[akshaymaloo]

Scope

Smaller replacement for #114, targeting roster as requested in #114 (comment).

Kept

• Release-note CSP, HTTPS link policy, and nonpersistent WebKit storage, unchanged from the accepted part of Authenticate helper IPC and harden release authenticity #114.
• Ed25519 verification of the generated DMG against the exported app's public key and the appcast enclosure length. A missing appcast tool or failed verification stops the release.
• Helper message checks: 4 MiB encoded-message limit before decoding/dispatch, bounded item count/text/image data, unique item titles, and finite/bounded geometry and opacity. Both receiving call sites validate decoded commands/events before handling them.

Left unchanged

• The existing CFMessagePort transport. No sockets, temporary-directory endpoints, signature checks on helper peers, executable-path checks, or debugger restrictions.
• project.yml and Sparkle dependency selection. No Sparkle bump or new pin.
• The original spctl ... || true behavior for the stapled, non-code-signed DMG.
• Signing-tool discovery and the rest of the release pipeline. The pipeline change here is limited to update-signature verification and failing when appcast tooling is absent.

The message checks validate payloads; they deliberately do not introduce peer authentication.

Validation

On macOS 27.2 / Xcode 27.1:

• 6 HelperProtocolTests passed, including valid messages, the exact message-size boundary, oversized valid JSON, item counts, duplicate titles, UTF-8 byte lengths, image data, geometry, and event validation.
• 9 release-note app cases passed, including actual WebKit script/resource blocking. The app and both embedded helpers build successfully with Sparkle 2.9.6 (ac2def288cbff5cfc7df3ffef6abdf45b72bcb0a). The version was selected only in the ignored, generated local lockfile for this compatibility check; the PR does not change dependency configuration.
• 8 offline release/signature tests passed. These explicitly cover spctl returning exit 3 without blocking verification, invalid signatures remaining fatal, missing tooling, and cryptographic acceptance/rejection of generated and tampered fixtures.
• bash -n scripts/release.sh and git diff --check passed.

A production notarized release was not run. Release orchestration is covered by offline test doubles; update-signature verification is exercised with real Ed25519 fixtures.

[fif7y]

Hey @akshaymaloo, this is exactly the scope I was hoping for, thanks!

I ran the new update check against the real 0.3.4-beta.1 DMG and it passes, and a copy with one byte changed fails. Your tests pass too, and the release notes popover keeps its height with the new policy.

Merging it now, it should be in the next beta.