Harden release artifacts with signing, notarization, and clean-machine validation
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start with docs/releasing.md and the existing release CI configuration to see how artifacts are packaged and published. Then map the platform signing and clean-machine validation requirements to the current release steps. Done means the listed platform checks, checksums, smoke tests, and documentation reflect verified release status.
Written by the indexing model from the issue text.
Description
Context
The 0.1.0 release exists, but the packaging documentation still warns that
Windows artifacts are unsigned, the macOS DMG is ad-hoc signed rather than
notarized, and installers have not been validated on clean machines. That creates
Gatekeeper/SmartScreen friction and leaves release quality below the M5 bar.
Scope
- macOS: sign the app/DMG with a Developer ID, submit for notarization, staple the
ticket, and verify on a clean macOS VM. - Windows: sign the MSI and portable executable with Authenticode, timestamp the
signature, and verify install/uninstall/launch on clean Windows x64 and ARM64. - Linux: validate AppImage/DEB installation and runtime dependencies in clean
x64/arm64 environments, including desktop entry and icon handling. - Publish checksums and verify artifact names/versions in CI.
- Add a release checklist covering install, first launch, proxy startup, CA
creation, and uninstall/cleanup. - Keep signing credentials in repository/environment secrets, never in logs.
Acceptance criteria
- macOS package passes Gatekeeper and notarization verification.
- Windows packages show a valid publisher signature.
- Linux packages install and launch on clean target distributions.
- Release checksums and clean-machine smoke tests are documented and
automated where possible. -
docs/releasing.mdreflects the actual validation status.
- Dominant language
- Rust
- Stars
- 1
- Forks
- 0
- Avg merge
- 34m
- Merged PRs (30d)
- 66
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from andyintheshell/perseid
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 85/100
andyintheshell/perseid#73 ·
Maintainers usually reply within 1 day
-
enhancement help wanted priority: p3
Difficulty 5/5 Over a week Newbie friendliness 25/100
andyintheshell/perseid#72 ·
Maintainers usually reply within 1 day
-
enhancement priority: p3
Difficulty 5/5 Over a week Newbie friendliness 35/100
andyintheshell/perseid#71 ·
Maintainers usually reply within 1 day
-
enhancement priority: p3
Difficulty 5/5 Over a week Newbie friendliness 35/100
andyintheshell/perseid#70 ·
Maintainers usually reply within 1 day
-
accessibility enhancement help wanted priority: p2
Difficulty 5/5 Over a week Newbie friendliness 38/100
andyintheshell/perseid#69 ·
Maintainers usually reply within 1 day
All issues in andyintheshell/perseid
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
manuscript-lang/manuscript#1629 ·
Maintainers usually reply within 1 day
-
autofixer: follow-up
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
tursodatabase/turso#10885 ·
Maintainers usually reply within 1 day
-
🐞 bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
nannou-org/gantz#475 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day