review: refuse to publish a bundle without a team identifier; document the allowed-teams override

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
release: NOTARIZED is 0/1, compare numerically
2026-09-05 10:06:57 +04:00 · 2026-09-05 10:03:48 +04:00 · 2026-09-05 10:03:40 +04:00
1 changed files with 9 additions and 2 deletions
@@ -359,11 +359,18 @@ SPCTL_STATUS=$?
 set -e
 echo "${SPCTL_OUTPUT}"
 if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then
-    echo "spctl did not report accepted for ${APP_BUNDLE}." >&2
+    if [[ "${NOTARIZED}" -eq 1 ]]; then
        echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2
        exit 1
    fi
    echo "WARNING: Gatekeeper does not accept this build (not notarized). First install on other Macs needs right-click > Open." >&2
 fi
 TEAM_IDENTIFIER="$(codesign -dv "${APP_BUNDLE}" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2}')"
 if [[ -z "${TEAM_IDENTIFIER}" ]]; then
    echo "No TeamIdentifier on ${APP_BUNDLE} — the build is not signed with a team identity; refusing to publish." >&2
    exit 1
 fi
 echo "==> Writing ${APPCAST_PATH}"
 python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" "${NOTARIZED}" "${TEAM_IDENTIFIER}" <<'PY'
Author	SHA1	Message	Date
Claude Fable 5	a32cd03581	review: refuse to publish a bundle without a team identifier; document the allowed-teams override Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 10:06:57 +04:00
Claude Fable 5	8a12ed0a54	release: NOTARIZED is 0/1, compare numerically Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 10:03:48 +04:00
Claude Fable 5	bfdc6fde9d	release: spctl gate only hard-fails when the build was notarized Un-notarized fallback builds (Apple Development identity) are rejected by spctl by design; the script must still publish them with a warning, otherwise the fallback path can never release. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 10:03:40 +04:00