07 · Release — app ticket, DMG ticket, and public download

07 · Release — app ticket, DMG ticket, and public download An architecture diagram generated by Archify. Quality gate · Tests, audits, universal archive · Architecture component Quality gate Tests, audits, universal archive Sign app · Developer ID + license materials · Architecture component Sign app Developer ID + license materials Notarize app · Accepted → staple → validate · Architecture component Notarize app Accepted → staple → validate Create DMG · Layout + already stapled app · Architecture component Create DMG Layout + already stapled app Notarize DMG · Sign → Accepted → staple · Architecture component Notarize DMG Sign → Accepted → staple Verify container · DMG AND enclosed app · Architecture component Verify container DMG AND enclosed app GitHub release · Check existing tag; upload · Architecture component GitHub release Check existing tag; upload Download fresh copy · SHA-256 + verify container again · Architecture component Download fresh copy SHA-256 + verify container again passed App ZIP App stapled final DMG DMG stapled verified download again Legend Backend Security

Code before publication

  • • PR → native CI on Apple Silicon and Intel → main → tag.
  • • release.sh builds; publish_release.sh publishes separately.

Two artifacts, two Apple tickets

  • • The app is stapled before packaging.
  • • Gatekeeper alone does not replace a ticket in the container.

The website has its own path

  • • website/ → Vite → Pages workflow → public verification.
  • • No runtime data flow exists between the website and macOS app.