Skip to content

Sign the uninstaller that ships in the DMG #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MasterYoav merged 1 commit into from
Sep 18, 2026
Merged

Sign the uninstaller that ships in the DMG #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion docs/11-packaging-and-updates.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,7 +310,13 @@ It says so.

**Also ship a standalone uninstaller script** in the DMG for the user who already dragged the app to
the Trash and then found the volumes. It is `Uninstall xBot.command`, copied from
`scripts/uninstall-xbot.command`, and it mirrors `AppState.uninstall()` step for step. ⚠️ Yes, this is a terminal — it is the one place the no-terminal
`scripts/uninstall-xbot.command`, and it mirrors `AppState.uninstall()` step for step.

**It is signed with the same identity as the app**, in `create-dmg.sh`, so the DMG's notarization
covers it. A `.command` keeps its signature in extended attributes, which both the copy and the disk
image preserve. Unsigned, it arrives quarantined and macOS refuses it as coming from an unidentified
developer — and the person meeting that has already trashed the app, so there is no second path to
their volumes. ⚠️ Yes, this is a terminal — it is the one place the no-terminal
promise yields, because the alternative is orphaned data with no way to remove it. It is documented
on the website, not in the app.

Expand Down
11 changes: 11 additions & 0 deletions scripts/create-dmg.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,17 @@ ln -s /Applications "${STAGE}/Applications"
cp "${ROOT}/scripts/uninstall-xbot.command" "${STAGE}/Uninstall xBot.command"
chmod +x "${STAGE}/Uninstall xBot.command"

# Signed like anything else that ships, when there is an identity to sign with.
#
# A .command carries its signature in extended attributes rather than inside the file, and both `cp`
# and the disk image preserve those. Unsigned, it arrives quarantined from a download and macOS
# refuses it as coming from an unidentified developer — which, for the person who already trashed
# the app and wants their volumes back, is a dead end with no second path.
if [[ -n "${MACOS_SIGNING_IDENTITY:-}" ]]; then
codesign --force --timestamp --sign "${MACOS_SIGNING_IDENTITY}" \
"${STAGE}/Uninstall xBot.command"
fi

hdiutil create -volname "${VOLUME}" -srcfolder "${STAGE}" -ov -format UDZO "${DMG}"
rm -rf "${STAGE}"

Expand Down
Loading