Desktop builds for macOS and Windows from scratch
Desktop builds for macOS and Windows from scratch
The product shipped on the web only, and desktop builds were made by hand on somebody’s machine. That works right up to the first release that has to go out urgently and not from that machine. I built the pipeline for both platforms end to end: build, signing, artifact publishing.
macOS
The first thing to untangle was an ambiguous signing identity. Two certificates with the same name sat in the keychain and the build picked between them at random: yesterday’s app signed with one, today’s with the other, and the only way to notice is user complaints. Then notarization moved to a keychain profile instead of login and password variables — signing secrets left the repository entirely; the keys live in the keychain and in runner variables.
The finished app is signed with a Developer ID certificate and its intermediate CA, sent to Apple for notarization, and stapled automatically by a build hook rather than as a manual step afterwards.
Windows
Here there were four infrastructure blockers in a row, and the main one was file system redirection for 32-bit processes. The installer failed under the system account while building and installing fine under a regular user: a 32-bit process reaching for a system directory was silently redirected elsewhere, and some paths inside the installation stopped lining up.
Signing is jsign over PKCS11 with a hardware token: the PIN comes from the runner environment, and a trusted timestamp is added so the signature outlives the certificate itself.
Publishing
Artifacts go to object storage with the two latest versions kept: the current and the previous one are always available for a rollback, and old builds do not pile up. The release contents are computed from the git tag, and the rollout passes a gate on backend readiness in production — the desktop app must not reach users before the server can talk to it.
About nineteen production releases went through this pipeline in a quarter, with a record of five in one week. Signing for two operating systems usually turns out to be the topic interviewers dig into hardest: the skill is rare and the pitfalls are the same for everyone.