sunnypatell/sunnify-spotify-downloader v2.0.10 on GitHub

what's changed

changed

release pipeline rebuilt around a dedicated trusted builder (#54). binaries are now built and attested inside the release-build.yml reusable workflow, which upgrades the build provenance from slsa build L2 to L3 per github's official guidance. build inputs are hash-locked (pip install --require-hashes, every wheel pinned by sha256 on all three platforms, pyinstaller included), builds check out the release tag itself, and PYTHONHASHSEED + SOURCE_DATE_EPOCH are set for determinism.
macos app seal now survives packaging. the .app gets an explicit ad-hoc re-sign plus a codesign --verify --strict gate, and is archived with ditto instead of zip -r (zip dereferences qt framework symlinks, which could break the signature seal). an intact seal means a blocked first launch gets the recoverable "open anyway" path instead of the dead-end "damaged" dialog.
brew install --cask sunnify is now zero-friction. the cask strips quarantine post-install (after homebrew has verified the archive's sha256 against the cask), so the app just opens - no more sudo xattr instructions. transparency note about the ad-hoc signature stays in the caveats.

added

offline verification bundles: every binary ships with a <name>.sigstore.json release asset, so you can verify provenance without the github api in the loop.
repo-side: openssf scorecard (weekly score + badge), actionlint + zizmor gating workflow changes, dependabot keeping all action pins and lockfile hashes fresh (grouped, monthly), RELEASING/SUPPORT/GOVERNANCE docs, github private vulnerability reporting documented as the preferred security channel.

notes

no app-code changes in this release; the binaries are rebuilt from the same source as v2.0.9 with newer locked dependencies (notably yt-dlp 2026.6.9). if v2.0.9 works for you there is no urgency to upgrade; macos users get the smoothest install experience to date.
the first run of the new workflow-lint gate caught that the previous actions/checkout sha pin had been orphaned by an upstream retag (unreachable in the repo's history). repinned to the commit v6.0.3 actually resolves to. the new tooling paying for itself on day one.

verifying this release

# checksums (no extra tooling)
sha256sum -c checksums.txt --ignore-missing

# slsa build l3 provenance, pinned to the trusted builder
gh attestation verify Sunnify-Linux \
  --repo sunnypatell/sunnify-spotify-downloader \
  --signer-workflow sunnypatell/sunnify-spotify-downloader/.github/workflows/release-build.yml

# offline (uses the attached bundle instead of the github api)
gh attestation verify Sunnify-Linux \
  --repo sunnypatell/sunnify-spotify-downloader \
  --bundle Sunnify-Linux.sigstore.json

install via homebrew (macos)

brew tap sunnypatell/sunnify https://github.com/sunnypatell/sunnify-spotify-downloader
brew install --cask sunnify

full changelog: v2.0.9...v2.0.10

attestations from this build

direct links to each attestation generated by the workflow run that produced these binaries (sigstore-signed, public-good rekor log entry, SLSA build L3 via the release-build.yml reusable workflow):

the *.sigstore.json assets attached above are the same attestations as offline-verifiable bundles. these get auto-refreshed on every release re-build, so the links above always correspond to the binaries currently attached to this release.