Public, static update hosting for CodexCompanion. The application source remains in a separate private repository.
stable/appcast.xml— stable-channel Sparkle feed, created only when a verified release existsbeta/appcast.xml— beta-channel Sparkle feed, created only when a verified beta existsdownloads/<version>/— notarized, stapled release archives and optional DMGsrelease-notes/<version>.html— public release notes
Placeholder files keep the empty channel directories visible. They are not appcasts and contain no release items.
Nothing may be published until all of these gates pass:
- Build the release from the private source repository at a recorded commit.
- Sign the app and distribution artifacts with the intended Developer ID identity.
- Verify the app signature and designated requirement with
codesign. - Submit the distribution artifact to Apple and receive an accepted notarization result.
- Staple and validate the notarization ticket on the distributed app or DMG.
- Verify the final artifact with
spctland re-check its cryptographic checksum. - Sign the Sparkle archive with the configured EdDSA key and verify the generated signature.
- Generate the channel appcast using only the final public HTTPS artifact and release-note URLs.
- Stage the versioned artifact, release notes, and appcast together in a review branch.
- Confirm there are no credentials, private paths, source files, internal logs, or private metadata in the staged tree.
- Merge to
main, wait for GitHub Pages deployment, and verify every public URL over HTTPS. - Run the manual in-app update test from an older signed build and retain rollback instructions.
If any signing, notarization, stapling, Gatekeeper, Sparkle-signature, or HTTPS check fails, publication stops. An older valid appcast remains untouched.
See PUBLISHING.md for the repeatable release procedure.