Claude 3c422b1824 ci(cli): surface notary log on non-Accepted; record signing validation ...

macOS validation (Developer ID D77MCV9NZ7) confirmed the hardened-runtime
entitlements are correct and load-bearing: amy init derives a secp256k1 key
cleanly, and dropping disable-library-validation reproduces the runtime
dlopen Team-ID failure. The one unverified gap is whether Apple's notary
service accepts the unsigned Mach-O dylibs embedded inside lib/*.jar
(secp256k1/jna/sqlite/skiko), which it inspects recursively.

- create-release.yml: the notarize step now submits with --output-format json,
  and on any non-Accepted status dumps `notarytool log` (per-file issues) and
  fails — so the first real run names the offending files instead of failing
  opaquely. No speculative in-jar signing yet; gather the log first.
- BUILDING.md: record the validation result, the embedded-jar-native risk, the
  one-run way to decide it (workflow_dispatch dry_run with MAC_* secrets), and
  the staged fixes (sign-in-jar and/or strip the skiko/Compose leak). Note the
  desktop app shares the same jars and needs its own dry-run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015sso31DfSF9B6EFCVkEqWD

2026-06-18 00:49:26 +00:00

..

actions

feat(cli): codesign + notarize the macOS amy tarball

2026-06-18 00:21:58 +00:00

ISSUE_TEMPLATE

Update bug_report.md

2025-04-12 15:56:51 +01:00

workflows

ci(cli): surface notary log on non-Accepted; record signing validation

2026-06-18 00:49:26 +00:00

dependabot.yml

feat(release): expand desktop distribution to 8 assets + 2 package managers

2026-04-16 14:54:51 +03:00

PULL_REQUEST_TEMPLATE.md

docs(contributing): add CONTRIBUTING-WITH-AI.md companion guide

2026-05-11 20:24:47 +02:00