How do I install the Release Signing skill?

Run npx skillmds@latest add kunchenguid-no-mistakes/release-signing in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Release Signing skill do?

Use when changing macOS release signing, release artifact verification, or the release workflow. It is listed under Productivity on SkillMD.

Is Release Signing safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Release Signing?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Release Signing free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Release Signing?

kunchenguid (@kunchenguid-no-mistakes) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Release Signing by kunchenguid-no-mistakes

Name: Release Signing
Rating: 4.5 (4 reviews)
Author: kunchenguid

File contents

macOS Release Signing (permanent identity)

Every official macOS release artifact - both darwin/arm64 and darwin/amd64 - is Developer ID Application signed on a macOS runner with a fixed identifier, hardened runtime, secure timestamp, and no entitlements, then strictly verified before it is archived or checksummed; the Linux and Windows release paths are unchanged.
The executable identifier com.kunchenguid.no-mistakes and Team ID 9T2J7MNUP9 are the permanent Developer ID identity and MUST NEVER change: they are the invariant of the identity-based designated requirement that lets macOS permission grants survive no-mistakes update, so changing either resets every grant once.
Signing runs only in the darwin build job gated behind the release-signing GitHub environment; the certificate is the base64 CSC_LINK secret unlocked with CSC_KEY_PASSWORD, imported into an ephemeral keychain with a runtime-generated password that is deleted on success and failure, and no other job may reference those secrets.
Signing happens before tarball creation and checksum generation, and the verify gate fails the release closed on any missing or ambiguous signature, wrong Team ID, non-permanent identifier, content-based (cdhash) requirement, missing hardened runtime or timestamp, or wrong architecture.
Mechanics live in .github/workflows/release.yml; the contract is pinned by the root TestReleaseWorkflow* static tests in workflow_release_signing_test.go, and secret values are never recorded here or in any test fixture.
Notarization, stapling, a PKG, Homebrew, and universal binaries are intentionally out of scope for this phase.

Frequently asked questions

Release Signing