Right now scripts/release.sh zips an app that was archived, signed, and notarized locally in Xcode, then uploads it with gh release create. That works, but it makes the build machine the trust root: there is nothing connecting Squirrel Trap.zip to the commit it was built from, so someone who wants to verify the binary matches the source they just read has no way to do it.
GitHub can close that gap directly. Building in Actions and adding a provenance attestation step means anyone can run:
gh attestation verify "Squirrel Trap.app" --repo jtoeman/squirreltrap
and get back the commit SHA and workflow that produced it.
Rough shape:
- Move the
xcodebuild archive / -exportArchive steps into a workflow triggered on tag push
- Store the Developer ID cert and notarytool credentials as repo secrets
- Add
actions/attest-build-provenance after the export step
- Keep
release.sh as the local fallback
This matters more than usual for this app because it asks for Input Monitoring. The source is careful and easy to audit, but auditing the source only helps if you can tell that the download corresponds to it.
Right now
scripts/release.shzips an app that was archived, signed, and notarized locally in Xcode, then uploads it withgh release create. That works, but it makes the build machine the trust root: there is nothing connectingSquirrel Trap.zipto the commit it was built from, so someone who wants to verify the binary matches the source they just read has no way to do it.GitHub can close that gap directly. Building in Actions and adding a provenance attestation step means anyone can run:
and get back the commit SHA and workflow that produced it.
Rough shape:
xcodebuild archive/-exportArchivesteps into a workflow triggered on tag pushactions/attest-build-provenanceafter the export steprelease.shas the local fallbackThis matters more than usual for this app because it asks for Input Monitoring. The source is careful and easy to audit, but auditing the source only helps if you can tell that the download corresponds to it.