On Apple Silicon macOS, both official v0.6.11 macOS artifacts match the SHA-256
digests returned by the GitHub release API, but the contained app fails signature
verification.
Artifacts checked:
LLM.Wiki_aarch64.app.tar.gz
(9625672a3be10b4c772641885349e1718b9c42d3b0804600da3117fc6a39256b)LLM.Wiki_0.6.11_aarch64.dmg
(9f30b33f82092c17ba613e1592aa880c134712a14f0812abd101620da243e5df)
The DMG image checksum passes. The app from both packages returns:
LLM Wiki.app: invalid signature (code or signature have been modified)
with:
codesign --verify --deep --strict --verbose=2 "LLM Wiki.app"
spctl --assess --type execute --verbose=4 also does not accept the app. The
bundle displays TeamIdentifier R6KDF42PRK and a stapled notarization ticket, but
strict integrity verification still fails.
Would you please reproduce this on a clean runner and add post-build checks for
both the .app and mounted .dmg before release upload? I did not bypass
Gatekeeper or open the app.
On Apple Silicon macOS, both official v0.6.11 macOS artifacts match the SHA-256
digests returned by the GitHub release API, but the contained app fails signature
verification.
Artifacts checked:
LLM.Wiki_aarch64.app.tar.gz(
9625672a3be10b4c772641885349e1718b9c42d3b0804600da3117fc6a39256b)LLM.Wiki_0.6.11_aarch64.dmg(
9f30b33f82092c17ba613e1592aa880c134712a14f0812abd101620da243e5df)The DMG image checksum passes. The app from both packages returns:
with:
codesign --verify --deep --strict --verbose=2 "LLM Wiki.app"spctl --assess --type execute --verbose=4also does not accept the app. Thebundle displays TeamIdentifier
R6KDF42PRKand a stapled notarization ticket, butstrict integrity verification still fails.
Would you please reproduce this on a clean runner and add post-build checks for
both the
.appand mounted.dmgbefore release upload? I did not bypassGatekeeper or open the app.