shield_lock
金大哥
← 返回 Skill 列表
extension
分类: 开发与工程无需 API Key

macos-dmg-builder

构建、签名、公证并将原生macOS应用程序打包成可分发的DMG文件。当用户要求发布一个SwiftUI/AppKit/Xcode的macOS应用程序时使用，设置notarytool凭证（Apple ID应用特定密码+团队ID），搭建或运行发布脚本（`make macos-release`），或者调试Developer ID/公证失败问题。

person作者: jakexiaohubgithub
open_in_new仓库download下载资源包

macOS DMG Builder

Overview

Use this skill to create a repeatable macOS release pipeline with signed and notarized .app and .dmg artifacts.

Prefer existing project scripts first. If the project does not already have release automation, scaffold it from assets/templates/ using the bundled script.

Onboarding Walkthrough (Mandatory)

Before running release commands, collect or confirm these values. Do not skip this step.

  1. repo_root (absolute path to target repo)
  2. app_name (display name of the app in Finder/DMG)
  3. xcode_scheme (build/archive scheme)
  4. bundle_id (for entitlement/signing sanity checks)
  5. artifact_dir (where .app and .dmg should be written)
  6. team_id (Apple Developer Team ID)
  7. apple_id (Apple ID used for notarization)
  8. notary_profile (Keychain profile name for notarytool)
  9. signing_identity preference (display name or SHA-1 hash)

If any required value is missing, ask focused questions before proceeding. Use defaults only when they are verifiably correct for the repo.

Onboarding defaults for LemonNotes:

  • repo_root: /Users/jakerains/Projects/LemonNotes
  • app_name: LemonNotes
  • xcode_scheme: LemonNotesMac
  • artifact_dir: macos/.release/output
  • team_id: 47347VQHQV
  • notary_profile: LemonNotesApp-Notarize

Run preflight checks immediately after onboarding:

  • scripts/preflight_release_env.sh --profile <notary-profile>

Workflow

1) Detect existing release automation

  1. Check for scripts/macos-release.sh.
  2. Check for scripts/macos-notary-setup.sh.
  3. Check Makefile for macos-release and macos-notary-setup targets.

2) If missing, scaffold release automation

  1. Run scripts/scaffold_release_pipeline.sh --repo <repo-root>.
  2. Add --apply-makefile to append targets automatically.
  3. Add --force only when replacing existing scripts intentionally.

3) Configure notary profile (one-time per machine/profile)

  1. Run scripts/setup_notary_profile.sh.
  2. Default profile for LemonNotes is LemonNotesApp-Notarize.
  3. Use app-specific password input securely (prompt or env var) and never print it in output.

4) Run release

  1. Run make macos-release from repo root.
  2. Confirm phases:
  • archive
  • app notarization/stapling
  • DMG creation/signing
  • DMG notarization/stapling

5) Verify and report

  1. Run scripts/verify_release_artifacts.sh.
  2. Report:
  • output paths
  • notarization/staple validation status
  • SHA256 of DMG

Credential and Security Rules

  • Never echo app-specific passwords to terminal output.
  • Prefer prompting interactively for secrets.
  • If a user shares a password in chat, use it only for immediate setup and avoid repeating it.
  • Prefer app-specific notary profiles (e.g., LemonNotesApp-Notarize) over reusing unrelated profile names.

Troubleshooting Quick Fixes

  • Duplicate Developer ID name ambiguity:
    • Resolve to SHA-1 with security find-identity -v -p codesigning.
    • Sign with hash identity, not display name.
  • Profile not found:
    • Run scripts/check_notary_profile.sh <profile>.
    • Run scripts/setup_notary_profile.sh if missing.
  • Release script exits unexpectedly:
    • Re-run with tracing: bash -x scripts/macos-release.sh.
    • Continue from first failing phase.

LemonNotes Quick Path

  1. Run onboarding checklist from references/onboarding-playbook.md.
  2. Run make macos-notary-setup.
  3. Run make macos-release.
  4. Expect artifacts in macos/.release/output.

Read references/lemonnotes-integration.md for exact LemonNotes defaults and conventions.

Resources

  • scripts/inspect_signing_identities.sh: list usable Developer ID identities and suggested exports.
  • scripts/preflight_release_env.sh: preflight check for tools, certs, and optional notary profile.
  • scripts/check_notary_profile.sh: validate a notary profile from Keychain.
  • scripts/setup_notary_profile.sh: create/update notary profile credentials.
  • scripts/scaffold_release_pipeline.sh: install release/notary scripts into a repo.
  • scripts/verify_release_artifacts.sh: validate signatures/staples and print DMG hash.
  • references/onboarding-playbook.md: onboarding interview + zero-to-release checklist.
  • references/workflow.md: generic release flow and checks.
  • references/lemonnotes-integration.md: LemonNotes-specific defaults.
  • assets/templates/: template scripts and Makefile snippet.