[CI] Staple the app as well as the image, and verify the drag-installed copy

A notarization ticket stapled only to the .dmg covers the download, but the app
the user drags out of it carries none. Its first launch then depends on
Gatekeeper reaching Apple, so a user who is offline, behind a captive portal or
on a restricted network is told "Apple could not verify ... is free of malware"
-- the exact dialog this pipeline exists to prevent. Stapling was gated to the
release branch to save a second Apple round trip; a minute of CI is not worth
that risk, so it now happens wherever notarization does.

The verification step was checking the app while it still sat on the mounted
image, which is not the object the user runs. It now dittos the app out, marks
the copy with the quarantine attribute a browser sets, and asserts against that
copy: the ticket travels with it (stapler validate, so first launch needs no
network) and Gatekeeper accepts it (spctl --type exec). The image itself is
checked the same way a downloaded file would be.

Signed-off-by: Christian Parpart <christian@parpart.family>

Author: christianparpart

.github/workflows/build.yml

@@ -448,11 +448,14 @@ jobs:
             echo "CODE_SIGN_CERTIFICATE_ID=-" >> "$GITHUB_OUTPUT"
             echo "NOTARIZE=OFF" >> "$GITHUB_OUTPUT"
           fi
-          # Stapling the app *inside* the image is a second Apple round trip. The image's
-          # own ticket already satisfies Gatekeeper on download; the app's own ticket only
-          # adds offline first-launch after drag-installing. Worth its minute on something
-          # users actually download, not on every branch push.
-          if [[ -n "$HAS_SIGNING_SECRETS" && "$GH_HEAD_REF" == 'release' ]]; then
+          # Stapled together with the image, never separately. A ticket on the .dmg alone
+          # covers the download, but the app dragged out of it carries none -- so its first
+          # launch depends on Gatekeeper reaching Apple, and a user who is offline, behind a
+          # captive portal or on a restricted network gets exactly the dialog this pipeline
+          # exists to prevent: "Apple could not verify ... is free of malware". Stapling the
+          # app makes the installed copy self-sufficient. It costs a second Apple round trip
+          # of a minute or two, which is not a price worth haggling over against that.
+          if [[ -n "$HAS_SIGNING_SECRETS" ]]; then
             echo "STAPLE_APP=ON" >> "$GITHUB_OUTPUT"
           else
             echo "STAPLE_APP=OFF" >> "$GITHUB_OUTPUT"
@@ -656,13 +659,31 @@ jobs:
           test "$(ls "$MOUNT" | sort | tr '\n' ' ')" = "Applications contour.app "
           test "$(ls "$MOUNT/contour.app/Contents/MacOS")" = "contour"
 
-          if [[ "${{ steps.set_vars.outputs.NOTARIZE }}" == 'ON' ]]; then
-            # The decision a user's Gatekeeper makes on first launch.
-            spctl --assess --verbose=4 --type exec "$MOUNT/contour.app"
-          fi
-          if [[ "${{ steps.set_vars.outputs.STAPLE_APP }}" == 'ON' ]]; then
-            xcrun stapler validate "$MOUNT/contour.app"
+          if [[ "${{ steps.set_vars.outputs.NOTARIZE }}" != 'ON' ]]; then
+            echo "::notice::unsigned build (no secrets); skipping Gatekeeper assertions"
+            exit 0
           fi
+
+          # Reproduce what the user actually does, because that is where the
+          # "Apple could not verify ... is free of malware" dialog comes from: they drag
+          # the app OUT of the image and launch the copy. A ticket stapled only to the
+          # .dmg does not travel with that copy, leaving first launch dependent on
+          # Gatekeeper reaching Apple -- which fails offline, behind a captive portal, or
+          # on a restricted network. So the checks below run against the copy, not against
+          # the app sitting on the mounted image.
+          INSTALLED=$(mktemp -d)/contour.app
+          ditto "$MOUNT/contour.app" "$INSTALLED"
+          # A downloaded image carries this; the copy must clear Gatekeeper with it set.
+          xattr -w com.apple.quarantine "0081;00000000;Safari;" "$INSTALLED"
+
+          # The ticket is embedded in the copy, so first launch needs no network at all.
+          xcrun stapler validate "$INSTALLED"
+          # The exact decision Gatekeeper makes when that copy is first launched.
+          spctl --assess --verbose=4 --type exec "$INSTALLED"
+
+          # And the same for the image a browser just downloaded.
+          xcrun stapler validate "$DMG"
+          spctl --assess --verbose=4 --type install "$DMG"
       - name: upload to artifact store (DMG)
         uses: actions/upload-artifact@v4
         with: