wharfy 0.9 — the sign step now signs

The sign step now signs

The pipeline is build → sign → release → publish → verify. Until now sign only reported state — it never signed anything. 0.9 fills that gap for prebuilt CLI binaries: declare a sign: identity and wharfy codesigns your macOS Mach-O with it, so signing lives in the pipeline instead of a script you keep on the side.

prebuilt:
  binaries:
    - { os: darwin, arch: arm64, path: dist/app-darwin-arm64 }
sign:
  identity: "Developer ID Application: Acme (TEAMID)"

# no identity → advisory; your pre-signed binaries are respected
signing (advisory; no identity configured — pre-signed binaries respected): darwin unsigned

# identity set → wharfy signs
signed darwin (Developer ID Application: Acme (TEAMID)): 1 binary — checksums finalize at `wharfy release`

Local or CI

Point wharfy at an identity you already have. It never manages its own — no conflict with your existing signing setup.

For the .p12 path, wharfy imports it into a throwaway keychain, signs, and deletes it. Secrets come from the environment only — never wharfy.yaml, never a generated file.

Sign, then checksum

Signing changes the binary’s hash, so order matters. wharfy signs a staged copy — your source binary is untouched — then archives and checksums the signed result, so the sha in your Formula and manifests matches what ships.

• No identity → nothing is signed; pre-signed binaries pass straight through.
• Identity set on a non-macOS host → it fails loud, rather than shipping unsigned as if it were signed.

Notarization isn’t required — a self-signed binary completes. Bundles (0.8) are still relayed as-is; wharfy doesn’t re-sign them.

Getting it

brew upgrade wharfy / scoop update wharfy / go install github.com/ShiroDoromoto/wharfy/cmd/wharfy@latest. On Linux, from the apt / yum repo.