Hugging Face's logo

will-taggart
/
AFFECTOR

Text Generation
English
activation-steering
macos
emotional-geometry
Model card Files
xet
 Community
AFFECTOR / docs /APPLE_RELEASE.md
will-taggart's picture
will-taggart
Stage standalone documentation, technical paper, and source for signed release
f592f80 verified
preview code
|
Raw History Blame Contribute Delete
2.36 kB

Signing and notarizing AFFECTOR

Apple Developer ID signing identifies the publisher; notarization submits the signed archive to Apple's automated service. Stapling attaches the accepted ticket for distribution. This is separate from App Store review and does not assess output quality.

Prerequisites

  • Xcode command-line tools and an Apple Developer Program membership.
  • A Developer ID Application certificate with its private key in Keychain.
  • Notarization credentials stored in a Keychain profile. Never put passwords or private keys in the repository.

Check identities with security find-identity -v -p codesigning. The publisher identity for this release is Developer ID Application: William Taggart (HQSX3AJ8U7).

Workflow

  1. Build and test the application. Make all content changes before signing.
  2. Sign every nested Mach-O executable/library from the inside out with the Developer ID identity, secure timestamp, and hardened runtime. Then sign nested bundles and the outer app. AFFECTOR includes Python and native dependencies, so signing only the outer app is insufficient. Use the included source/macos/sign_release.py utility on a separate release copy.
  3. Verify with codesign --verify --deep --strict AFFECTOR.app.
  4. Make the upload archive: ditto -c -k --sequesterRsrc --keepParent AFFECTOR.app AFFECTOR.zip.
  5. Submit: xcrun notarytool submit AFFECTOR.zip --keychain-profile YOUR_PROFILE --output-format json.
  6. Inspect status with xcrun notarytool info SUBMISSION_ID --keychain-profile YOUR_PROFILE. Retrieve the log if rejected: xcrun notarytool log SUBMISSION_ID --keychain-profile YOUR_PROFILE notarization-log.json.
  7. Only after status is Accepted: xcrun stapler staple AFFECTOR.app and xcrun stapler validate AFFECTOR.app.
  8. Check Gatekeeper: spctl --assess --type execute --verbose=2 AFFECTOR.app. Re-create the ZIP from the stapled app, then compute SHA-256 checksums and distribute it.

Do not rebuild, edit, or re-sign a stapled app afterward; that creates a different artifact requiring a new release workflow. Keep an unchanged accepted archive and its submission record.

Official instructions: https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution and https://developer.apple.com/documentation/security/customizing-the-notarization-workflow .