zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

build(release): simplify v0.1.0 visible assets
Client Quality Gates / Shared client and Web (push) Has been cancelled
Details
Client Quality Gates / macOS Desktop (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Cheng Zhou
2026-07-17 12:40:16 +08:00
parent e3489f3b06
commit 795e0a75ca
8 changed files with 65 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guides/client-release.md
+23 -10
View File
@@ -163,26 +163,39 @@ Platform signing defaults to `signed`. An exception is allowed only when
`frontend/desktop-release-policy.json` names the exact product version and
records release-owner approval. The current v0.1.0 exception uses macOS ad-hoc
signing and unsigned Windows application/installer binaries. Its artifact names
and release directory contain `UNSIGNED-PLATFORM`; the directory must include
`UNSIGNED-PLATFORM-RELEASE.txt`, `DESKTOP-RELEASE-PROVENANCE.json`, and
`SHA256SUMS.txt`. This does not establish Apple or Microsoft publisher trust,
and Gatekeeper or SmartScreen warnings are expected. Later versions return to
the signed default unless separately approved.
and verified updater release directory contain `UNSIGNED-PLATFORM`; the private
evidence/update directory must include `UNSIGNED-PLATFORM-RELEASE.txt`,
`DESKTOP-RELEASE-PROVENANCE.json`, and the full `SHA256SUMS.txt`. The
user-facing GitHub Release may use the exact-version
`installer-and-checksum-only` profile, with platform warnings in Release Notes
and a separate checksum manifest covering only the displayed installer. This
does not establish Apple or Microsoft publisher trust, and Gatekeeper or
SmartScreen warnings are expected. Later versions return to the signed default
unless separately approved.
### v0.1.0 staged macOS contingency
The release owner approved one additional v0.1.0 contingency for unavailable
hosted Actions capacity. A controlled local macOS host may build the macOS
ad-hoc artifacts from the immutable final `v0.1.0` tag and publish them first.
That initial GitHub Release must include the DMG, updater package and `.sig`,
`SHA256SUMS.txt`, provenance, the unsigned-platform warning, and an explicit
Windows-pending notice. Windows must later be built from the same tag and SHA.
That initial user-facing GitHub Release contains only the DMG and a
`SHA256SUMS.txt` that covers the DMG, in addition to GitHub's automatic source
archives. The Release Notes must state that macOS is ad-hoc/not notarized and
that Windows remains pending. The macOS updater package and `.sig`, full
checksum manifest, provenance, unsigned-platform warning, and Windows-pending
notice must be copied to a permission-restricted, Git-ignored private release
directory before any visible asset is removed. Windows must later be built from
the same tag and SHA.
The staged macOS release is an installer distribution, not an activated
cross-platform updater release. Do not upload or replace production
`latest.json` until the Windows `NotSigned` installer/updater has been built and
the combined macOS/Windows feed passes full verification. This fallback is
limited to v0.1.0 and does not authorize local formal builds for later versions.
the combined macOS/Windows feed passes full verification. The combined updater
artifacts, signatures, provenance, full checksum manifest, and `latest.json`
must use a separately configured HTTPS update origin that anonymous production
clients can read; a private GitHub Release is not a valid production updater
origin. This fallback is limited to v0.1.0 and does not authorize local formal
builds for later versions.
## Windows Release and Internal Validation