From d76f4a95e77c9ca98365336b047a8ff48b035a46 Mon Sep 17 00:00:00 2001 From: Ryan Lewis Date: Tue, 25 Aug 2026 03:33:51 +0100 Subject: [PATCH] docs(release): unwrap v0.5.3 header prose for GitHub rendering GitHub release bodies render single newlines as hard breaks, so the 72-column wrapping rendered as ragged lines. The live release body is already fixed via 'gh release edit'; this syncs the source file. --- .github/releases/v0.5.3.md | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/.github/releases/v0.5.3.md b/.github/releases/v0.5.3.md index 0fc16c2..8a33207 100644 --- a/.github/releases/v0.5.3.md +++ b/.github/releases/v0.5.3.md @@ -4,21 +4,11 @@ Infra release: no CLI changes. The binaries themselves are the feature. ### Release pipeline -- **Darwin binaries are now Developer ID–signed and notarized by Apple.** - Both architectures are signed and notarized before archiving, so the - tarballs, checksums, and provenance attestations all cover the signed - Mach-O. Gatekeeper accepts the binary without any quarantine workaround — - the cask's `xattr -d com.apple.quarantine` hack is gone. (#130) -- **Release job egress is now blocked by default** with an explicit - endpoint allowlist (previously audit-only), limiting what a compromised - dependency or action could exfiltrate — the job holds signing keys now. - (#130) +- **Darwin binaries are now Developer ID–signed and notarized by Apple.** Both architectures are signed and notarized before archiving, so the tarballs, checksums, and provenance attestations all cover the signed Mach-O. Gatekeeper accepts the binary without any quarantine workaround — the cask's `xattr -d com.apple.quarantine` hack is gone. (#130) +- **Release job egress is now blocked by default** with an explicit endpoint allowlist (previously audit-only), limiting what a compromised dependency or action could exfiltrate — the job holds signing keys now. (#130) -One caveat: bare Mach-O binaries can't have the notarization ticket -stapled, so Gatekeeper does an online check on first run. Fine for normal -installs; only bites a fully-offline first run. +One caveat: bare Mach-O binaries can't have the notarization ticket stapled, so Gatekeeper does an online check on first run. Fine for normal installs; only bites a fully-offline first run. ### Requirements -macOS with Things3 installed. Binaries for Apple Silicon (`darwin_arm64`) and -Intel (`darwin_amd64`). +macOS with Things3 installed. Binaries for Apple Silicon (`darwin_arm64`) and Intel (`darwin_amd64`).