George Lambert
dcee1918dc
Some checks failed
windows-msi / full-msi-unsigned (push) Has been cancelled
DUAL-SHIP exit criteria A–E; notary CI sketch with secret names only.
109 lines
4.4 KiB
Text
109 lines
4.4 KiB
Text
Verae menu bar (PT-06) — macOS
|
|
==============================
|
|
|
|
NSStatusItem that polls the IPP helper GET /status and opens GET /queue.
|
|
Does not touch IPP POST. Hold ids are never evidence.
|
|
|
|
Package version
|
|
---------------
|
|
Source of truth: internal/job.HelperVersion (currently 0.3.6).
|
|
build-menubar-app.sh reads job.go when VERSION is unset, stamps
|
|
CFBundleShortVersionString / CFBundleVersion, and writes
|
|
Contents/Resources/VERSION + packaging-metadata.txt.
|
|
Override: VERSION=x.y.z ./build-menubar-app.sh
|
|
|
|
Run now
|
|
-------
|
|
verae-print menubar
|
|
verae-print menubar --foreground
|
|
./run-menubar.sh
|
|
|
|
Install at login (LaunchAgent)
|
|
------------------------------
|
|
verae-print menubar --install
|
|
verae-print menubar --uninstall
|
|
|
|
--install copies durable assets to:
|
|
~/Library/Application Support/Verae/menubar/
|
|
and writes:
|
|
~/Library/LaunchAgents/com.verae.timestamping.menubar.plist
|
|
using launchctl bootstrap (fallback: load -w). Optional swiftc compile so
|
|
login does not need the Swift toolchain.
|
|
|
|
Optional unsigned .app
|
|
----------------------
|
|
./build-menubar-app.sh
|
|
./build-menubar-app.sh ~/Applications/Verae\ Menubar.app
|
|
VERSION=0.3.6 ./build-menubar-app.sh
|
|
open "Verae Menubar.app"
|
|
|
|
LSUIElement=true (menu bar only, no Dock). Bundle id:
|
|
ai.verae.timestamping.menubar
|
|
Not codesigned or notarized by default — local/dev use.
|
|
Login Items: System Settings → General → Login Items → +.
|
|
Prefer LaunchAgent for headless reliability.
|
|
|
|
The builder copies platform/macos/pkg/entitlements.plist into
|
|
Contents/Resources/entitlements.plist for optional signing (see below).
|
|
It does not apply codesign itself and never embeds secrets.
|
|
|
|
Codesign + notarization (document only — needs Apple certs)
|
|
-----------------------------------------------------------
|
|
Operator steps: NOTARIZE-CHECKLIST.md
|
|
CI sketch (unsigned default; notary secret names only): ci-notarize.yml.example
|
|
Copy into .github/workflows or .forgejo/workflows when enabling; not live.
|
|
|
|
You need an Apple Developer Program membership and a Developer ID
|
|
Application certificate in the keychain. This project does not ship
|
|
secrets or signing.env values. When certs are available:
|
|
|
|
1) Build the unsigned app
|
|
./build-menubar-app.sh ~/Applications/Verae\ Menubar.app
|
|
|
|
2) Codesign with hardened runtime + entitlements
|
|
APP="$HOME/Applications/Verae Menubar.app"
|
|
ENT="$APP/Contents/Resources/entitlements.plist"
|
|
# Or: platform/macos/pkg/entitlements.plist
|
|
codesign --force --deep --options runtime --timestamp \
|
|
--entitlements "$ENT" \
|
|
--sign "Developer ID Application: YOUR ORG (TEAMID)" \
|
|
"$APP"
|
|
codesign --verify --deep --strict --verbose=2 "$APP"
|
|
spctl --assess --type execute -vv "$APP" # may fail until notarized
|
|
|
|
3) Zip for notarytool (preserve symlinks / bundle layout)
|
|
ditto -c -k --keepParent "$APP" /tmp/VeraeMenubar.zip
|
|
|
|
4) Submit to Apple notary service (App Store Connect API key or
|
|
keychain profile previously configured with `xcrun notarytool store-credentials`)
|
|
xcrun notarytool submit /tmp/VeraeMenubar.zip \
|
|
--keychain-profile "verae-notary" \
|
|
--wait
|
|
# Alternative: --apple-id … --team-id … --password @keychain:AC_PASSWORD
|
|
|
|
5) Staple the ticket so Gatekeeper works offline
|
|
xcrun stapler staple "$APP"
|
|
xcrun stapler validate "$APP"
|
|
spctl --assess --type execute -vv "$APP"
|
|
|
|
6) Optional: distribute as a signed .pkg instead of a bare .app —
|
|
see platform/macos/pkg/build-pkg.sh (Developer ID Installer + productbuild).
|
|
That path also requires signing.env / Apple certs and is separate from
|
|
this menu-bar stub.
|
|
|
|
Gatekeeper notes
|
|
----------------
|
|
* Unsigned .app: right-click → Open the first time, or remove quarantine:
|
|
xattr -dr com.apple.quarantine "Verae Menubar.app"
|
|
* Hardened runtime is required for notarization; entitlements must match
|
|
network client use (loopback GET /status only — no IPP POST from the tray).
|
|
* Do not paste API keys, app-specific passwords, or .p12 material into the
|
|
repo. Keep credentials in the keychain / CI secrets store.
|
|
|
|
Files
|
|
-----
|
|
verae-menubar.swift NSStatusItem source
|
|
run-menubar.sh compile-or-interpret entry
|
|
com.verae.timestamping.menubar.plist LaunchAgent template
|
|
build-menubar-app.sh unsigned .app bundle builder
|
|
README.txt this file (incl. notarization)
|