SPB Git

spb/zyquo-cloud Public MIT

Native macOS AI chat client for 12 cloud providers — your keys, every cloud model, one beautiful chat.

macosswiftaichat
Swift 97.4% Shell 1.7% Makefile 1%
2.0 KB
View source Raw Blame History

# Signing & Notarization — extracted from zyquo-term (Phase 8 reference)

Inspected /Users/simon-pierreboucher/Desktop/other/OTHER/zyquo-term on 2026-07-30. Both the certificate and the notary profile were verified present and working on this machine (security find-identity lists the cert; notarytool history shows a recent Accepted submission).

# Values to reuse

Item Value
Signing identity Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)
Team ID 3YM54G49SN
notarytool credentials Keychain profile MacLustr-Notarize (stored in login keychain — no Apple ID/password needed in scripts)
Entitlements pattern Hardened runtime at signing time; minimal entitlements plist (zyquo-term ships only com.apple.security.cs.allow-jit = false; no sandbox). Zyquo Cloud needs no extra entitlements either — outbound network needs none outside the sandbox.

# Pipeline (from zyquo-term scripts/notarize.sh + scripts/package-app.sh)

  1. swift build -c release → assemble dist/Zyquo Cloud.app (Contents/MacOS/ZyquoCloud, Info.plist, Resources/AppIcon.icns, SPM .bundle resources copied into Resources).
  2. Sign nested executables first, then the bundle: codesign --force --options runtime --timestamp --entitlements <plist> --sign "Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)" <target>
  3. codesign --verify --deep --strict --verbose=2
  4. DMG: copy app + /Applications symlink into temp dir → hdiutil create -volname ... -format UDZO → codesign the DMG.
  5. xcrun notarytool submit <dmg-or-zip> --keychain-profile "MacLustr-Notarize" --wait
  6. xcrun stapler staple the DMG and the .app; verify with spctl -a -vv ("Notarized Developer ID").

zyquo-term notarizes the DMG (app stapled too). For Zyquo Cloud, make release will do: zip via ditto -c -k --keepParent for notarization, staple the app, then optionally build + notarize the DMG.