Implement code signing, notarization, and Sparkle updates

[frankdilo]

Overview

Research how to implement proper macOS app signing, notarization, and automatic updates for Markdown Viewer, following the approach used by CodexBar.

Research Report

See the detailed research report: docs/codexbar-signing-distribution-report.md

Summary of CodexBar Approach

• Code Signing: Developer ID Application certificate with hardened runtime
• Notarization: App Store Connect API with stapling
• Updates: Sparkle 2.8.1 with EdDSA (Ed25519) signatures
• Distribution: GitHub Releases + Homebrew Cask
• Automation: Shell scripts for packaging, signing, appcast generation

Implementation Phases

Phase 1: Code Signing & Notarization

• Create Scripts/ directory with signing scripts
• Set up Developer ID certificate
• Create version.env for version management
• Update build.sh to include signing and notarization
• Create entitlements file

Phase 2: Sparkle Integration

• Add Sparkle dependency to Package.swift
• Generate EdDSA keypair
• Embed public key in Info.plist
• Create appcast.xml in repo root
• Add updater UI ("Check for Updates..." menu item)
• Create make_appcast.sh script

Phase 3: Release Automation

• Create release.sh script
• Set up GitHub Actions for CI
• Document release process

Required Credentials

• Developer ID Application certificate (Apple Developer Program)
• App Store Connect API key (for notarization)
• Sparkle EdDSA private key (generate locally)

[frankdilo]

Update: Added CI/CD & Release Automation Details

The research report has been expanded with a new Appendix B: Detailed CI/CD & Release Automation section covering:

• GitHub Actions Workflows: ci.yml, release-cli.yml, upstream-monitor.yml with triggers, jobs, and steps
• Release Script Deep Dive: Full execution flow diagram for release.sh
• Supporting Scripts: sign-and-notarize.sh, make_appcast.sh, verify_appcast.sh, validate_changelog.sh, changelog-to-html.sh
• Quality Gates Summary: Table of all checks (SwiftFormat, SwiftLint, tests, changelog, appcast, assets)
• Secrets & Environment Variables: Complete reference for GitHub Actions and local variables
• Workflow Orchestration Diagram: Visual flow from developer push through Sparkle client updates
• Key Architectural Patterns: Design principles used in the automation

See the updated report: docs/codexbar-signing-distribution-report.md