From 9f79f5671506a05c24c5e56d42f9ecabc356ac69 Mon Sep 17 00:00:00 2001 From: Vladimir Date: Wed, 19 Aug 2026 17:28:38 +0800 Subject: [PATCH] Pin the Homebrew cask to the notarized Alpha app zip. Why: Developer ID signing and Apple notarization produced Simulator-Broker-0.1.0-alpha.1.zip. The cask still used sha256 :no_check and public docs still said the Alpha release did not attach that zip. Changed: Pin Casks/simulator-broker.rb to the published zip SHA-256. Document the brew cask one-liner and remove the stale not-attached caveats. Verification: npm run agent:verify -- --profile spec-only --paths Casks/simulator-broker.rb,README.md,docs/getting-started.md,docs/status.md,SECURITY.md,CHANGELOG.md,spec/build-and-test.md,docs/test/front-door.test.mjs --session-dir task-sessions/cask-notarized-app-zip-20260819 Affected: Casks/simulator-broker.rb README.md docs/getting-started.md docs/status.md SECURITY.md CHANGELOG.md spec/build-and-test.md docs/test/front-door.test.mjs Refs: https://github.com/fiveonecode/simulator-broker/releases/tag/v0.1.0-alpha.1 https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/Simulator-Broker-0.1.0-alpha.1.zip spec/build-and-test.md Session: task-sessions/cask-notarized-app-zip-20260819 --- CHANGELOG.md | 4 ++-- Casks/simulator-broker.rb | 9 ++++----- README.md | 21 +++++++++++---------- SECURITY.md | 4 ++-- docs/getting-started.md | 13 ++++++------- docs/status.md | 6 ++---- docs/test/front-door.test.mjs | 7 +++++++ spec/build-and-test.md | 11 +++++++---- 8 files changed, 41 insertions(+), 34 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 52dd3a7..2fee70f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,8 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 [`fiveonecode/homebrew-simulator-broker`](https://github.com/fiveonecode/homebrew-simulator-broker) for that tap name. `Formula/` and `Casks/` here stay the source of truth. - Homebrew cask `Casks/simulator-broker.rb` installs `Simulator Broker.app` - from the signed, notarized GitHub Release zip `Simulator-Broker-.zip` - when that zip is attached. + from the signed, notarized GitHub Release zip `Simulator-Broker-.zip`. + Tag `v0.1.0-alpha.1` now attaches that zip, and the cask pins its SHA-256. - Packable npm CLI `packages/simbroker` (`npm run package:npm`) with a `bin` field. The repo-root package stays private. Tag-driven `.github/workflows/release.yml` attaches that tarball and no longer diff --git a/Casks/simulator-broker.rb b/Casks/simulator-broker.rb index d6c78c5..a406754 100644 --- a/Casks/simulator-broker.rb +++ b/Casks/simulator-broker.rb @@ -1,6 +1,6 @@ cask "simulator-broker" do version "0.1.0-alpha.1" - sha256 :no_check + sha256 "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70" url "https://github.com/fiveonecode/simulator-broker/releases/download/v#{version}/Simulator-Broker-#{version}.zip" name "Simulator Broker" @@ -13,9 +13,8 @@ caveats <<~EOS This cask installs Simulator Broker.app from the signed, notarized - GitHub Release zip Simulator-Broker-#{version}.zip. Produce that zip - with npm run package:distribution (Developer ID Application + notarytool), - using payload/app/Simulator Broker.app from the distribution bundle. - The current Alpha GitHub Release attaches the CLI tarball, not this zip. + GitHub Release zip Simulator-Broker-#{version}.zip. Reproduce that + zip from payload/app/Simulator Broker.app after + npm run package:distribution (Developer ID Application + notarization). EOS end diff --git a/README.md b/README.md index 2d72079..39a3358 100644 --- a/README.md +++ b/README.md @@ -5,8 +5,7 @@ on one Mac without stealing devices from each other. > **Alpha.** macOS only. Xcode is required to create or run iOS Simulators. > Interfaces can change. Install the CLI with Homebrew or the `simbroker` -> npm package. A signed, notarized operator app is not attached to this -> Alpha release yet. +> npm package. Install the operator app with the Homebrew cask. [![Node tests](https://github.com/fiveonecode/simulator-broker/actions/workflows/ci.yml/badge.svg)](https://github.com/fiveonecode/simulator-broker/actions/workflows/ci.yml) @@ -59,16 +58,18 @@ build the macOS app. If Homebrew is installed, `simbroker` lands in and one guarded login-shell PATH line. Open a new terminal if this shell still cannot resolve `simbroker`. `source .../env.sh` remains a fallback. -The Homebrew cask `fiveonecode/simulator-broker/simulator-broker` installs -`Simulator Broker.app` from the signed, notarized GitHub Release zip -`Simulator-Broker-.zip`. That zip is not attached to the current -Alpha release. Produce it with `npm run package:distribution` after Developer -ID signing and notarytool notarization. +The Homebrew cask installs the signed, notarized operator app: -Xcode is still required to create and run iOS Simulators. Alpha CLI tarballs -are attached to +```bash +brew install --cask fiveonecode/simulator-broker/simulator-broker +``` + +That cask downloads `Simulator-Broker-.zip` from [GitHub Releases](https://github.com/fiveonecode/simulator-broker/releases). -Extract a tarball and run `./bin/simbroker --help`. + +Xcode is still required to create and run iOS Simulators. Alpha CLI tarballs +are also attached to those releases. Extract a tarball and run +`./bin/simbroker --help`. `simbroker` help and `simbroker doctor` print human-readable text by default. Pass `--json` for machine-readable payloads. diff --git a/SECURITY.md b/SECURITY.md index f2462d7..ed1c010 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,8 @@ Security fixes are considered for the current `main` branch and for the latest tagged Alpha (`0.1.0-alpha.1`). Older Alpha tags are not supported. The published CLI artifacts are the GitHub Release tarball, the Homebrew formula that installs that tarball, and the packable `simbroker` npm -package. A signed, notarized operator app zip is not attached to this -Alpha release. +package, and the signed, notarized operator app zip +`Simulator-Broker-0.1.0-alpha.1.zip`. ## Reporting A Vulnerability diff --git a/docs/getting-started.md b/docs/getting-started.md index 0222441..09d5c51 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -10,8 +10,7 @@ A small public patch follows the public-patches track in > **Alpha.** macOS only. Xcode is required to create or run iOS Simulators. > Interfaces can change. Install the CLI with Homebrew or the `simbroker` -> npm package. A signed, notarized operator app is not attached to this -> Alpha release yet. +> npm package. Install the operator app with the Homebrew cask. ## Prerequisites @@ -171,12 +170,12 @@ SIMBROKER_DISTRIBUTION_SIGNING_IDENTITY='Developer ID Application: Example (TEAM npm run package:distribution ``` -GitHub Releases attach the Alpha CLI tarball. The Homebrew cask +GitHub Releases attach the Alpha CLI tarball and the signed, notarized +`Simulator-Broker-.zip`. The Homebrew cask `fiveonecode/simulator-broker/simulator-broker` installs -`Simulator Broker.app` from `Simulator-Broker-.zip` on that -release. Produce the zip with `npm run package:distribution` after Developer -ID signing and notarytool notarization. The current Alpha release does not -attach that zip. +`Simulator Broker.app` from that zip. Reproduce the zip from +`payload/app/Simulator Broker.app` after `npm run package:distribution` +and Developer ID notarization. ## Report a problem diff --git a/docs/status.md b/docs/status.md index ef678a9..cac635d 100644 --- a/docs/status.md +++ b/docs/status.md @@ -68,7 +68,5 @@ node client/bin/simbroker.mjs lease release --lease-file /tmp/simbroker-lease.js node client/bin/simbroker.mjs simulators boot --alias ui-1 ``` -## Lower-priority public follow-through - -- Attach a signed, notarized `Simulator-Broker-.zip` to GitHub - Releases so the Homebrew cask has a downloadable app artifact +The Alpha GitHub Release attaches the signed, notarized +`Simulator-Broker-.zip` used by the Homebrew cask. diff --git a/docs/test/front-door.test.mjs b/docs/test/front-door.test.mjs index bb0b56c..9a6b55a 100644 --- a/docs/test/front-door.test.mjs +++ b/docs/test/front-door.test.mjs @@ -140,9 +140,11 @@ test("README advertises GitHub Releases and the public Node CI badge", () => { assert.equal(readme.includes("or GitHub Release yet"), false); assert.equal(readme.includes("There is no Homebrew formula or npm package yet."), false); assert.ok(readme.includes("brew install fiveonecode/simulator-broker/simbroker")); + assert.ok(readme.includes("brew install --cask fiveonecode/simulator-broker/simulator-broker")); assert.ok(readme.includes("homebrew-simulator-broker")); assert.ok(readme.includes("npm install -g")); assert.ok(readme.includes("simbroker-0.1.0-alpha.1.tgz")); + assert.equal(readme.includes("is not attached"), false); }); test("CHANGELOG and package.json name the Alpha version", () => { @@ -306,9 +308,14 @@ test("Homebrew formula points at the Alpha CLI tarball and the cask names a nota assert.ok(cask.includes('cask "simulator-broker"')); assert.ok(cask.includes("releases/download/v#{version}/Simulator-Broker-#{version}.zip")); assert.ok(cask.includes('app "Simulator Broker.app"')); + const caskChecksum = cask.match(/sha256 "([a-f0-9]{64})"/); + assert.ok(caskChecksum, "cask must pin a sha256"); + assert.equal(caskChecksum[1], "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70"); + assert.equal(cask.includes("sha256 :no_check"), false); assert.equal(cask.includes("package:local"), false); assert.equal(cask.includes("package_local"), false); assert.ok(cask.includes("package:distribution") || cask.includes("package_distribution")); + assert.equal(cask.includes("not this zip"), false); }); test("root package stays private and package_npm.sh packs a runnable simbroker bin", () => { diff --git a/spec/build-and-test.md b/spec/build-and-test.md index ba22fdc..ad63c41 100644 --- a/spec/build-and-test.md +++ b/spec/build-and-test.md @@ -47,16 +47,19 @@ A first extracted implementation slice now exists: with a `bin` field; the repo-root package stays `private` - `Casks/simulator-broker.rb` installs `Simulator Broker.app` from `Simulator-Broker-.zip` on GitHub Releases (signed/notarized app - shape from `package_distribution.sh`, not `package:local`) + from `payload/app/Simulator Broker.app` after `package_distribution.sh`, + not `package:local`). The cask pins the published zip SHA-256. - public GitHub-hosted Ubuntu CI runs `verify:public-surface`, `test:broker-core`, `test:client`, and `test:harness-adoption`; it does not run `test:app`. The job budget is 30 minutes. Broker tests that build an app snapshot must inject the fixture `simctl` adapter. The default public-surface scan reads index blobs only for dirty or missing worktree files so a clean checkout does not spawn one `git cat-file` per file. -- tagged versions such as `v0.1.0-alpha.1` attach the CLI tarball and the - packable `simbroker-.tgz` to a GitHub Release through - `.github/workflows/release.yml` +- tagged versions such as `v0.1.0-alpha.1` attach the CLI tarball, the + packable `simbroker-.tgz`, and the notarized + `Simulator-Broker-.zip` to a GitHub Release. The CLI and npm + tarballs come from `.github/workflows/release.yml`; the app zip is an + operator-signed notarized attach for this Alpha. - local-debug portable bundle support through a zip bundle plus package-smoke verification of the bundled install path and installed-app launch proof - a separate Release distribution packaging path that requires operator-supplied signing inputs, runs `codesign` plus `spctl`, optionally notarizes with `notarytool`, and writes a readiness summary JSON - executable `agent-harness/` changes now route through the implementation