The download manifest told visitors there was "no signed and notarized public Portal release" yet, implying notarization is the bar the project is working toward. It is not: Portal is deliberately ad-hoc signed and GitHub-attested, and `verify-website.sh` fails the build if any surface claims Developer ID notarization. Reading it as a pending step misrepresents the trust model on the one surface a prospective downloader actually sees. State what is true -- no release promoted yet -- and name the signing posture directly, so the string stays accurate once the download goes live.
- commit
- 78f9065c00de64f42ca794124c05d52323d93e4d
- parent
- 711718e9e8208560b3a1e550039867d57aa26ba5
- author
- Dami <dami.etoile@gmail.com>
| M | website/ | 2 | +- |
@@ -2,7 +2,7 @@
22 "builds": {33 "macos-arm64": {44 "available": false,5- "reason": "No signed and notarized public Portal release has been promoted yet."5+ "reason": "No public Portal release has been promoted yet. Portal is ad-hoc signed and GitHub-attested, never Apple-notarized."66 }77 },88 "format": 1,