# §101 — Signing and shipping

A version bump on `main` is the release. Everything below happens without you watching it.

The workflow tags it, publishes the notes from `CHANGELOG.md`, and builds a signed and notarized `.app` and `.dmg`, `.tar.gz`/`.deb`/`.AppImage` for x86_64 and aarch64, and `.zip`/`.msi` with Scoop and Chocolatey manifests. Then it rewrites the Homebrew cask.

Signing credentials are optional — without them every job still runs and produces ad-hoc artifacts with a warning, so a fork keeps building.

Two things that bite. **`assets/entitlements.plist` is not optional**: gpui JITs its Metal shaders, so a hardened-runtime build without `allow-jit` notarizes cleanly and then crashes on first paint. And **check the staple, not the signature** — a signed-but-not-notarized build looks identical until a stranger downloads it. `xcrun stapler validate` and `spctl -a -vvv -t install` are the two commands that actually answer.

Set the Developer ID team in `update.rs`. Without it guise refuses to execute a downloaded bundle and opens the release page instead — an app that ships notarized builds and forgets this has quietly lost its own update path.

## Where now

- Read the release guide — /docs/desktop/release/
- Read the packaging guide — /docs/desktop/packaging/
- Back to the start — turn to §1