skills.rest
cgfixit
cgfixitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cgagentharness-release

Builds and verifies universal macOS desktop release artifacts for CG-agent-harness.

Updated Sep 7, 2026
Search Tags:#release#desktop app#macos#rust#code signing#github workflow#universal binary
One-click install
npx skills add https://github.com/cgfixit/CG-agent-harness --skill cgagentharness-release-cgfixit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cgagentharness-release
Source: https://github.com/cgfixit/CG-agent-harness/tree/main/.codex/skills/cgagentharness-release
Command: npx skills add https://github.com/cgfixit/CG-agent-harness --skill cgagentharness-release-cgfixit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Releasing a signed universal macOS desktop app requires a precise build, signing, and verification order; this Skill encodes that procedure so release artifacts are reproducible and correctly provenance-tracked. ## Core Features & Use Cases - Universal Binary Packaging: Builds aarch64 and x86_64 backend and desktop slices, lipos them, and signs in the correct order so embedded SHA256 digests stay valid. - Artifact Verification: Verifies ZIP checksums, nested signatures, resources, system-only linkage, and runs packaged-backend and desktop policy tests. - Release Provenance: Matches remote SHA, workflow run, artifact COMMIT, and checksums before preparing draft prereleases or tagged releases. - Use Case: A maintainer on Apple Silicon runs the packaging script, verifies the extracted app in a fresh directory, launches it with a disposable home, and prepares a draft prerelease tied to the candidate branch. ## Quick Start Build and verify the universal macOS desktop release bundle for CG-agent-harness and prepare a draft prerelease for the current candidate branch.

Frequently Asked Questions about cgagentharness-release

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a universal macOS binary with Rust?▼

Install both aarch64-apple-darwin and x86_64-apple-darwin standard libraries via rustup, build each slice separately, then combine them with lipo. The packaging script automates this with the --universal flag.

How to verify a signed macOS app bundle before release?▼

Verify the ZIP checksum, extract to a fresh directory, and run the verification script against the extracted app. It checks both executables contain arm64 and x86_64, nested signatures, resources, and system-only linkage.

Why must the backend be signed before embedding its SHA256?▼

The desktop slices embed the exact whole-file SHA256 of the signed universal backend. Re-signing the sidecar after embedding changes its digest and breaks the verification, so the signing order is fixed.

Does ad-hoc signing replace Developer ID notarization on macOS?▼

No. Ad-hoc signing is not Developer ID signing or notarization, and this limitation must be stated in release notes. Gatekeeper behavior differs for ad-hoc signed bundles.

Can I test the Intel build using Rosetta?▼

Intel cross-compilation, Rosetta execution, and native Intel testing are different claims. Do not silently install Rosetta or change TCC settings to fill an evidence gap in acceptance testing.

Related Skills

Explore More Software Engineering Skills→
kwanpham2195kwanpham2195
2

clean-copy

Reimplements a branch on a new branch with a clean, narrative-quality git commit history.

Community
Intermediate
dodygdodyg

dotnet-github-releases

Create and manage GitHub Releases for .NET projects with tag-based workflows.

Community
Intermediate
TitoPrauseeTitoPrausee

multi-project-247-orchestrator

Orchestrate multiple software projects with autonomous agent teams and direct commit workflows.

Community
Advanced
brianlovinbrianlovin
357

electron-wrapper

Bundle a Bun-based web server into an Electron desktop app with electron-builder.

Community
Advanced