate into a throwaway keychain, requires the identity to be valid and at least 30 days from expiry, signs and verifies a probe binary with a secure timestamp, and reads the notary submission history with the release key, which Apple refuses while an agreement is unsigned or the key is revoked. The four checks are independent and each reports one titled outcome, so one night names every broken credential. It builds, uploads and publishes nothing.