The Doctor: Verify the Installed Artifact

"Source, bundle, and installed versions must be compared explicitly by the install/doctor scripts. A successful swift build is not deployment proof."

What's Actually in /Applications?

You built, you bundled the closure, you signed it, you ran the installer. Now the app sits in /Applications. Here's the uncomfortable question: is what's installed actually what you think it is? Maybe the installer copied an older build. Maybe a signature didn't take. Maybe a dylib is still pointing at Homebrew. Maybe you're looking at last week's version. Belief is not verification, and the gap between 'I installed it' and 'the installed thing is correct' is exactly where deployment bugs hide.

Ashen Reel closes that gap with a doctor: a script whose only job is to interrogate the actual installed bundle and prove it's real. Not the build output — the thing on disk that users launch.

What the Doctor Proves

The doctor checks the claims a compile can't: a stable code signature across the app and every nested Mach-O binary; a complete internal dependency closure with no Homebrew runtime link; a bundled custom icon; and a clear distinction between a source build and the installed release. Each check turns a hope into a fact you can read in the output.

Verify the installed artifact, not the build output. The only thing users run is the bundle on disk. Point your verification at that — its signature, its dependencies, its version — because every step between source and install is a place something can quietly go wrong.

A doctor is a handful of checks, each turning an assumption into a pass or a loud fail:

Make source-to-installed drift observable. The install and doctor scripts compare the source build, the bundled release, and the installed app explicitly, so a mismatch is visible instead of silent. When the version in /Applications disagrees with what you just built, you want a script to tell you — not a confused user reporting a bug you already fixed.

The Doctor Is the Real Definition of Done

Track 6 opened with 'swift build is not deployment proof.' The doctor is what deployment proof actually looks like. A green build says the code is willing; a green doctor says the installed artifact on the real target is signed, self-contained, and the version you meant to ship. For Ashen Reel, 'done' isn't when the build passes — it's when the doctor passes against the bundle in /Applications on the actual Office Mac. That's the line between compiling software and shipping it.

Code

A doctor interrogates the INSTALLED bundle, not the build·bash

APP="/Applications/Ashen Reel.app"
fail() { echo "doctor: FAIL -- $1"; exit 1; }

# 1. Signed, with a stable identity across the app AND every nested Mach-O.
codesign --verify --deep --strict "$APP" || fail "signature invalid or incomplete"

# 2. Self-contained: NO runtime dependency resolves to Homebrew.
if otool -L "$APP/Contents/MacOS/AshenReel" | grep -q '/opt/homebrew'; then
  fail "installed app still links Homebrew -- not self-contained"
fi

# 3. Installed != a stray dev build: the version must match the release source.
installed=$(defaults read "$APP/Contents/Info" CFBundleShortVersionString)
product=$(jq -r .version cwk-product.json)
[ "$installed" = "$product" ] || fail "installed $installed != product $product"

echo "doctor: PASS -- installed artifact is signed, self-contained, and v$installed"

Exercise

Write a doctor for something you deploy. It must inspect the DEPLOYED artifact (not your source or your build) and assert at least three things: the exact version/identity you intended, that no development-only dependency leaked in, and one integrity property (a signature, a checksum, a required file present). Run it against a real deployment. Did every assertion pass — and would you have known if one silently didn't?

Hint

The doctor's rule: inspect the thing users actually run, and check the properties a build step can't. Version match catches 'installed the wrong build.' A dev-dependency grep catches 'not self-contained.' A signature/hash catches 'tampered or incomplete.' Run it last, every time, and 'done' finally means something checkable.

The Doctor: Verify the Installed Artifact

What's Actually in /Applications?

What the Doctor Proves

The Doctor Is the Real Definition of Done

Code

External links

Exercise

Progress

Comments 0