Build, notarize and publish v0.3.1 #182

Activity

1. sudoHG

   added

   ready-for-humanRequires the maintainer (real data, devices, accounts)Requires the maintainer (real data, devices, accounts)

   on Oct 11, 2026
2. sudoHG

   closed this as completedin #183on Oct 11, 2026
3. luoji-bot commented on Oct 11, 2026

   

   luoji-botbot

   on Oct 11, 2026

   More actions

   Release receipt (Codex executor on the maintainer's Mac, with the maintainer's approval relayed through Orca at each gated step). Signing identity, Team ID, notarization credentials and library contents are kept off this issue.

   • Released commit: 227edf46ee1a24eae0c98777895287c9c35f9596, version PR #183, annotated tag v0.3.1 (Tagger sudoHG <by331works@gmail.com>). Push CI: both build-and-test and basic-ui-flows passed; Swift 1,127 passed, 0 failed, 3 unchanged opt-in skips; Automation 183 passed; required desktop flows 15 passed, 0 failed, 0 skipped.
   • Contents and review: Restore pending request review after time away #181 is the only product fix since v0.3.0; Polish approval cards after the v0.3.0 review #176, Return a specific error when an agent creates a duplicate name #179, Fix issues deferred from the v0.2.0 pre-release review #158 and Store bundle delivery mappings as separate encrypted metadata #137 are excluded. The maintainer waived the full independent pre-release review for this patch in Build, notarize and publish v0.3.1 #182.
   • Version validation: local swift build -j 2 passed; swift test -j 2 --filter HelperMCPConnectionTests: 4 passed, 0 failed, 0 skipped; product-version Automation tests: 5 passed, 0 failed, 0 skipped; hygiene, module dependencies and diff checks passed. PR CI: both jobs passed; Swift 1,127 passed, 0 failed, 3 opt-in skips, identical to the base; Automation 183 passed; required desktop flows 15 passed, 0 failed, 0 skipped. No full local suite or local desktop E2E was run.
   • Build: ASKKEY_RELEASES_ENABLED=true bash scripts/build-app.sh Release; implicit release gate passed against the exact push CI and tag. Version/build 0.3.1, strict code signatures and hardened runtime verified for the app and helper. Installed at /Applications/Ask Key.app after quitting the previous app and moving it to the Trash; registered with Launch Services and launched with env -i. App CDHash 69cf55b0104887996d5a5f79b42867833f5ab0ff; helper CDHash cf3c9ec13966ee7ab99c0143206e4e1f54c9f0de.
   • Device checks (maintainer present): Info.plist version/build 0.3.1; askkey status reported protocol 1; askkey health reported ok; Spotlight kMDItemDisplayName was 请旨; MCP initialize returned serverInfo {name: askkey, version: 0.3.1}. The installed helper's run --wait-for-approval --credential "审批链路测试" ... -- /bin/echo ok visibly waited for approval, then exited 0 and printed only ok.
   • Package: package-release.sh --notary-credential "App Store Connect API凭证（发布）" completed both approved submissions. App and DMG notarized and stapled. Both checksum files passed shasum -a 256 -c; cmp confirmed byte-identical stable and versioned DMGs (9,564,187 bytes each), SHA-256 6767fca7ea48b626a1c07eb8f8cf8a0f0e64f5e46f2f724b11908c5583585f9c. Independent staple and Gatekeeper checks passed for the DMG and its inner app. A read-only, non-browsing DMG mount showed version 0.3.1 and app CDHash 69cf55b0104887996d5a5f79b42867833f5ab0ff, identical to the installed tested build; it was detached afterwards.
   • Release and anonymous verification: v0.3.1 published as Latest with short bilingual notes and exactly four assets. All four uploaded sizes and SHA-256 digests matched the verified candidates. All four files were re-downloaded anonymously with an empty environment except PATH, curlrc disabled and no authentication headers; the stable files used releases/latest/download/AskKey.dmg and its checksum. Every download was byte-identical to its candidate, both checksum files passed, and the downloaded DMG was accepted by Gatekeeper as Notarized Developer ID.
   • Post-publication staple recheck: Codex's rechecks timed out on the network. The planner re-downloaded releases/latest/download/AskKey.dmg anonymously afterwards: checksum OK, stapler validate worked, and Gatekeeper accepted it as Notarized Developer ID.
   • Cleanup: task-owned build and DerivedData removed (1.78 GiB), then publication/download temporary files removed (36.54 MiB). The checkout is clean at the released commit; no task build, test, packaging or verification process remains. Current data-volume free space: 374Gi (df -h). One unrelated shared testmanagerd service remains untouched; the previous app is in the Trash as requested. The installed 0.3.1 app remains running; worktree/branch release is left to the coordinator.

   Follow-ups remain #176, #179, #158 and #137.