Skip to content

Code signing and release integrity

This page describes the release path implemented by .github/workflows/release.yml. A downloadable release is built from its public tagged commit on GitHub-hosted runners after the complete Python, Node, and browser quality gate passes.

Public build location

Collie is MIT-licensed. Official builds, release rehearsals, CI, and documentation deployment run in the public colliehq/collie repository, using GitHub-hosted Windows, macOS, and Linux runners. The repository has no self-hosted runner dependency.

Workflow What it builds or validates
CI Complete Windows, macOS, and Linux test gates
Release Windows installer, macOS arm64 DMG, Python distributions, VS Code and browser extensions
Docs Strict MkDocs build and GitHub Pages deployment

Maintainers can build all release packages without publishing by running:

gh workflow run release.yml --repo colliehq/collie --ref main

For a candidate build, replace main with its pushed branch. Build logs and artifacts appear on the public Actions run. A release tag must be pushed to https://github.com/colliehq/collie.git explicitly; a checkout's origin can point at a different fork.

Published artifacts

A tagged release contains:

  • Collie-Setup.exe for Windows, signed with Azure Artifact Signing;
  • Collie-arm64.dmg for Apple-silicon Macs, Developer ID signed, notarised, and stapled;
  • Collie-VSCode.vsix for VS Code;
  • the credential-free browser extension ZIP;
  • the Python wheel and source distribution.

Stable tags additionally attempt a PyPI upload through its OpenID Connect Trusted Publishing flow, which requires a matching publisher configuration. The v0.27.0 PyPI upload was rejected with invalid-publisher; its verified Python packages are available from GitHub Releases. Prerelease tags remain GitHub-only until their channel policy is explicitly changed.

The canonical download location is the GitHub Releases page. A manual workflow run may build unsigned macOS output for diagnostics, but it does not publish a release. A tag fails instead of publishing an unsigned or un-notarised DMG.

Windows signing

The release job builds the plain Inno Setup installer, then signs it through Azure Artifact Signing using SHA-256 and an RFC 3161 timestamp. GitHub exchanges a short-lived OIDC token for the signing authority; no long-lived Azure client secret or signing private key is stored in the repository. The expected publisher is Daming Wu and the certificate chains to Microsoft's public trust infrastructure.

After signing, CI runs signtool verify /pa /v and fails if Windows does not accept the signature. Collie's Windows updater separately requires both the release asset's SHA-256 digest and a valid Authenticode signature from that publisher before it launches an installer.

macOS signing

The macOS job imports a Developer ID Application certificate into a temporary keychain and stores App Store Connect credentials only for the life of the hosted runner. build_mac.sh signs nested Mach-O files and the app, signs the DMG, submits it for notarisation, staples the ticket, and asks Gatekeeper (spctl) for the final verdict. See the Developer ID setup guide for the maintainer setup.

Release authority

Only a v* tag on the canonical colliehq/collie repository can trigger publication. The workflow first checks that the tag matches harness.__version__; every artifact job then depends on the full quality gate. Pull requests and forks cannot enter the release environment or use its signing authority.

Before the first publish, PyPI must configure a Trusted Publisher for repository colliehq/collie, workflow release.yml, environment pypi. The workflow then requests a short-lived OIDC identity and uses an exact commit-pinned PyPA publish action; there is no repository or environment PyPI token.

Verify a download

  • Download from GitHub Releases or a link on collie.run that points there.
  • Compare the file's SHA-256 with the digest shown for that release asset.
  • On Windows, open Properties → Digital Signatures and confirm a valid signature from Daming Wu. PowerShell users can also run Get-AuthenticodeSignature .\Collie-Setup.exe.
  • On macOS, spctl -a -vv -t open Collie-arm64.dmg should report an accepted notarised Developer ID artifact.

Report a problem

For a suspected tampered binary or security issue, open a minimal report on GitHub Issues with the affected release, filename, and observed digest. Do not include exploit details, credentials, or private data in a public issue; ask the maintainer to establish a private reporting channel first.