build(desktop): allow controlled unsigned v0.1.0 release

.github/workflows/desktop-release-candidate.yml

@@ -19,8 +19,35 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  release-policy:
+    name: Resolve desktop release signing policy
+    runs-on: ubuntu-latest
+    outputs:
+      platform_signing_mode: ${{ steps.policy.outputs.platform_signing_mode }}
+      macos_signing: ${{ steps.policy.outputs.macos_signing }}
+      windows_signing: ${{ steps.policy.outputs.windows_signing }}
+      artifact_label: ${{ steps.policy.outputs.artifact_label }}
+      warning_required: ${{ steps.policy.outputs.warning_required }}
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout release source
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.13"
+
+      - name: Resolve version-scoped signing policy
+        id: policy
+        shell: bash
+        run: npm run desktop:release-policy:check -- --require-tag --github-output "${GITHUB_OUTPUT}"
+
   macos-release-candidate:
-    name: Signed macOS release candidate
+    name: macOS release candidate
+    needs: release-policy
     runs-on: macos-latest
     defaults:
       run:
@@ -29,7 +56,11 @@ jobs:
       VITE_BUILD_CHANNEL: release
       VITE_BUILD_COMMIT: ${{ github.sha }}
       RELEASE_BUILD: "true"
-      REQUIRE_DESKTOP_SIGNING: "true"
+      DESKTOP_RELEASE_PLATFORM: macos
+      DESKTOP_PLATFORM_SIGNING_MODE: ${{ needs.release-policy.outputs.platform_signing_mode }}
+      REQUIRE_UPDATER_SIGNING: "true"
+      REQUIRE_DESKTOP_SIGNING: ${{ needs.release-policy.outputs.platform_signing_mode == 'signed' && 'true' || 'false' }}
+      ALLOW_UNSIGNED_PLATFORM_RELEASE: ${{ needs.release-policy.outputs.platform_signing_mode == 'unsigned-exception' && 'true' || 'false' }}
       DESKTOP_UPDATE_BASE_URL: ${{ github.event_name == 'workflow_dispatch' && inputs.artifact_base_url || vars.DESKTOP_UPDATE_BASE_URL }}
       TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
       TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
@@ -54,7 +85,7 @@ jobs:
         shell: bash
         run: |
           if [[ "${GITHUB_REF_TYPE}" != "tag" ]]; then
-            echo "Signed desktop release candidates must run from a vX.Y.Z tag."
+            echo "Desktop release candidates must run from a vX.Y.Z tag."
             exit 1
           fi
           expected_tag="v$(node -p "require('./package.json').version")"
@@ -77,7 +108,7 @@ jobs:
       - name: Check release build metadata and signing environment
         run: npm run release:env:check
 
-      - name: Check signed desktop release readiness
+      - name: Check desktop release readiness
         run: npm run desktop:release-readiness:check
 
       - name: Check synchronized client version
@@ -101,9 +132,14 @@ jobs:
       - name: Build Web artifact
         run: npm run build
 
-      - name: Build signed and notarized Universal macOS artifacts
+      - name: Build Apple-signed and notarized Universal macOS artifacts
+        if: needs.release-policy.outputs.platform_signing_mode == 'signed'
         run: npm run desktop:build:macos-release -- --ci
 
+      - name: Build ad-hoc Universal macOS artifacts
+        if: needs.release-policy.outputs.platform_signing_mode == 'unsigned-exception'
+        run: npm run desktop:build:macos-unsigned-release -- --ci
+
       - name: Verify and stage macOS artifacts
         shell: bash
         run: |
@@ -111,28 +147,46 @@ jobs:
           artifact="$(find src-tauri/target -path '*/release/bundle/macos/*.app.tar.gz' -print -quit)"
           dmg="$(find src-tauri/target -path '*/release/bundle/dmg/*.dmg' -print -quit)"
           if [[ -z "${app}" || -z "${artifact}" || -z "${dmg}" || ! -s "${artifact}.sig" ]]; then
-            echo "Signed macOS app, updater artifact/signature, and DMG are all required."
+            echo "macOS app, updater artifact/signature, and DMG are all required."
             exit 1
           fi
 
           codesign --verify --deep --strict --verbose=2 "${app}"
-          spctl --assess --type execute --verbose=2 "${app}"
-          xcrun stapler validate "${app}"
-          xcrun stapler validate "${dmg}"
+          if [[ "${DESKTOP_PLATFORM_SIGNING_MODE}" == "signed" ]]; then
+            spctl --assess --type execute --verbose=2 "${app}"
+            xcrun stapler validate "${app}"
+            xcrun stapler validate "${dmg}"
+          else
+            signature_info="$(codesign -dv --verbose=4 "${app}" 2>&1)"
+            if ! grep -q "Signature=adhoc" <<<"${signature_info}"; then
+              echo "The macOS unsigned-platform exception must produce an ad-hoc signed app."
+              exit 1
+            fi
+          fi
 
           stage="src-tauri/target/desktop-release-macos"
           mkdir -p "${stage}"
-          cp "${artifact}" "${artifact}.sig" "${dmg}" "${stage}/"
+          if [[ "${DESKTOP_PLATFORM_SIGNING_MODE}" == "unsigned-exception" ]]; then
+            artifact_name="$(basename "${artifact}" .app.tar.gz)_UNSIGNED.app.tar.gz"
+            dmg_name="$(basename "${dmg}" .dmg)_UNSIGNED.dmg"
+            cp "${artifact}" "${stage}/${artifact_name}"
+            cp "${artifact}.sig" "${stage}/${artifact_name}.sig"
+            cp "${dmg}" "${stage}/${dmg_name}"
+            cp desktop-release-unsigned-warning.txt "${stage}/UNSIGNED-PLATFORM-RELEASE.txt"
+          else
+            cp "${artifact}" "${artifact}.sig" "${dmg}" "${stage}/"
+          fi
 
-      - name: Upload signed macOS candidate artifacts
+      - name: Upload macOS candidate artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: ctms-desktop-macos-${{ github.ref_name }}
+          name: ctms-desktop-macos-${{ github.ref_name }}-${{ needs.release-policy.outputs.artifact_label }}
           path: frontend/src-tauri/target/desktop-release-macos/*
           if-no-files-found: error
 
   windows-release-candidate:
-    name: Signed Windows release candidate
+    name: Windows release candidate
+    needs: release-policy
     runs-on: windows-latest
     defaults:
       run:
@@ -141,7 +195,11 @@ jobs:
       VITE_BUILD_CHANNEL: release
       VITE_BUILD_COMMIT: ${{ github.sha }}
       RELEASE_BUILD: "true"
-      REQUIRE_WINDOWS_SIGNING: "true"
+      DESKTOP_RELEASE_PLATFORM: windows
+      DESKTOP_PLATFORM_SIGNING_MODE: ${{ needs.release-policy.outputs.platform_signing_mode }}
+      REQUIRE_UPDATER_SIGNING: "true"
+      REQUIRE_WINDOWS_SIGNING: ${{ needs.release-policy.outputs.platform_signing_mode == 'signed' && 'true' || 'false' }}
+      ALLOW_UNSIGNED_PLATFORM_RELEASE: ${{ needs.release-policy.outputs.platform_signing_mode == 'unsigned-exception' && 'true' || 'false' }}
       DESKTOP_UPDATE_BASE_URL: ${{ github.event_name == 'workflow_dispatch' && inputs.artifact_base_url || vars.DESKTOP_UPDATE_BASE_URL }}
       TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
       TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
@@ -163,7 +221,7 @@ jobs:
         shell: pwsh
         run: |
           if ($env:GITHUB_REF_TYPE -ne "tag") {
-            throw "Signed desktop release candidates must run from a vX.Y.Z tag."
+            throw "Desktop release candidates must run from a vX.Y.Z tag."
           }
           $expectedTag = "v$(node -p "require('./package.json').version")"
           if ($env:GITHUB_REF_NAME -ne $expectedTag) {
@@ -182,7 +240,7 @@ jobs:
       - name: Check release build metadata and signing environment
         run: npm run release:env:check
 
-      - name: Check signed desktop release readiness
+      - name: Check desktop release readiness
         run: npm run desktop:release-readiness:check
 
       - name: Check synchronized client version
@@ -207,6 +265,7 @@ jobs:
         run: npm run build
 
       - name: Import Windows code-signing certificate
+        if: needs.release-policy.outputs.platform_signing_mode == 'signed'
         shell: pwsh
         run: |
           $pfxPath = Join-Path $env:RUNNER_TEMP "ctms-windows-signing.pfx"
@@ -233,6 +292,7 @@ jobs:
           Remove-Item $pfxPath -Force
 
       - name: Write signed Windows Tauri config
+        if: needs.release-policy.outputs.platform_signing_mode == 'signed'
         shell: pwsh
         run: |
           $config = @{
@@ -249,10 +309,16 @@ jobs:
           Get-Content "tauri.windows.release.conf.json"
 
       - name: Build signed Windows NSIS artifacts
+        if: needs.release-policy.outputs.platform_signing_mode == 'signed'
         timeout-minutes: 30
         run: npm run desktop:build:windows-release -- --config tauri.windows.release.conf.json --ci
 
-      - name: Verify Authenticode and stage Windows artifacts
+      - name: Build unsigned Windows NSIS artifacts
+        if: needs.release-policy.outputs.platform_signing_mode == 'unsigned-exception'
+        timeout-minutes: 30
+        run: npm run desktop:build:windows-release -- --ci
+
+      - name: Verify platform signing mode and stage Windows artifacts
         shell: pwsh
         run: |
           $bundleDir = "src-tauri/target/release/bundle/nsis"
@@ -270,14 +336,27 @@ jobs:
 
           foreach ($executable in @($appExecutables + $installers)) {
             $signature = Get-AuthenticodeSignature -FilePath $executable.FullName
-            if ($signature.Status -ne "Valid" -or -not $signature.SignerCertificate -or -not $signature.TimeStamperCertificate) {
-              throw "Authenticode signature or RFC 3161 timestamp is invalid for $($executable.FullName): $($signature.StatusMessage)"
+            if ($env:DESKTOP_PLATFORM_SIGNING_MODE -eq "signed") {
+              if ($signature.Status -ne "Valid" -or -not $signature.SignerCertificate -or -not $signature.TimeStamperCertificate) {
+                throw "Authenticode signature or RFC 3161 timestamp is invalid for $($executable.FullName): $($signature.StatusMessage)"
+              }
+            } elseif ($signature.Status -ne "NotSigned") {
+              throw "The Windows unsigned-platform exception must produce an Authenticode-unsigned executable: $($executable.FullName) returned $($signature.Status)."
             }
           }
 
           $stage = "src-tauri/target/desktop-release-windows"
           New-Item -ItemType Directory -Path $stage -Force | Out-Null
-          Copy-Item $installers[0].FullName, $updaters[0].FullName, $signaturePath -Destination $stage
+          if ($env:DESKTOP_PLATFORM_SIGNING_MODE -eq "unsigned-exception") {
+            $installerName = $installers[0].Name -replace '\.exe$', '_UNSIGNED.exe'
+            $updaterName = $updaters[0].Name -replace '\.nsis\.zip$', '_UNSIGNED.nsis.zip'
+            Copy-Item $installers[0].FullName -Destination (Join-Path $stage $installerName)
+            Copy-Item $updaters[0].FullName -Destination (Join-Path $stage $updaterName)
+            Copy-Item $signaturePath -Destination (Join-Path $stage "$updaterName.sig")
+            Copy-Item "desktop-release-unsigned-warning.txt" -Destination (Join-Path $stage "UNSIGNED-PLATFORM-RELEASE.txt")
+          } else {
+            Copy-Item $installers[0].FullName, $updaters[0].FullName, $signaturePath -Destination $stage
+          }
 
       - name: Remove Windows signing certificate
         if: always()
@@ -289,16 +368,17 @@ jobs:
           Remove-Item (Join-Path $env:RUNNER_TEMP "ctms-windows-signing.pfx") -Force -ErrorAction SilentlyContinue
           Remove-Item "tauri.windows.release.conf.json" -Force -ErrorAction SilentlyContinue
 
-      - name: Upload signed Windows candidate artifacts
+      - name: Upload Windows candidate artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: ctms-desktop-windows-${{ github.ref_name }}
+          name: ctms-desktop-windows-${{ github.ref_name }}-${{ needs.release-policy.outputs.artifact_label }}
           path: frontend/src-tauri/target/desktop-release-windows/*
           if-no-files-found: error
 
   aggregate-release-candidate:
     name: Verify combined desktop release directory
     needs:
+      - release-policy
       - macos-release-candidate
       - windows-release-candidate
     runs-on: ubuntu-latest
@@ -316,18 +396,21 @@ jobs:
         with:
           node-version: "22.13"
 
-      - name: Download signed macOS candidate artifacts
+      - name: Download macOS candidate artifacts
         uses: actions/download-artifact@v4
         with:
-          name: ctms-desktop-macos-${{ github.ref_name }}
+          name: ctms-desktop-macos-${{ github.ref_name }}-${{ needs.release-policy.outputs.artifact_label }}
           path: frontend/src-tauri/target/desktop-release-input/macos
 
-      - name: Download signed Windows candidate artifacts
+      - name: Download Windows candidate artifacts
         uses: actions/download-artifact@v4
         with:
-          name: ctms-desktop-windows-${{ github.ref_name }}
+          name: ctms-desktop-windows-${{ github.ref_name }}-${{ needs.release-policy.outputs.artifact_label }}
           path: frontend/src-tauri/target/desktop-release-input/windows
 
+      - name: Create desktop release provenance
+        run: npm run desktop:release-provenance:create -- --macos-signing "${{ needs.release-policy.outputs.macos_signing }}" --windows-signing "${{ needs.release-policy.outputs.windows_signing }}" --output src-tauri/target/desktop-release-input/DESKTOP-RELEASE-PROVENANCE.json
+
       - name: Create combined desktop update feed
         shell: bash
         run: |
@@ -340,20 +423,32 @@ jobs:
             exit 1
           fi
 
+          include_args=(--include "${dmgs[0]}" --include "${installers[0]}" --include src-tauri/target/desktop-release-input/DESKTOP-RELEASE-PROVENANCE.json)
+          notes_args=()
+          if [[ "${{ needs.release-policy.outputs.warning_required }}" == "true" ]]; then
+            mapfile -t warnings < <(find src-tauri/target/desktop-release-input/macos -name 'UNSIGNED-PLATFORM-RELEASE.txt' -type f)
+            if [[ ${#warnings[@]} -ne 1 ]]; then
+              echo "The unsigned-platform release warning is required."
+              exit 1
+            fi
+            include_args+=(--include "${warnings[0]}")
+            notes_args+=(--notes "UNSIGNED PLATFORM RELEASE: macOS is ad-hoc signed and not notarized; Windows is not Authenticode-signed. Gatekeeper and SmartScreen warnings are expected. Verify tag, commit, updater signatures, and SHA256SUMS.txt before installation.")
+          fi
+
           npm run desktop:update-feed:create -- \
             --artifact "${mac_artifacts[0]}" \
             --platform-artifact "windows-x86_64=${windows_artifacts[0]}" \
-            --include "${dmgs[0]}" \
-            --include "${installers[0]}" \
+            "${include_args[@]}" \
+            "${notes_args[@]}" \
             --output-dir src-tauri/target/desktop-release-feed \
             --base-url "${DESKTOP_UPDATE_BASE_URL}"
 
       - name: Verify combined desktop update feed
-        run: npm run desktop:update-feed:check -- --feed src-tauri/target/desktop-release-feed/latest.json --artifacts-dir src-tauri/target/desktop-release-feed --base-url "${DESKTOP_UPDATE_BASE_URL}" --require-platform windows-x86_64
+        run: npm run desktop:update-feed:check -- --feed src-tauri/target/desktop-release-feed/latest.json --artifacts-dir src-tauri/target/desktop-release-feed --base-url "${DESKTOP_UPDATE_BASE_URL}" --require-platform windows-x86_64 --require-provenance
 
       - name: Upload verified desktop release directory
         uses: actions/upload-artifact@v4
         with:
-          name: ctms-desktop-release-${{ github.ref_name }}
+          name: ctms-desktop-release-${{ github.ref_name }}-${{ needs.release-policy.outputs.artifact_label }}
           path: frontend/src-tauri/target/desktop-release-feed/*
           if-no-files-found: error