edit | blame | history | raw

TagLauncher 8.3.6 App Store PKG Preflight

Date: 2026-07-07
Version: 8.3.6
Build: 20260707.1506

Package

  • Upload package: Upload/TagLauncher-8.3.6-build20260707.1506.pkg
  • Local rollback DMG: Archive/TagLauncher-8.3.6-build20260707.1506.dmg
  • Replaces failed upload package: AppStore-8.3.6-20260707.1242/Upload/TagLauncher-8.3.6-build20260707.1242.pkg

Signing

  • App signing identity: 3rd Party Mac Developer Application: Hainan Wanxing Technology Co., Ltd. (CR3J54M8BQ)
  • Installer signing identity: 3rd Party Mac Developer Installer: Hainan Wanxing Technology Co., Ltd. (CR3J54M8BQ)
  • Embedded provisioning profile: TagLauncher Mac App Store 20260707
  • Provisioning profile UUID: 3ee49163-ef5c-4467-8971-f93cc1fc6b6d

Payload Metadata

  • CFBundleShortVersionString: 8.3.6
  • CFBundleVersion: 20260707.1506
  • Bundle ID: com.taglauncher.app
  • Team ID: CR3J54M8BQ

Permission Gate

The failed 20260707.1242 upload was rejected because a payload directory was only readable by root after installation. The rebuilt payload was expanded and checked with:

find "$APP" \( -type d ! -perm -005 -o -type f ! -perm -004 \) -ls

Result:

  • PASS: no app bundle directories are restricted from non-root search/read access.
  • PASS: no app bundle files are restricted from non-root read access.
  • PASS: main executable is readable and executable by non-root users.

Verification

Commands completed successfully:

pkgutil --check-signature Upload/TagLauncher-8.3.6-build20260707.1506.pkg
pkgutil --expand-full Upload/TagLauncher-8.3.6-build20260707.1506.pkg /tmp/taglauncher-836-1506-pkg-preflight/expanded
codesign --verify --deep --strict --verbose=2 /tmp/taglauncher-836-1506-pkg-preflight/expanded/com.taglauncher.app.pkg/Payload/TagLauncher.app
hdiutil verify Archive/TagLauncher-8.3.6-build20260707.1506.dmg
shasum -a 256 -c SHA256SUMS.txt

Non-gating local distribution check:

  • spctl -a -vv -t install may reject App Store upload packages signed with 3rd Party Mac Developer Installer.
  • This artifact is for App Store Connect upload, not Developer ID local distribution. Treat pkgutil --check-signature, payload codesign --verify, embedded provisioning profile, payload permission gate, and ASC upload validation as the release gates.

Hashes

a35525d303b3ee85d40c16f595b9461fc912c5fab559d20d4881b1776fa44f35  Archive/TagLauncher-8.3.6-build20260707.1506.dmg
933043a2dac0be016b7dfd9effdf048462456592d340f68fd3fe5653052d59b9  Upload/TagLauncher-8.3.6-build20260707.1506.pkg