[codeskine]

Releases become one installer, Drosera-X.Y.Z-macos.pkg, in place of the VST3-only zip. It installs the VST3, the Audio Unit and the standalone app for all users. Each format can be left out under Customize. CI builds and checks the package on every push. When the Apple signing secrets exist, a tag build signs, notarizes and staples it.

Design: docs/superpowers/specs/2026-11-03-macos-installer-design.md. Plan: docs/superpowers/plans/2026-11-03-macos-installer.md.

What changes

• tools/package/build_pkg.sh builds one component package per format and combines them under distribution.xml.
  • Bundles are not relocatable, so Installer never updates a stray copy elsewhere.
  • The installer requires macOS 11 and declares arm64 and x86_64.
  • The Read Me screen is generated from the licence files. It now includes the OFL texts of the embedded fonts.
  • It signs only when all five signing variables are set, and refuses to run with some of them.
• tools/package/check_pkg.sh expands a package without installing it. It checks components, install paths, relocation, the declared OS and architectures, and code seals, and loads the packaged VST3 in plugin_host_test. For a signed package it also checks the Installer signature, notarization, the stapled ticket and the hardened runtime.
• tools/package/test_package.sh has 11 cases. It proves the check accepts a good package and refuses broken ones: missing AU, relocatable bundles, a broken seal, a missing component, unsigned when signing is required. It also covers paths with spaces, rc versions and HTML escaping.
• The standalone app declares why it uses the microphone. Signed, it gets the audio-input entitlement.
• ci.yml and release.yml:
  • CI builds the standalone app and runs the package test.
  • The package replaces the zip step and the old VST3-only notarization step.
  • Any signing secret means CI expects a signed package.
  • Unsigned releases get an Open Anyway paragraph in their notes.
• Docs:
  • The README is restructured, with badges, a quickstart and the project structure.
  • The manual covers the standalone app.
  • RELEASING.md and BUILDING.md are rewritten for the package and for signing.
  • INSTALL.txt is removed.

The DSP is untouched. render_test and check_reference.sh pass with no new checksums.

Testing

• Locally on macOS 27.2: the full suite and test_package.sh (11/11).
• An earlier probe, and then the real package downloaded as if from Safari, showed the following:
  • An unsigned package is blocked once and opens with Open Anyway.
  • Installer does not pass the quarantine attribute to what it installs.
• The owner installed the package and played Drosera as an AU in Logic, as a VST3 in another host, and in the standalone app, which asked for microphone access.
• A whole-branch review found one important issue: signing was gated on APPLE_ID alone. It is fixed, and a test covers it.

Not covered

• The signed path has never run, because the secrets do not exist yet. RELEASING.md explains the setup and what to check if it fails.
• Deferred minors from the review:
  • grep -q after pipes under pipefail in the signed checks;
  • no lipo check that the binaries are universal;
  • a vague error when a Developer ID identity is missing;
  • no guard against an empty version;
  • no notarytool timeout;
  • the app-specific password on the command line.
• Users of 0.1.x must delete their hand-copied VST3 from ~/Library/Audio/Plug-Ins/VST3/. The installer's last screen, the README and the changelog say so.

🤖 Generated with Claude Code