From 057646cf8953121547573e5eb209dea2c88929ee Mon Sep 17 00:00:00 2001
From: Fedor Kororkov <fkorotkov@openai.com>
Date: Fri, 17 Jul 2026 14:47:15 -0400
Subject: [PATCH] Fix Tart release code signing (#1284)

---
 .ci/sign-release.sh           | 12 +++++++++++-
 .github/workflows/release.yml |  5 ++---
 .goreleaser.yml               |  3 ++-
 gon.hcl                       | 12 ------------
 4 files changed, 15 insertions(+), 17 deletions(-)
 delete mode 100644 gon.hcl

diff --git a/.ci/sign-release.sh b/.ci/sign-release.sh
index b7939b7..0c697f2 100755
--- a/.ci/sign-release.sh
+++ b/.ci/sign-release.sh
@@ -10,5 +10,15 @@ if [ "${TART_RELEASE_SNAPSHOT:-false}" = "true" ]; then
     --entitlements Resources/tart-dev.entitlements \
     dist/tart_darwin_all/tart.app
 else
-  gon gon.hcl
+  codesign \
+    --force \
+    --verbose \
+    --sign "Developer ID Application: Cirrus Labs, Inc. (9M2P8L4D89)" \
+    --timestamp \
+    --options runtime \
+    --keychain "$RUNNER_TEMP/build.keychain" \
+    --entitlements Resources/tart-prod.entitlements \
+    dist/tart_darwin_all/tart.app
+
+  codesign --verify --strict --verbose=2 dist/tart_darwin_all/tart.app
 fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a5a572..60240f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,7 @@ jobs:
         run: |
           echo "$MACOS_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
           security create-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
+          security set-keychain-settings -lut 21600 "$RUNNER_TEMP/build.keychain"
           security default-keychain -s "$RUNNER_TEMP/build.keychain"
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
           security import "$RUNNER_TEMP/certificate.p12" \
@@ -46,8 +47,7 @@ jobs:
             -s \
             -k "$KEYCHAIN_PASSWORD" \
             "$RUNNER_TEMP/build.keychain"
-      - name: Install gon
-        run: brew install mitchellh/gon/gon
+          security list-keychain -d user -s "$RUNNER_TEMP/build.keychain"
       - name: Create release app token for this repo
         id: app-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
@@ -72,7 +72,6 @@ jobs:
           version: "~> v2"
           args: release --clean
         env:
-          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 63bb4ad..9be29ac 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -30,7 +30,8 @@ universal_binaries:
         - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
         - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
         - cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
-        - .ci/sign-release.sh
+        - cmd: .ci/sign-release.sh
+          output: true
 
 archives:
   - name_template: "{{ .ProjectName }}"
diff --git a/gon.hcl b/gon.hcl
deleted file mode 100644
index 6d01549..0000000
--- a/gon.hcl
+++ /dev/null
@@ -1,12 +0,0 @@
-source = [ "dist/tart_darwin_all/tart.app" ]
-bundle_id = "com.github.cirruslabs.tart"
-
-apple_id {
-  username = "hello@cirruslabs.org"
-  password = "@env:AC_PASSWORD"
-}
-
-sign {
-  application_identity = "Developer ID Application: Cirrus Labs, Inc."
-  entitlements_file = "Resources/tart-prod.entitlements"
-}