Put the signed bundle in the image it is distributed in

[tannevaled]

A .app is what AppKit needs; a .dmg is what a person downloads. The reader could make the first and not the second.

APP=$(go run ./cmd/bundle -exe ./newsreader -dir /tmp -version 1.2.3)
codesign --force --deep --sign "NewsReader Dev" --identifier com.gonewsreader.reader "$APP"
go run ./cmd/dmg -app "$APP" -o "News Reader.dmg"

cmd/dmg puts the bundle in the image it is distributed in — the application on the left, a shortcut to /Applications on the right, the reader's own icon on the volume, and a window sized to hold them — through go-macos/appdmg: pure Go, CGO_ENABLED=0, no hdiutil. A 100 MB bundle becomes a 55 MB image in about four seconds.

Sign first, and this checks that it survived

The image is a copy of the bundle as it stands, so a bundle signed afterwards is not the bundle inside it. Signed first, the copy inside the mounted image answers:

/Volumes/News Reader/News Reader.app: valid on disk
/Volumes/News Reader/News Reader.app: satisfies its Designated Requirement
Identifier=com.gonewsreader.reader

Checked rather than assumed — a copy that dropped extended attributes would have produced an application macOS refuses to open.

Also verified on the mounted image: the volume root carries kHasCustomIcon (GetFileInfo -a → …C…), and the Finder opens the window at 620 × 380 with the icons at (160, 200) and (460, 200) — the positions asked for.

Details

• The volume icon comes from internal/appicon through appbundle.ICNS, the same PNG the bundle's icon is made of.
• -background takes a picture when there is art for one. Without it the window is given a size of its own, since nothing else would know one — the Finder would otherwise open it at whatever size it used last.
• Build tooling, so it joins cmd/bundle outside the coverage gate. It cross-builds on every target in the matrix (checked locally for linux/amd64, s390x, riscv64, windows/arm64, darwin/arm64, android/arm64).
• .gitignore gains /dmg and /bundle: go build ./cmd/dmg leaves a binary in the repo root, and that file already carries a note about three that were committed at ~97 MB each.

🤖 Generated with Claude Code