Prerequisites¶

This document distinguishes between:

• Local development — what you need to clone the repo, build, run tests, and dogfood OFEM on your own machine (no signing, no notarization, no release).
• Publishing & signing — what additionally is needed to produce the official signed/notarized .app and ship it via Homebrew cask.

If you only want to contribute code, you only need the Local development section. The publishing requirements are only relevant to the maintainer (Sam) and to release CI.

Local development¶

Plus a configured Microsoft Entra tenant with at least one workspace you can read, so you can sign in with ofem login during development and have something to browse.

Optional but useful¶

• direnv — for project-local env vars (brew install direnv).
• delta — nicer diffs in git (brew install git-delta).
• entr — auto-run tests on file save (brew install entr).
• dlv — Go debugger (brew install delve).

Phase 0 (CLI-only) can be done WITHOUT¶

• Xcode (technically — but you have it anyway for the standard Mac dev environment).
• Apple Developer Program membership.
• Any signing certificates.

You can go build ./cmd/ofem and use the unsigned binary locally as much as you want during Phase 0.

Phase 1+ (File Provider Extension) adds¶

For local dogfooding of the .app: - Xcode 15+ (you already need it). - A free Apple ID and ad-hoc signing are enough to install the .app on your own Mac. Other people cannot install your build without disabling Gatekeeper.

Publishing & signing (maintainer / release CI only)¶

Tools¶

GitHub Actions secrets to configure¶

Domain ownership¶

The bundle identifier dev.debruyn.ofem implies ownership of debruyn.dev. Sam owns this. Not strictly required for code signing but expected by Apple's reverse-DNS convention.

Initial bootstrap order¶

The first time the release pipeline runs end-to-end, this is the order:

1. Enroll in Apple Developer Program.
2. Create Developer ID Application certificate in Xcode.
3. Create App Store Connect API key.
4. Create App Group group.dev.debruyn.ofem in Apple Developer portal.
5. Create Entra App Registration; copy client ID into source.
6. Create Application Insights resource in Azure; copy connection string into GH secret.
7. Create homebrew-ofem empty repo + add HOMEBREW_TAP_GH_TOKEN to OFEM repo secrets.
8. Tag v2026.05.0-rc.1; let CI run; iterate on signing issues.
9. Tag v2026.05.1 for the first stable release.

Environment check for THIS machine (as of writing)¶

Run this script to verify your local-dev environment is ready:

./scripts/check-prereqs.sh   # to be added in the Phase 0 scaffolding

A reference snapshot from Sam's machine at the time of writing: