Wire Forge-native release infrastructure

Apple/App/App.xcconfig

@@ -18,6 +18,10 @@ INFOPLIST_KEY_LSUIElement[sdk=macosx*] = YES
 INFOPLIST_KEY_NSMainNibFile[sdk=macosx*] = MainMenu
 INFOPLIST_KEY_NSPrincipalClass[sdk=macosx*] = NSApplication
 INFOPLIST_KEY_LSApplicationCategoryType[sdk=macosx*] = public.app-category.utilities
+BURROW_SPARKLE_FEED_URL = https:/$()/releases.burrow.net/sparkle/appcast.xml
+BURROW_SPARKLE_PUBLIC_ED_KEY = Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=
+INFOPLIST_KEY_SUFeedURL[sdk=macosx*] = $(BURROW_SPARKLE_FEED_URL)
+INFOPLIST_KEY_SUPublicEDKey[sdk=macosx*] = $(BURROW_SPARKLE_PUBLIC_ED_KEY)
 
 CODE_SIGN_ENTITLEMENTS = App/App-iOS.entitlements
 CODE_SIGN_ENTITLEMENTS[sdk=macosx*] = App/App-macOS.entitlements

Apple/App/AppDelegate.swift

@@ -1,12 +1,18 @@
 #if os(macOS)
 import AppKit
 import BurrowUI
+import Sparkle
 import SwiftUI
 
 @main
 @MainActor
 class AppDelegate: NSObject, NSApplicationDelegate {
     private var windowController: NSWindowController?
+    private let updaterController = SPUStandardUpdaterController(
+        startingUpdater: true,
+        updaterDelegate: nil,
+        userDriverDelegate: nil
+    )
 
     private let quitItem: NSMenuItem = {
         let quitItem = NSMenuItem(
@@ -30,6 +36,16 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         return item
     }()
 
+    private lazy var checkForUpdatesItem: NSMenuItem = {
+        let item = NSMenuItem(
+            title: "Check for Updates...",
+            action: #selector(checkForUpdates(_:)),
+            keyEquivalent: ""
+        )
+        item.target = self
+        return item
+    }()
+
     private let toggleItem: NSMenuItem = {
         let toggleView = NSHostingView(rootView: MenuItemToggleView())
         toggleView.frame.size = CGSize(width: 300, height: 32)
@@ -45,6 +61,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         menu.items = [
             toggleItem,
             openItem,
+            checkForUpdatesItem,
             .separator(),
             quitItem
         ]
@@ -86,5 +103,10 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         windowController = controller
         NSApplication.shared.activate(ignoringOtherApps: true)
     }
+
+    @objc
+    private func checkForUpdates(_ sender: Any?) {
+        updaterController.checkForUpdates(sender)
+    }
 }
 #endif

Apple/Burrow.xcodeproj/project.pbxproj

@@ -17,6 +17,7 @@
 		D03383B02C8E67E300F7C44E /* NIOTransportServices in Frameworks */ = {isa = PBXBuildFile; productRef = D044EE952C8DAB2800778185 /* NIOTransportServices */; };
 		D05B9F7629E39EEC008CB1F9 /* BurrowApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = D05B9F7529E39EEC008CB1F9 /* BurrowApp.swift */; };
 		D09150422B9D2AF700BE3CB0 /* MainMenu.xib in Resources */ = {isa = PBXBuildFile; fileRef = D09150412B9D2AF700BE3CB0 /* MainMenu.xib */; platformFilters = (macos, ); };
+		D0A11C102F90000100112233 /* DequeModule in Frameworks */ = {isa = PBXBuildFile; productRef = D0A11C0F2F90000100112233 /* DequeModule */; };
 		D0B1D1102C436152004B7823 /* AsyncAlgorithms in Frameworks */ = {isa = PBXBuildFile; productRef = D0B1D10F2C436152004B7823 /* AsyncAlgorithms */; };
 		D0BCC6092A09A03E00AD070D /* libburrow.a in Frameworks */ = {isa = PBXBuildFile; fileRef = D0BCC6032A09535900AD070D /* libburrow.a */; };
 		D0BF09522C8E66F6000D8DEC /* BurrowConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */; };
@@ -47,6 +48,7 @@
 		D0FA10022D10200100112233 /* burrow.grpc.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0FA10042D10200100112233 /* burrow.grpc.swift */; };
 		D0F7597E2C8DB30500126CF3 /* CGRPCZlib in Frameworks */ = {isa = PBXBuildFile; productRef = D0F7597D2C8DB30500126CF3 /* CGRPCZlib */; };
 		D0F7598D2C8DB3DA00126CF3 /* Client.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4992C8D921A007F820A /* Client.swift */; };
+		D0C0DE102FA0000100112233 /* Sparkle in Frameworks */ = {isa = PBXBuildFile; platformFilters = (macos, ); productRef = D0C0DE122FA0000100112233 /* Sparkle */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -218,6 +220,7 @@
 				D0BF09552C8E66FD000D8DEC /* BurrowConfiguration.framework in Frameworks */,
 				D0F4FAD32C8DC79C0068730A /* BurrowCore.framework in Frameworks */,
 				D0D4E5892C8D9C94007F820A /* BurrowUI.framework in Frameworks */,
+				D0C0DE102FA0000100112233 /* Sparkle in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -238,6 +241,7 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				D0A11C102F90000100112233 /* DequeModule in Frameworks */,
 				D0D4E5702C8D9C62007F820A /* BurrowCore.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -460,6 +464,9 @@
 				D020F65C29E4A697002790F6 /* PBXTargetDependency */,
 			);
 			name = App;
+			packageProductDependencies = (
+				D0C0DE122FA0000100112233 /* Sparkle */,
+			);
 			productName = Burrow;
 			productReference = D05B9F7229E39EEC008CB1F9 /* Burrow.app */;
 			productType = "com.apple.product-type.application";
@@ -504,6 +511,7 @@
 			);
 			name = UI;
 			packageProductDependencies = (
+				D0A11C0F2F90000100112233 /* DequeModule */,
 			);
 			productName = Core;
 			productReference = D0D4E5582C8D9BF2007F820A /* BurrowUI.framework */;
@@ -567,6 +575,8 @@
 				D0D4E4852C8D8F29007F820A /* XCRemoteSwiftPackageReference "swift-protobuf" */,
 				D044EE8F2C8DAB2000778185 /* XCRemoteSwiftPackageReference "swift-nio" */,
 				D044EE942C8DAB2800778185 /* XCRemoteSwiftPackageReference "swift-nio-transport-services" */,
+				D0A11C0D2F90000100112233 /* XCRemoteSwiftPackageReference "swift-collections" */,
+				D0C0DE112FA0000100112233 /* XCRemoteSwiftPackageReference "Sparkle" */,
 			);
 			productRefGroup = D05B9F7329E39EEC008CB1F9 /* Products */;
 			projectDirPath = "";
@@ -949,6 +959,14 @@
 				minimumVersion = 1.21.0;
 			};
 		};
+		D0A11C0D2F90000100112233 /* XCRemoteSwiftPackageReference "swift-collections" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/apple/swift-collections.git";
+			requirement = {
+				kind = upToNextMajorVersion;
+				minimumVersion = 1.1.3;
+			};
+		};
 		D0B1D10E2C436152004B7823 /* XCRemoteSwiftPackageReference "swift-async-algorithms" */ = {
 			isa = XCRemoteSwiftPackageReference;
 			repositoryURL = "https://github.com/apple/swift-async-algorithms.git";
@@ -957,6 +975,14 @@
 				minimumVersion = 1.0.1;
 			};
 		};
+		D0C0DE112FA0000100112233 /* XCRemoteSwiftPackageReference "Sparkle" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/sparkle-project/Sparkle.git";
+			requirement = {
+				kind = upToNextMajorVersion;
+				minimumVersion = 2.9.2;
+			};
+		};
 		D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */ = {
 			isa = XCRemoteSwiftPackageReference;
 			repositoryURL = "https://github.com/grpc/grpc-swift.git";
@@ -1001,11 +1027,21 @@
 			package = D0D4E4852C8D8F29007F820A /* XCRemoteSwiftPackageReference "swift-protobuf" */;
 			productName = SwiftProtobuf;
 		};
+		D0A11C0F2F90000100112233 /* DequeModule */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = D0A11C0D2F90000100112233 /* XCRemoteSwiftPackageReference "swift-collections" */;
+			productName = DequeModule;
+		};
 		D0B1D10F2C436152004B7823 /* AsyncAlgorithms */ = {
 			isa = XCSwiftPackageProductDependency;
 			package = D0B1D10E2C436152004B7823 /* XCRemoteSwiftPackageReference "swift-async-algorithms" */;
 			productName = AsyncAlgorithms;
 		};
+		D0C0DE122FA0000100112233 /* Sparkle */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = D0C0DE112FA0000100112233 /* XCRemoteSwiftPackageReference "Sparkle" */;
+			productName = Sparkle;
+		};
 		D0F7597D2C8DB30500126CF3 /* CGRPCZlib */ = {
 			isa = XCSwiftPackageProductDependency;
 			package = D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */;

Apple/Burrow.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -1,5 +1,5 @@
 {
-  "originHash" : "fa512b990383b7e309c5854a5279817052294a8191a6d3c55c49cfb38e88c0c3",
+  "originHash" : "5d81b59cbecacd7aae6aa598b32e3513c636250dadab9280a55b905bb0e0ee60",
   "pins" : [
     {
       "identity" : "grpc-swift",
@@ -10,6 +10,15 @@
         "version" : "1.23.0"
       }
     },
+    {
+      "identity" : "sparkle",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/sparkle-project/Sparkle.git",
+      "state" : {
+        "revision" : "6276ba2b404829d139c45ff98427cf90e2efc59b",
+        "version" : "2.9.2"
+      }
+    },
     {
       "identity" : "swift-async-algorithms",
       "kind" : "remoteSourceControl",

Apple/Certificates/README.md

@@ -0,0 +1,41 @@
+# Apple Certificates
+
+Public Apple certificate material that can be inspected by release tooling lives
+here. Private keys do not belong in this directory.
+
+## Developer ID Application
+
+- Apple certificate id: `9JKN6HXBHC`
+- Certificate file: `Apple/Certificates/developer-id-application-9JKN6HXBHC.cer`
+- Subject: `Developer ID Application: Conrad Kramer (87PW93R2ZR)`
+- Issuer: `Developer ID Certification Authority`, `G2`
+- Team id: `87PW93R2ZR`
+- Validity: `2026-06-07T12:13:47Z` through `2031-06-08T12:13:46Z`
+- SHA-256 fingerprint: `7B:2D:58:A5:BB:1E:34:5E:FB:FF:7F:E0:A1:CA:4F:B1:5B:6E:08:AF:CE:FD:BE:D0:2B:0A:E9:9C:82:E3:4F:74`
+- Google KMS key:
+  `projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-developer-id-application/cryptoKeyVersions/1`
+- KMS public-key SHA-256:
+  `9cfaf4755158f445f20a215ef52e7a7ba00da1a310e2e934ba7db5dbb29d2869`
+
+The certificate was created from a CSR signed by the non-exportable Google KMS
+key above. There is no `.p12` for this identity. Release signing must use a
+signer that delegates the relevant Apple code-signing operations to Google KMS.
+
+## iOS Distribution
+
+- Apple certificate id: `3G42677598`
+- Certificate file: `Apple/Certificates/ios-distribution-3G42677598.cer`
+- Subject: `iPhone Distribution: Conrad Kramer (87PW93R2ZR)`
+- Issuer: `Apple Worldwide Developer Relations Certification Authority`, `G3`
+- Team id: `87PW93R2ZR`
+- Validity: `2026-06-07T12:21:32Z` through `2027-06-07T12:21:31Z`
+- SHA-256 fingerprint: `5A:2F:BA:6E:FB:CA:2D:58:01:1F:A0:C8:0F:CF:6B:58:BE:AA:73:7F:4E:F8:06:1C:8A:14:1B:22:8A:2A:29:2B`
+- Google KMS key:
+  `projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-ios-distribution/cryptoKeyVersions/1`
+- KMS public-key SHA-256:
+  `f8613ce059de90b29acf01cbd4a7deb37567653bd154bdf6c447098b5c4fae91`
+
+The certificate was created from a CSR signed by the non-exportable Google KMS
+key above through App Store Connect certificate creation. There is no `.p12`
+for this identity. iOS signing requires a signing path that can delegate Apple
+code-signing operations to Google KMS.

Apple/Configuration/Info.plist

@@ -4,5 +4,9 @@
 <dict>
 	<key>CFBundleName</key>
 	<string>$(INFOPLIST_KEY_CFBundleDisplayName)</string>
+	<key>SUFeedURL</key>
+	<string>$(BURROW_SPARKLE_FEED_URL)</string>
+	<key>SUPublicEDKey</key>
+	<string>$(BURROW_SPARKLE_PUBLIC_ED_KEY)</string>
 </dict>
 </plist>