Skip to content

docs(release): unwrap v0.5.3 header prose for GitHub rendering #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryanlewis merged 1 commit into from
Aug 25, 2026
Merged

docs(release): unwrap v0.5.3 header prose for GitHub rendering #136

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 4 additions & 14 deletions .github/releases/v0.5.3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,11 @@ Infra release: no CLI changes. The binaries themselves are the feature.

### Release pipeline

- **Darwin binaries are now Developer ID–signed and notarized by Apple.**
Both architectures are signed and notarized before archiving, so the
tarballs, checksums, and provenance attestations all cover the signed
Mach-O. Gatekeeper accepts the binary without any quarantine workaround —
the cask's `xattr -d com.apple.quarantine` hack is gone. (#130)
- **Release job egress is now blocked by default** with an explicit
endpoint allowlist (previously audit-only), limiting what a compromised
dependency or action could exfiltrate — the job holds signing keys now.
(#130)
- **Darwin binaries are now Developer ID–signed and notarized by Apple.** Both architectures are signed and notarized before archiving, so the tarballs, checksums, and provenance attestations all cover the signed Mach-O. Gatekeeper accepts the binary without any quarantine workaround — the cask's `xattr -d com.apple.quarantine` hack is gone. (#130)
- **Release job egress is now blocked by default** with an explicit endpoint allowlist (previously audit-only), limiting what a compromised dependency or action could exfiltrate — the job holds signing keys now. (#130)

One caveat: bare Mach-O binaries can't have the notarization ticket
stapled, so Gatekeeper does an online check on first run. Fine for normal
installs; only bites a fully-offline first run.
One caveat: bare Mach-O binaries can't have the notarization ticket stapled, so Gatekeeper does an online check on first run. Fine for normal installs; only bites a fully-offline first run.

### Requirements

macOS with Things3 installed. Binaries for Apple Silicon (`darwin_arm64`) and
Intel (`darwin_amd64`).
macOS with Things3 installed. Binaries for Apple Silicon (`darwin_arm64`) and Intel (`darwin_amd64`).
Loading