@rightkit/release 0.2.141 → 0.2.143

package/README.md

@@ -72,6 +72,10 @@ Build a SwiftPM app with `right-release build --platform mac|win` (add `--config
 
 Set `targets.mac.notarize.appBeforePackage: true` (with `notarize.app` naming the `.app`) to notarize and staple the app itself right after signing and before the package step copies it into the DMG, so an app copied out of the DMG passes `stapler validate` offline. The DMG named by `notarize.file` is still notarized and stapled afterward; the app ticket receipt is `macos-app-notarization.json`. Without the flag, behavior is unchanged.
 
+For `projectType: "swiftpm"` on mac with `appBeforePackage: true` and no `targets.mac.package`, right-release builds the DMG itself (same `dmg-build.mjs` as Tauri) at the package step, after the `.app` is signed, notarized and stapled: it runs `xcrun stapler validate` on the app (refusing to pack an unstapled one), builds the DMG at `notarize.file` (must end `.dmg`), Developer ID signs it (receipt `macos-dmg-signing.json`), then notarizes and staples the DMG as before. Options go in `targets.mac.dmg`: `{ volname, background, iconSize, appPosition, applicationsPosition, window, volumeIcon, out }` (`volname` defaults to the app name). A prePackage hook must no longer build the DMG: preflight fails when its command or arguments mention `dmg` or `hdiutil` (heuristic), because that DMG would carry the unstapled app. Keep a custom DMG flow with `targets.mac.dmg: false` or a `targets.mac.package` step (both run after the staple and skip the automatic build).
+
+`sign.prePackageFiles` entries may be `.app` bundles (directories). Nested code (Mach-O files, frameworks, XPC services, plug-ins) is signed first, inside-out and without entitlements, then the bundle is signed; the receipt records a tree digest of the bundle. Any other directory is rejected with a clear error.
+
 ## Known issues
 
 - `smol-toml` is pinned exactly. A consumer that adds another `smol-toml` gets a second copy (npm audit 2026-10-08, release finding).

package/build-release.mjs

@@ -48,7 +48,7 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // Cached target directories must not outlive changes to these signing helpers.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs", "msix-build.mjs", "msix-plan.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "swift-mac-dmg.mjs", "mac-bundle-signing.mjs", "macos-file-evidence.mjs", "swift-mac-app.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs", "msix-build.mjs", "msix-plan.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")

package/install-app.mjs

@@ -2,12 +2,12 @@
 // Sanctioned, non-intrusive local app install from a signed DMG (macOS); --dev also accepts a
 // Developer ID-signed, not-notarized zip or .app.
 // Never uses a shell, osascript, AppleEvents, or foreground activation.
-import { execFile as nodeExecFile } from "./background-process.mjs";
+import { execFile as nodeExecFile, execFileSync as nodeExecFileSync } from "./background-process.mjs";
 import { detachWithRetry } from "./hdiutil-detach.mjs";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const SIGTERM_WAIT_MS = 15_000;
 const POLL_MS = 250;
@@ -194,6 +194,59 @@ export function writeJournal(fsImpl, file, data) {
   } catch { /* directory fsync is best effort */ }
 }
 
+// --- atomic swap helper (rightkit-swap: renamex_np(RENAME_SWAP)) -------------
+
+// Errors that mean "no atomic swap here": fall back to the two-rename + journal path.
+const SWAP_FALLBACK_CODES = new Set(["ENOHELPER", "ENOTSUP", "EINVAL", "ENOSYS"]);
+const SWAP_HELPER_NAME = "rightkit-swap";
+
+// Resolve order: env RIGHTKIT_SWAP, then <package>/bin/darwin/rightkit-swap, then PATH.
+export function resolveSwapHelper({ env = process.env, fsImpl = fs, pkgDir = path.dirname(fileURLToPath(import.meta.url)) } = {}) {
+  const usable = (p) => { try { return fsImpl.statSync(p).isFile(); } catch { return false; } };
+  if (env.RIGHTKIT_SWAP && usable(env.RIGHTKIT_SWAP)) return env.RIGHTKIT_SWAP;
+  const shipped = path.join(pkgDir, "bin", "darwin", SWAP_HELPER_NAME);
+  if (usable(shipped)) return shipped;
+  for (const dir of String(env.PATH || "").split(path.delimiter)) {
+    if (dir && path.isAbsolute(dir) && usable(path.join(dir, SWAP_HELPER_NAME))) return path.join(dir, SWAP_HELPER_NAME);
+  }
+  return null;
+}
+
+function coded(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+// Sync on purpose: signal-handler rollback must be able to swap back. Throws an error whose `code`
+// is in SWAP_FALLBACK_CODES when no atomic swap is possible here (no helper, or exit 3 / ENOTSUP / EINVAL).
+export function createSwapPaths({ env = process.env, resolve = resolveSwapHelper, execFileSync = nodeExecFileSync } = {}) {
+  return (a, b) => {
+    const helper = resolve({ env });
+    if (!helper) throw coded("ENOHELPER", `${SWAP_HELPER_NAME} helper not found`);
+    try { execFileSync(helper, [a, b], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); }
+    catch (error) {
+      const text = `${error?.stderr || ""}`.trim();
+      if (error?.code === "ENOENT" || error?.code === "EACCES") throw coded("ENOHELPER", `${helper} cannot run: ${error.code}`);
+      if (error?.status === 3 || /SWAP_UNSUPPORTED/.test(text)) throw coded("ENOTSUP", text || "atomic swap unsupported on this volume");
+      throw coded("EIO", text || error?.message || "rightkit-swap failed");
+    }
+  };
+}
+
+// Exchange two paths, falling back to three renames only when no atomic swap exists (roll-back/recovery).
+function swapBack(swapPaths, fsImpl, a, b) {
+  try { swapPaths(a, b); return "atomic"; }
+  catch (error) {
+    if (!SWAP_FALLBACK_CODES.has(error?.code)) throw error;
+    const tmp = `${a}.swapback`;
+    fsImpl.renameSync(a, tmp);
+    fsImpl.renameSync(b, a);
+    fsImpl.renameSync(tmp, b);
+    return "two-rename";
+  }
+}
+
 const defaultIsAlive = (pid) => {
   try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
 };
@@ -207,7 +260,7 @@ async function trashBundle(run, fsImpl, home, now, bundle, appName) {
 }
 
 // Deterministic roll-forward/back of any interrupted install journal in `dest`. Idempotent.
-export async function recoverInstalls({ dest, appName = null, run, fsImpl, home, now, event, sleep, isAlive = defaultIsAlive, selfPid = process.pid }) {
+export async function recoverInstalls({ dest, appName = null, run, fsImpl, home, now, event, sleep, isAlive = defaultIsAlive, selfPid = process.pid, swapPaths = createSwapPaths() }) {
   let names = [];
   try { names = fsImpl.readdirSync(dest).filter((n) => JOURNAL_RE.test(n)); } catch { return []; }
   if (appName) names = names.filter((n) => n === path.basename(journalPathFor(dest, appName)));
@@ -225,8 +278,28 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
     const rm = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
     let action;
     let keepJournal = false;
+    let keepStaged = false;
     try {
-      if (!has(j.installed)) {
+      if (j.swap === "atomic") {
+        // Atomic mode: `installed` is never absent. After the exchange, `staged` holds the OLD bundle;
+        // before it, `staged` holds the new copy. The staged copy's inode (journaled) tells them apart.
+        const swapped = has(j.installed) && Number.isFinite(j.stagedIno) && fsImpl.statSync(j.installed).ino === j.stagedIno;
+        if (!has(j.installed)) {
+          if (has(j.staged)) { fsImpl.renameSync(j.staged, j.installed); action = "restored-backup"; }
+          else action = "cleared";
+        } else if (!swapped || !has(j.staged)) action = "cleared";
+        else {
+          let ok = j.phase === "verified";
+          if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
+          if (ok) {
+            try { await trashBundle(run, fsImpl, home, now, j.staged, path.basename(j.installed)); action = "rolled-forward"; }
+            catch { action = "rolled-forward-trash-pending"; keepJournal = true; keepStaged = true; }
+          } else {
+            swapBack(swapPaths, fsImpl, j.staged, j.installed); // staged now holds the bad new bundle
+            action = "rolled-back";
+          }
+        }
+      } else if (!has(j.installed)) {
         if (has(j.backup)) { fsImpl.renameSync(j.backup, j.installed); action = "restored-backup"; }
         else action = "cleared";
       } else if (has(j.backup)) {
@@ -245,7 +318,7 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
       event("recovery-failed", { journal: file, reason: errText(error) });
       continue; // leave the journal for the next run
     }
-    rm(j.staged);
+    if (!keepStaged) rm(j.staged);
     if (j.mount && has(j.mount)) {
       const out = await detachWithRetry({ mount: j.mount, log: (e) => event(e.event, e), sleep, detach: (args) => run("/usr/bin/hdiutil", args) });
       if (out.ok) rm(j.mountRoot);
@@ -258,9 +331,9 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
 }
 
 export async function recoverApp(opts, deps = {}) {
-  const { execFile = realExecFile, fsImpl = fs, home = os.homedir(), now = () => new Date(), sleep = (ms) => new Promise((r) => setTimeout(r, ms)), emit = () => {}, isAlive, platform = process.platform } = deps;
+  const { execFile = realExecFile, fsImpl = fs, home = os.homedir(), now = () => new Date(), sleep = (ms) => new Promise((r) => setTimeout(r, ms)), emit = () => {}, isAlive, platform = process.platform, env = process.env, swapPaths = createSwapPaths({ env }) } = deps;
   if (platform !== "darwin") throw new InstallAppError("unsupported", `install-app is not implemented on ${platform}`);
-  const results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive });
+  const results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive, swapPaths });
   emit({ event: "recover-done", dest: opts.dest, recovered: results.length });
   return { ok: true, recovered: results };
 }
@@ -280,6 +353,8 @@ export async function installApp(opts, deps = {}) {
     isAlive = defaultIsAlive,
     signalTarget = process,
     exit = (code) => process.exit(code),
+    env = process.env,
+    swapPaths = createSwapPaths({ env }),
   } = deps;
   const dev = opts.dev === true;
   const event = (name, data = {}) => emit({ event: name, ...(dev ? { dev: true } : {}), ...data });
@@ -298,7 +373,16 @@ export async function installApp(opts, deps = {}) {
     const s = swap;
     swap = null;
     try {
-      if (!s.final) {
+      if (s.mode === "atomic") {
+        // installed was never absent. Before the exchange only the staged copy needs removing; after it,
+        // exchange back (installed = old again, staged = the new copy) and drop the new copy. Once final,
+        // staged holds the verified-old bundle awaiting the Trash, so it must not be touched.
+        if (!s.final) {
+          if (s.swapped) swapBack(swapPaths, fsImpl, s.staged, s.installed);
+          removeQuiet(s.staged);
+          removeQuiet(s.journal);
+        }
+      } else if (!s.final) {
         if (s.stagedIn) removeQuiet(s.installed);
         if (s.backedUp && !fsImpl.existsSync(s.installed)) fsImpl.renameSync(s.backup, s.installed);
         removeQuiet(s.staged);
@@ -346,7 +430,7 @@ export async function installApp(opts, deps = {}) {
     if (!fsImpl.existsSync(inputPath)) throw new InstallAppError(`${inputKind}-missing`, `${inputKind.toUpperCase()} not found: ${inputPath}`);
     if (!fsImpl.existsSync(opts.dest)) throw new InstallAppError("dest-missing", `destination not found: ${opts.dest}`);
 
-    await recoverInstalls({ dest: opts.dest, appName: opts.appName, run, fsImpl, home, now, event, sleep, isAlive, selfPid: pid });
+    await recoverInstalls({ dest: opts.dest, appName: opts.appName, run, fsImpl, home, now, event, sleep, isAlive, selfPid: pid, swapPaths });
 
     let sourceApp = null;
     const pickApp = (dir, label) => {
@@ -408,7 +492,7 @@ export async function installApp(opts, deps = {}) {
     const journalData = { schema: 1, appName, pid, phase: "staging", dev, installed, backup, staged, mount: mountPoint, mountRoot };
     removeQuiet(staged);
     writeJournal(fsImpl, journal, journalData);
-    swap = { installed, backup, staged, journal, backedUp: false, stagedIn: false, final: false };
+    swap = { installed, backup, staged, journal, mode: null, swapped: false, backedUp: false, stagedIn: false, final: false };
     try { await run("/usr/bin/ditto", [sourceApp, staged]); }
     catch (error) {
       rollbackSwap();
@@ -426,12 +510,37 @@ export async function installApp(opts, deps = {}) {
     const quit = hadInstalled ? await quitApp(run, kill, sleep, installed) : { pids: [], killed: [] };
     event("quit", { wasRunning, pids: quit.pids, forced: quit.killed });
 
-    // Swap: old -> backup, staged -> installed. The old bundle is never trashed before the new one is verified.
+    // Swap. Preferred: one atomic exchange (renamex_np RENAME_SWAP), so `installed` is never absent even
+    // under SIGKILL; the old bundle then sits at the staged path. Fallback (no helper, or a volume without
+    // RENAME_SWAP): old -> backup, staged -> installed, journaled. The old bundle is never trashed before
+    // the new one is verified.
     failedStage = "replace";
-    writeJournal(fsImpl, journal, { ...journalData, phase: "swapping" });
-    if (hadInstalled) { fsImpl.renameSync(installed, backup); swap.backedUp = true; }
-    fsImpl.renameSync(staged, installed);
-    swap.stagedIn = true;
+    let jd = journalData;
+    let swapMode;
+    if (!hadInstalled) {
+      swapMode = "rename"; // nothing to exchange: a single rename onto an absent name is atomic
+      swap.mode = "two-rename";
+      writeJournal(fsImpl, journal, { ...jd, phase: "swapping", swap: swapMode });
+      fsImpl.renameSync(staged, installed);
+      swap.stagedIn = true;
+    } else {
+      jd = { ...journalData, swap: "atomic", backup: null, stagedIno: fsImpl.statSync(staged).ino };
+      writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+      swap.mode = "atomic";
+      try { swapPaths(staged, installed); swap.swapped = true; swapMode = "atomic"; }
+      catch (error) {
+        if (!SWAP_FALLBACK_CODES.has(error?.code)) throw new InstallAppError("swap-failed", `atomic swap failed (${errText(error)}); previous app untouched`);
+        event("swap-fallback", { reason: error.code, detail: errText(error) });
+        swapMode = "two-rename";
+        swap.mode = "two-rename";
+        jd = { ...journalData, swap: "two-rename" };
+        writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+        fsImpl.renameSync(installed, backup); swap.backedUp = true;
+        fsImpl.renameSync(staged, installed);
+        swap.stagedIn = true;
+      }
+      if (swapMode === "atomic") writeJournal(fsImpl, journal, { ...jd, phase: "swapped" });
+    }
     // Dev builds are not notarized: clear quarantine on the NEW bundle only so Gatekeeper does not block it.
     if (dev) {
       try { await run("/usr/bin/xattr", ["-dr", "com.apple.quarantine", installed]); }
@@ -443,18 +552,19 @@ export async function installApp(opts, deps = {}) {
     // Re-verify installed copy; on failure the catch below rolls back to the backup.
     failedStage = "reverify";
     await verifyBundle(run, installed, { assess: !dev, staple: false });
-    writeJournal(fsImpl, journal, { ...journalData, phase: "verified", mount: null, mountRoot: null });
+    writeJournal(fsImpl, journal, { ...jd, phase: "verified", mount: null, mountRoot: null });
     swap.final = true;
 
     // Only now does the old bundle go to the Trash.
     let trashed = null;
-    if (backup) {
-      try { trashed = await trashBundle(run, fsImpl, home, now, backup, appName); }
-      catch (error) { event("backup-trash-failed", { backup, reason: errText(error) }); trashed = backup; }
+    const oldBundle = swapMode === "atomic" ? staged : backup; // atomic: the exchange left the old bundle at the staged path
+    if (hadInstalled && oldBundle) {
+      try { trashed = await trashBundle(run, fsImpl, home, now, oldBundle, appName); }
+      catch (error) { event("backup-trash-failed", { backup: oldBundle, reason: errText(error) }); trashed = oldBundle; }
     }
-    if (!backup || trashed !== backup) removeQuiet(journal);
+    if (!oldBundle || trashed !== oldBundle) removeQuiet(journal);
     swap = null;
-    event("replaced", { installed, previous: trashed });
+    event("replaced", { installed, previous: trashed, swap: swapMode });
 
     // Relaunch hidden and in the background only.
     const relaunch = opts.relaunch === null ? wasRunning : opts.relaunch;
@@ -463,7 +573,7 @@ export async function installApp(opts, deps = {}) {
       await run("/usr/bin/open", ["-g", "-j", "-b", bundleId]);
       event("relaunched", { bundleId });
     }
-    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
+    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, swap: swapMode, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
     event("done", result);
     return result;
   } catch (error) {

package/mac-bundle-signing.mjs

@@ -0,0 +1,33 @@
+// Directory entries (.app bundles) in `sign.prePackageFiles`: sign nested code inside-out first
+// (no entitlements), then the bundle itself, reusing the swift-mac-app inside-out discovery.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { discoverNestedCode } from "./swift-mac-app.mjs";
+
+const fail = (message) => Object.assign(new Error(message), { code: "MAC_SIGN_ENTRY_INVALID" });
+
+function mainExecutableName(app) {
+  try {
+    const plist = readFileSync(path.join(app, "Contents", "Info.plist"), "utf8");
+    const match = /<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/.exec(plist);
+    if (match) return match[1];
+  } catch { /* binary plist or unreadable: fall back to the bundle name */ }
+  return path.basename(app, ".app");
+}
+
+/**
+ * Split signing entries into nested code (deepest first, signed without entitlements) and the entries
+ * themselves. A directory must be a `.app` bundle; anything else is rejected with a clear error.
+ * Injectable: isDirectory, discover, exists.
+ */
+export function expandMacSigningEntries(files, { isDirectory = (f) => statSync(f).isDirectory(), exists = existsSync, discover = discoverNestedCode, mainName = mainExecutableName } = {}) {
+  const nested = [];
+  for (const file of files) {
+    if (!isDirectory(file)) continue;
+    if (!file.endsWith(".app") || !exists(path.join(file, "Contents", "Info.plist"))) {
+      throw fail(`sign.prePackageFiles entry is a directory but not a .app bundle with Contents/Info.plist: ${file}`);
+    }
+    nested.push(...discover(file, mainName(file)));
+  }
+  return { nested: [...new Set(nested)], files };
+}

package/macos-file-evidence.mjs

@@ -0,0 +1,27 @@
+// Content evidence for a macOS signing entry: a plain file hashes its bytes; a directory (.app bundle)
+// hashes a deterministic tree digest. Shared by sign-macos.mjs (writes the receipt) and release.mjs (verifies it).
+import { createHash } from "node:crypto";
+import { lstatSync, readdirSync, readFileSync, readlinkSync, statSync } from "node:fs";
+import path from "node:path";
+
+export function fileEvidence(file) {
+  if (statSync(file).isDirectory()) {
+    const digest = createHash("sha256");
+    let sizeBytes = 0;
+    const visit = (directory) => {
+      for (const name of readdirSync(directory).sort()) {
+        const entry = path.join(directory, name);
+        const info = lstatSync(entry);
+        const type = info.isSymbolicLink() ? "link" : info.isDirectory() ? "directory" : "file";
+        const bytes = type === "link" ? Buffer.from(readlinkSync(entry)) : type === "file" ? readFileSync(entry) : Buffer.alloc(0);
+        digest.update(`${path.relative(file, entry).split(path.sep).join("/")}\0${type}\0${bytes.length}\0`).update(bytes);
+        sizeBytes += bytes.length;
+        if (type === "directory") visit(entry);
+      }
+    };
+    visit(file);
+    return { sha256: digest.digest("hex"), sizeBytes, kind: "bundle-tree-v1" };
+  }
+  const bytes = readFileSync(file);
+  return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.141",
+  "version": "0.2.143",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -29,6 +29,9 @@ import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 import { signingReceiptPath } from "./signing-receipts.mjs";
 import { notarizeAppBundle, validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { fileEvidence } from "./macos-file-evidence.mjs";
+import { expandMacSigningEntries } from "./mac-bundle-signing.mjs";
+import { buildStapledSwiftMacDmg, swiftMacDmgConfigError, swiftMacDmgPlan } from "./swift-mac-dmg.mjs";
 import { runConfiguredChecks } from "./release-checks.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
@@ -157,6 +160,8 @@ if (opts.platform === "mac") {
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
   if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
   if (target.notarize.appBeforePackage && !target.notarize.app) fail(`${config.app ?? "app"} mac notarize.appBeforePackage requires notarize.app`);
+  const swiftDmgError = swiftMacDmgConfigError({ target, projectType: resolveProjectType({ appRoot: root, config, target }), appName: config.app ?? "app" });
+  if (swiftDmgError) fail(swiftDmgError);
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
@@ -329,6 +334,14 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   }
 }
 
+if (opts.platform === "mac" && runMacPhase("package")) {
+  // SwiftPM + appBeforePackage: the .app is stapled by now, so right-release packs it into the DMG itself.
+  const swiftDmg = swiftMacDmgPlan({ target, projectType: resolveProjectType({ appRoot: root, config, target }), appName: config.app ?? path.basename(root), resolve: (p) => resolveReleaseArtifactPath(root, p) });
+  if (swiftDmg) {
+    if (opts.dryRun) console.log(`dry-run: build DMG ${swiftDmg.out} from stapled app ${swiftDmg.app}, then sign it`);
+    else await buildStapledSwiftMacDmg(swiftDmg, { remove: (file) => rmSync(file, { force: true }), signDmg: (dmg) => signMacos([dmg], root, "dmg-signing") });
+  }
+}
 if (command && (opts.platform !== "mac" || runMacPhase("package"))) await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
@@ -858,8 +871,17 @@ function windowsReceiptPath(root, phase) {
   return signingReceiptPath({ appRoot: root, target, platform: "win", phase, stateRoot: process.env.RIGHT_RELEASE_STATE_ROOT });
 }
 
-async function signMacos(files, root) {
-  const receipt = macosReceiptPath(root, "signing");
+async function signMacos(files, root, phase = "signing") {
+  const receipt = phase === "signing" ? macosReceiptPath(root, "signing") : path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `macos-${phase}.json`);
+  // Directory entries (.app bundles): nested code first, no entitlements, then the bundle itself.
+  let nested = [];
+  try { ({ nested } = opts.dryRun ? { nested: [] } : expandMacSigningEntries(files)); } catch (error) { fail(error.message); }
+  if (nested.length) {
+    const nestedReceipt = path.resolve(path.dirname(receipt), `macos-${phase}-nested.json`);
+    if (existsSync(nestedReceipt)) unlinkSync(nestedReceipt);
+    console.log(`right-release: signing ${nested.length} nested code item(s) inside-out`);
+    await run("node", [SIGN_MACOS, "--receipt", nestedReceipt, ...nested], root);
+  }
   const args = [SIGN_MACOS];
   if (opts.dryRun) args.push("--dry-run");
   args.push("--receipt", receipt, ...files);
@@ -911,7 +933,7 @@ function verifyMacosSigningReceipt(receipt, files) {
   try { expectedIdentity = resolveMacosDeveloperIdIdentity(); } catch (error) { fail(error.message); }
   const expected = files.map((file) => path.resolve(file)).sort();
   const actual = Array.isArray(evidence.files) ? evidence.files.map((item) => path.resolve(item.file)).sort() : [];
-  const hashes = new Map(files.map((file) => [path.resolve(file), createHash("sha256").update(readFileSync(file)).digest("hex")]));
+  const hashes = new Map(files.map((file) => [path.resolve(file), fileEvidence(file).sha256]));
   if (evidence.schema !== 1 || evidence.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT || !expectedIdentity || evidence.identity !== expectedIdentity
     || JSON.stringify(expected) !== JSON.stringify(actual)
     || evidence.files.some((item) => item.codesign !== "strict-valid" || item.identity !== expectedIdentity || item.timestampPresent !== true || item.after?.sha256 !== hashes.get(path.resolve(item.file)))) fail(`invalid macOS Developer ID signing receipt evidence: ${receipt}`);

package/rightkit-versions.json

@@ -16,7 +16,7 @@
     "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
     "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.32",
+    "@rightkit/git": "0.2.33",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.141",
+    "@rightkit/release": "0.2.143",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -73,7 +73,8 @@
       "0.2.28",
       "0.2.29",
       "0.2.30",
-      "0.2.31"
+      "0.2.31",
+      "0.2.32"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -172,7 +173,9 @@
       "0.2.137",
       "0.2.138",
       "0.2.139",
-      "0.2.140"
+      "0.2.140",
+      "0.2.141",
+      "0.2.142"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -277,7 +280,7 @@
     "rightkit-db": "0.3.2",
     "rightkit-embed": "0.3.1",
     "rightkit-framed-sidecar": "0.1.0",
-    "rightkit-fs": "0.3.2",
+    "rightkit-fs": "0.3.3",
     "rightkit-fsindex": "0.1.0",
     "rightkit-http": "0.2.4",
     "rightkit-jobs": "0.2.6",
@@ -334,7 +337,7 @@
       "rightkit-db": "0.3.2",
       "rightkit-embed": "0.3.1",
       "rightkit-framed-sidecar": "0.1.0",
-      "rightkit-fs": "0.3.2",
+      "rightkit-fs": "0.3.3",
       "rightkit-fsindex": "0.1.0",
       "rightkit-http": "0.2.4",
       "rightkit-jobs": "0.2.6",
@@ -371,7 +374,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.32",
+      "@rightkit/git": "0.2.33",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -384,7 +387,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.141",
+      "@rightkit/release": "0.2.143",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -517,7 +520,8 @@
       "0.1.0",
       "0.2.0",
       "0.3.0",
-      "0.3.1"
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-service": [
       "0.1.0",

package/sign-macos.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
+import { fileEvidence } from "./macos-file-evidence.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
@@ -56,28 +56,6 @@ const absoluteReceipt = path.resolve(receiptPath);
 mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
 writeFileSync(absoluteReceipt, `${JSON.stringify({ schema: 1, signingContract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, files: evidence }, null, 2)}\n`);
 
-function fileEvidence(file) {
-  if (statSync(file).isDirectory()) {
-    const digest = createHash("sha256");
-    let sizeBytes = 0;
-    function visit(directory) {
-      for (const name of readdirSync(directory).sort()) {
-        const entry = path.join(directory, name);
-        const info = lstatSync(entry);
-        const type = info.isSymbolicLink() ? "link" : info.isDirectory() ? "directory" : "file";
-        const bytes = type === "link" ? Buffer.from(readlinkSync(entry)) : type === "file" ? readFileSync(entry) : Buffer.alloc(0);
-        digest.update(`${path.relative(file, entry).split(path.sep).join("/")}\0${type}\0${bytes.length}\0`).update(bytes);
-        sizeBytes += bytes.length;
-        if (type === "directory") visit(entry);
-      }
-    }
-    visit(file);
-    return { sha256: digest.digest("hex"), sizeBytes, kind: "bundle-tree-v1" };
-  }
-  const bytes = readFileSync(file);
-  return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
-}
-
 function run(cmd, runArgs) {
   const result = spawnSync(cmd, runArgs, { encoding: "utf8" });
   const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;

package/swift-mac-dmg.mjs

@@ -0,0 +1,52 @@
+// SwiftPM macOS DMG ordering. With `notarize.appBeforePackage` the .app is notarized and stapled first;
+// right-release then builds the DMG itself (dmg-build.mjs, as Tauri does) so it packs the stapled app,
+// signs it, and the existing archive notarization staples the DMG.
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { buildDmg } from "./dmg-build.mjs";
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+const DMG_HOOK = /dmg|hdiutil/i;
+
+/** True when the prePackage hook looks like it builds a DMG (heuristic on command and arguments). */
+export const prePackageBuildsDmg = (prePackage) => Boolean(prePackage?.cmd) && DMG_HOOK.test([prePackage.cmd, ...(prePackage.args ?? [])].join(" "));
+
+/** Config error for swiftpm mac targets, or null. */
+export function swiftMacDmgConfigError({ target, projectType, appName = "app" }) {
+  if (projectType !== "swiftpm" || !target?.notarize?.appBeforePackage) return null;
+  if (prePackageBuildsDmg(target.prePackage)) {
+    return `${appName} mac prePackage builds a DMG while notarize.appBeforePackage is on, so the DMG would pack the unstapled .app. Drop DMG creation from prePackage: right-release builds the DMG after the .app is notarized and stapled (configure targets.mac.dmg for volname/background), or set targets.mac.dmg: false and build it in targets.mac.package.`;
+  }
+  if (target.dmg !== false && !target.package?.cmd && !String(target.notarize.file ?? "").endsWith(".dmg")) {
+    return `${appName} mac notarize.file must be a .dmg when right-release builds the DMG (notarize.appBeforePackage with no targets.mac.package)`;
+  }
+  return null;
+}
+
+/** Plan for the automatic DMG, or null when the app config builds its own (package step, dmg: false, or no appBeforePackage). */
+export function swiftMacDmgPlan({ target, projectType, appName = "app", resolve = (p) => path.resolve(p) }) {
+  if (projectType !== "swiftpm" || !target?.notarize?.appBeforePackage || target.dmg === false || target.package?.cmd) return null;
+  const d = target.dmg ?? {};
+  return {
+    app: resolve(target.notarize.app),
+    out: resolve(d.out ?? target.notarize.file),
+    options: { volname: d.volname ?? appName, background: d.background && resolve(d.background), iconSize: d.iconSize, appPosition: d.appPosition,
+      applicationsPosition: d.applicationsPosition, window: d.window, volumeIcon: d.volumeIcon && resolve(d.volumeIcon) },
+  };
+}
+
+const definedOnly = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined));
+
+/**
+ * Build the DMG from the stapled app, then sign it. Refuses to pack an app whose notarization ticket is not
+ * stapled. Injectable: run (stapler), build, signDmg, log.
+ */
+export async function buildStapledSwiftMacDmg(plan, { run = spawnSync, build = buildDmg, signDmg, log = console.log, remove = () => {} } = {}) {
+  const probe = run("xcrun", ["stapler", "validate", plan.app], { encoding: "utf8" });
+  if (probe.error || probe.status !== 0) throw fail("SWIFT_DMG_APP_NOT_STAPLED", `refusing to build the DMG: ${plan.app} is not stapled (xcrun stapler validate failed). Notarize and staple the app before packaging.`);
+  remove(plan.out);
+  log(`right-release: building macOS DMG from stapled app ${plan.app}`);
+  const built = build({ app: plan.app, out: plan.out, ...definedOnly(plan.options) });
+  if (signDmg) await signDmg(plan.out);
+  return built;
+}