release: enable the Portal download for v0.1.1 - #143
Merged
Conversation
Flips website/portal-release.json to the published v0.1.1 build, which is what takes goq.sh's download button out of its disabled state. The runbook asks for the artifact to be verified before this flip rather than after, so the bytes were checked as a stranger receives them: SHA-256 recomputed against the published checksum, `gh attestation verify` clean, and the app inside the mounted DMG reports Signature=adhoc with identifier sh.goq.portal. `spctl --assess` rejects it, which is the documented and expected result for an ad-hoc build that is deliberately not notarized. The Sigil install note also stops calling the signed channel pending, since v0.1.1 published it and install-sigil now pins that tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Flips
website/portal-release.jsonto the published v0.1.1 build — this is what enables goq.sh's download button.Verified before flipping, not after
The runbook wants the artifact checked as a stranger receives it:
d354f4df…1436afb2✓gh attestation verify --repo FelineStateMachine/goq✓Signature=adhoc,Identifier=sh.goq.portal✓spctl --assess→ rejected, which is the correct and documented result for an ad-hoc build that is deliberately not notarizedAlso retires
signed release channel pendingfrom the Sigil note — v0.1.1 published it andinstall-sigilpins that tag.verify-portal-release.py websiteandwebsite_static_gate=ok.