Skip to content

Commit ee7fd9d

Browse files
niikCopilot
andcommitted
Correct pkg signing NOTE in deep-dive
The note claimed the step now passes vars.MAC_APP_SIGNING_IDENTITY, but the workflow still passes the (unset) vars.APPLE_DEVELOPER_INSTALLER_ID. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 1b7da92 commit ee7fd9d

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

docs/release-process-deep-dive.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ There are three levels of "signing" that occur in this job:
226226
> Although the job title is `Build & notarize universal macOS pkg installer`, the [`productbuild` docs](https://www.unix.com/man_page/osx/1/productbuild/) only refer to signing, thus notarization may not be the correct term here.
227227

228228
> [!NOTE]
229-
> Historically the `.pkg` installer was never actually signed because `${{ vars.APPLE_DEVELOPER_INSTALLER_ID }}` was [never set](https://github.com/cli/cli/actions/runs/13271193192/job/37050749548#step:9:11). The `Build & notarize universal macOS pkg installer` step now passes `APPLE_DEVELOPER_INSTALLER_ID: ${{ vars.MAC_APP_SIGNING_IDENTITY }}`, so `productbuild` signing runs when that repository variable is populated.
229+
> Historically the `.pkg` installer was never actually signed because `${{ vars.APPLE_DEVELOPER_INSTALLER_ID }}` was [never set](https://github.com/cli/cli/actions/runs/13271193192/job/37050749548#step:9:11). The `Build & notarize universal macOS pkg installer` step still passes `APPLE_DEVELOPER_INSTALLER_ID: ${{ vars.APPLE_DEVELOPER_INSTALLER_ID }}`, so `productbuild` signing will run once that repository variable is populated.
230230

231231
Signing of MacOS artifacts uses `codesign` and notarization uses `xcrun notarytool`, which submits the artifact to the Apple servers for additional checks.
232232

0 commit comments

Comments
 (0)