From 66020bc318df9c074757b853a3845bd1c83ea061 Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Thu, 21 May 2026 00:50:11 +0000 Subject: [PATCH] changelog: document the macOS package-integrity fix Commit 57a089f6 (the GitHub #102 fix) landed without a CHANGELOG entry. Add the `[Unreleased]` / `### Fixed` line so the macOS package-integrity fix is on record before the v0.3.1 cut. --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a1e9bc4..3402e90 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -69,6 +69,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 opt out of the debug split package and declare the `*-debug` variant as a conflict, so a stale debug build cannot own installed files across a package switch. +- macOS package build: the `.pkg` architecture is now derived from + the Cargo `--target` triple instead of the build host's + `uname -m`. The arm64 and x86_64 release legs build on the same + Apple-silicon runner, so `uname -m` named both outputs + `fips-0.3.0-macos-arm64.pkg`; the release job's `merge-multiple` + artifact download then interleaved the two identically named + files into a single corrupt xar archive, and no x86_64 package + reached the release at all. (This shipped as the broken v0.3.0 + macOS `.pkg`, GitHub #102.) The release workflow now also asserts + the arch-named file is present and carries a SHA-256 integrity + chain from the build runner through to `gh release upload`, so a + recurrence fails CI instead of publishing. - Nostr discovery: filter unroutable direct UDP/TCP advert endpoints. Publisher and validator now retain only endpoints that parse as concrete socket addresses with routable IPs and nonzero ports.