Sign releases with free Apple Development identity

Restore Launch at Login for public builds by importing an Apple Development
.p12 in CI and signing the Release app with the Personal Team identity. Keep
Sparkle EdDSA as the update trust anchor and continue distributing without
notarization.

Validate the signing authority and Team ID, clean up the temporary keychain,
ignore private-key exports, document the first-launch trust model, and prepare
Elapse Recorder 1.13.2 (build 33) as the signed repair release.

Author: KrLite

.github/workflows/release.yml

@@ -13,12 +13,15 @@ concurrency:
   cancel-in-progress: false
 
 # Required repository configuration before pushing a v* tag:
-# Variable:
+# Variables:
+#   APPLE_TEAM_ID: free Personal Team identifier used by the Apple Development certificate.
 #   SPARKLE_PUBLIC_ED_KEY: output from Sparkle's generate_keys tool.
-# Secret:
+# Secrets:
+#   APPLE_DEVELOPMENT_CERTIFICATE: base64-encoded Apple Development .p12 export.
+#   APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD: password chosen when exporting the .p12.
 #   SPARKLE_PRIVATE_ED_KEY: contents of the file exported by generate_keys -x.
 # The public and private Sparkle keys must be generated as one pair.
-# Releases are intentionally Apple-unsigned and are authenticated by Sparkle EdDSA.
+# Releases are Apple Development-signed (not notarized) and Sparkle EdDSA-authenticated.
 
 jobs:
   release:
@@ -27,7 +30,10 @@ jobs:
     runs-on: macos-26
     env:
       DEVELOPER_DIR: /Applications/Xcode_26.3.app/Contents/Developer
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
       SPARKLE_PUBLIC_ED_KEY: ${{ vars.SPARKLE_PUBLIC_ED_KEY }}
+      APPLE_DEVELOPMENT_CERTIFICATE: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATE }}
+      APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD }}
       SPARKLE_PRIVATE_ED_KEY: ${{ secrets.SPARKLE_PRIVATE_ED_KEY }}
       GH_TOKEN: ${{ github.token }}
 
@@ -51,7 +57,7 @@ jobs:
         run: |
           set -euo pipefail
           missing=()
-          for name in SPARKLE_PUBLIC_ED_KEY SPARKLE_PRIVATE_ED_KEY; do
+          for name in APPLE_TEAM_ID SPARKLE_PUBLIC_ED_KEY APPLE_DEVELOPMENT_CERTIFICATE APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD SPARKLE_PRIVATE_ED_KEY; do
             if [[ -z "${!name:-}" ]]; then
               missing+=("$name")
             fi
@@ -69,6 +75,41 @@ jobs:
             echo "SPARKLE_PUBLIC_ED_KEY must decode to 32 bytes, found $decoded_length." >&2
             exit 1
           }
+          [[ "$APPLE_TEAM_ID" =~ ^[A-Z0-9]{10}$ ]] || {
+            echo "APPLE_TEAM_ID must be a 10-character team identifier." >&2
+            exit 1
+          }
+
+      - name: Import Apple Development certificate
+        shell: bash
+        run: |
+          set -euo pipefail
+          keychain="$RUNNER_TEMP/release-signing.keychain-db"
+          certificate="$RUNNER_TEMP/apple-development.p12"
+          keychain_password="$(openssl rand -hex 24)"
+          printf '%s' "$APPLE_DEVELOPMENT_CERTIFICATE" | /usr/bin/base64 -D > "$certificate"
+          test -s "$certificate"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$certificate" \
+            -k "$keychain" \
+            -P "$APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD" \
+            -T /usr/bin/codesign \
+            -T /usr/bin/security
+          security set-key-partition-list \
+            -S apple-tool:,apple: \
+            -s \
+            -k "$keychain_password" \
+            "$keychain"
+          security list-keychains -d user -s "$keychain"
+          identity_output="$(security find-identity -v -p codesigning "$keychain")"
+          printf '%s\n' "$identity_output"
+          grep -q '"Apple Development:' <<< "$identity_output" || {
+            echo "Imported .p12 does not contain a usable Apple Development identity." >&2
+            exit 1
+          }
+          echo "RELEASE_KEYCHAIN=$keychain" >> "$GITHUB_ENV"
 
       - name: Verify tag matches app version
         shell: bash
@@ -88,7 +129,7 @@ jobs:
           echo "APP_VERSION=$version" >> "$GITHUB_ENV"
           echo "APP_BUILD=$build" >> "$GITHUB_ENV"
 
-      - name: Build Apple-unsigned application
+      - name: Build Apple Development-signed application
         shell: bash
         run: |
           set -euo pipefail
@@ -106,24 +147,29 @@ jobs:
               -skipMacroValidation \
               -skipPackagePluginValidation \
               -onlyUsePackageVersionsFromResolvedFile \
-              CODE_SIGNING_ALLOWED=NO \
-              CODE_SIGNING_REQUIRED=NO \
-              CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO \
-              ENABLE_HARDENED_RUNTIME=NO \
+              CODE_SIGN_STYLE=Manual \
+              CODE_SIGN_IDENTITY='Apple Development' \
+              DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
+              OTHER_CODE_SIGN_FLAGS="--keychain $RELEASE_KEYCHAIN" \
               SPARKLE_PUBLIC_ED_KEY="$SPARKLE_PUBLIC_ED_KEY"
 
           app="$PWD/build/DerivedData/Build/Products/Release/Elapse Recorder.app"
           [[ -d "$app" ]] || {
-            echo "Unsigned app was not produced at $app" >&2
+            echo "Signed app was not produced at $app" >&2
             exit 1
           }
-          # Mach-O binaries may receive an automatic linker ad-hoc signature even when Xcode
-          # code signing is disabled. Remove it so Sparkle uses EdDSA as the sole trust anchor.
-          codesign --remove-signature "$app"
-          if codesign -dv "$app" >/dev/null 2>&1; then
-            echo "Expected an Apple-unsigned host app, but a code signature is present." >&2
+          codesign --verify --deep --strict --verbose=2 "$app"
+          signature_info="$(codesign -dv --verbose=4 "$app" 2>&1)"
+          printf '%s\n' "$signature_info"
+          grep -q '^Authority=Apple Development:' <<< "$signature_info" || {
+            echo "Built app is not signed with an Apple Development identity." >&2
             exit 1
-          fi
+          }
+          embedded_team="$(awk -F= '/^TeamIdentifier=/ { print $2 }' <<< "$signature_info")"
+          [[ "$embedded_team" == "$APPLE_TEAM_ID" ]] || {
+            echo "Built app team $embedded_team does not match APPLE_TEAM_ID $APPLE_TEAM_ID." >&2
+            exit 1
+          }
           embedded_key="$(/usr/libexec/PlistBuddy -c 'Print SUPublicEDKey' "$app/Contents/Info.plist")"
           [[ "$embedded_key" == "$SPARKLE_PUBLIC_ED_KEY" ]] || {
             echo "Built app does not contain the configured Sparkle public key." >&2
@@ -135,15 +181,15 @@ jobs:
             echo "Built app version $embedded_version ($embedded_build) does not match $APP_VERSION ($APP_BUILD)." >&2
             exit 1
           }
-          echo "UNSIGNED_APP=$app" >> "$GITHUB_ENV"
+          echo "SIGNED_APP=$app" >> "$GITHUB_ENV"
 
       - name: Package Sparkle update
         shell: bash
         run: |
           set -euo pipefail
           mkdir -p build/updates
           archive="build/updates/ElapseRecorder-${APP_VERSION}.zip"
-          ditto -c -k --sequesterRsrc --keepParent "$UNSIGNED_APP" "$archive"
+          ditto -c -k --sequesterRsrc --keepParent "$SIGNED_APP" "$archive"
           echo "UPDATE_ARCHIVE=$archive" >> "$GITHUB_ENV"
 
       - name: Create draft GitHub release
@@ -202,3 +248,11 @@ jobs:
           set -euo pipefail
           gh release upload "$GITHUB_REF_NAME" build/updates/appcast.xml --clobber
           gh release edit "$GITHUB_REF_NAME" --draft=false
+
+      - name: Remove release keychain
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
+            security delete-keychain "$RELEASE_KEYCHAIN" || true
+          fi

.gitignore

@@ -18,3 +18,7 @@ build/
 .swiftpm/
 .build/
 .github/copilot-instructions.md
+
+# Signing key exports
+*.p12
+*.sparkle.private-key

Docs/简体中文.md

@@ -47,6 +47,10 @@ Elapse Recorder是一款原生macOS菜单栏工具——它可以在你工作时
 2. 解压`Elapse Recorder.app`并将其移动到`/Applications`。
 3. 首次启动时，右键单击应用并选择**打开。**如果macOS仍然阻止启动，请在系统设置→隐私与安全性中允许Elapse Recorder运行，然后再次打开。
 
+> [!NOTE]
+>
+> 官方版本使用免费Apple Development证书签名，并通过Sparkle EdDSA验证，但未经过公证。macOS仍可能要求你通过Finder或隐私与安全性批准首次启动。
+
 ## 构建
 
 ```sh

ElapseRecorder.xcodeproj/project.pbxproj

@@ -455,7 +455,7 @@
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 32;
+				CURRENT_PROJECT_VERSION = 33;
 				DEVELOPMENT_TEAM = 7XRF3J9RS4;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -482,7 +482,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 1.13.1;
+				MARKETING_VERSION = 1.13.2;
 				PRODUCT_BUNDLE_IDENTIFIER = d.iota.ElapseRecorder;
 				PRODUCT_MODULE_NAME = ElapseRecorder;
 				PRODUCT_NAME = "Elapse Recorder";
@@ -504,7 +504,7 @@
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 32;
+				CURRENT_PROJECT_VERSION = 33;
 				DEVELOPMENT_TEAM = 7XRF3J9RS4;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -531,7 +531,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 1.13.1;
+				MARKETING_VERSION = 1.13.2;
 				PRODUCT_BUNDLE_IDENTIFIER = d.iota.ElapseRecorder;
 				PRODUCT_MODULE_NAME = ElapseRecorder;
 				PRODUCT_NAME = "Elapse Recorder";
@@ -551,11 +551,11 @@
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 32;
+				CURRENT_PROJECT_VERSION = 33;
 				DEVELOPMENT_TEAM = 7XRF3J9RS4;
 				GENERATE_INFOPLIST_FILE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 15.7;
-				MARKETING_VERSION = 1.13.1;
+				MARKETING_VERSION = 1.13.2;
 				PRODUCT_BUNDLE_IDENTIFIER = d.iota.ElapseRecorderTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -572,11 +572,11 @@
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 32;
+				CURRENT_PROJECT_VERSION = 33;
 				DEVELOPMENT_TEAM = 7XRF3J9RS4;
 				GENERATE_INFOPLIST_FILE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 15.7;
-				MARKETING_VERSION = 1.13.1;
+				MARKETING_VERSION = 1.13.2;
 				PRODUCT_BUNDLE_IDENTIFIER = d.iota.ElapseRecorderTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -592,10 +592,10 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 32;
+				CURRENT_PROJECT_VERSION = 33;
 				DEVELOPMENT_TEAM = 7XRF3J9RS4;
 				GENERATE_INFOPLIST_FILE = YES;
-				MARKETING_VERSION = 1.13.1;
+				MARKETING_VERSION = 1.13.2;
 				PRODUCT_BUNDLE_IDENTIFIER = d.iota.ElapseRecorderUITests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -611,10 +611,10 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 32;
+				CURRENT_PROJECT_VERSION = 33;
 				DEVELOPMENT_TEAM = 7XRF3J9RS4;
 				GENERATE_INFOPLIST_FILE = YES;
-				MARKETING_VERSION = 1.13.1;
+				MARKETING_VERSION = 1.13.2;
 				PRODUCT_BUNDLE_IDENTIFIER = d.iota.ElapseRecorderUITests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;

README.md

@@ -47,6 +47,10 @@ After choosing the applications and monitoring rules you care about, no further
 2. Extract `Elapse Recorder.app` and move it to `/Applications`.
 3. On first launch, right-click the app and choose **Open.** If macOS still blocks it, approve Elapse Recorder under System Settings → Privacy & Security and open it again.
 
+> [!NOTE]
+>
+> Official releases are signed with a free Apple Development certificate and authenticated by Sparkle EdDSA, but they are not notarized. macOS may still require first-launch approval through Finder or Privacy & Security.
+
 ## Building
 
 ```sh

ReleaseNotes/1.13.2.md

@@ -0,0 +1,9 @@
+# Elapse Recorder 1.13.2
+
+This maintenance release restores **Launch at Login** for publicly distributed builds.
+
+## Fixes
+
+- Sign the release with a free Apple Development identity so macOS Background Task Management can register Elapse Recorder as a login item.
+- Keep Sparkle EdDSA verification as the update trust anchor.
+- Preserve the manual first-launch approval flow for the non-notarized app.