docs: own the unsigned distribution, add a one-command install - #51
Merged
Conversation
Notarization needs a paid Developer ID and is not planned, so the docs stop promising it and explain the actual mechanic instead: quarantine is set by the *browser*, not by the file, which is why the command-line routes install and launch with no prompt at all. Adds a curl route for people without Homebrew. Every step is visible — nothing is piped into a shell — and it was tested end to end: no quarantine attribute on the copied app, ad-hoc signature intact, launches with no Gatekeeper block. The download buttons now point at /releases/latest/download/NotchBar.dmg, which resolves now that releases are no longer marked pre-release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Notarization needs a paid Apple Developer ID and is not planned, so the docs stop promising it in three places and explain the real mechanic instead.
The mechanic, stated plainly
Quarantine is attached by the browser, not by the file. Gatekeeper then refuses the unsigned app. That is why
--no-quarantineworks for the Homebrew cask — and why any command-line download avoids the prompt entirely. The docs now say this instead of "not notarized yet".What changed
curl+hdiutil+cp, four visible lines. Nothing is piped into a shell — the user reads every step before running it./releases/latest/download/NotchBar.dmg(works since ci(release): publish stable releases instead of pre-releases #50 dropped the pre-release flag), so the site offers a real one-click download instead of sending people to a Releases listing..dmgpath keeps its "Open Anyway" steps, reframed as the normal consequence of a browser download rather than a temporary state.Verification
/Applications: nocom.apple.quarantineattribute on the copied app,codesign --verify --strictpasses, and the app launches with no Gatekeeper block./releases/latest/download/NotchBar.dmgreturns HTTP 200 at the right size.data-i18nelement against the EN dictionary: 28 elements, zero mismatches.node --checkpasses.