Distribution

Check which version each channel serves, verify a download, and build a signed release.

Current release status

| Channel | Status | | --- | --- | | macOS app (GitHub Releases, Homebrew) | Signed and notarized v0.5.2 | | Chrome Web Store | Extension v0.4.8, updated August 23, 2026 (v0.5.2 in review) | | Windows (WinGet, setup ZIP) | Pending the signed Windows release and WinGet indexing |

The app and extension versions can differ because Chrome Web Store review and signed app publication complete independently.

Verify a download

Download the artifact and its checksum file from the same release, then check the hash. Replace X.Y.Z with the release version:

shasum -a 256 -c agent-browser-gateway-X.Y.Z-macos-arm64.dmg.sha256.txt

For a release bundle that publishes SHA256SUMS.txt:

shasum -a 256 -c SHA256SUMS.txt --ignore-missing

Install only artifacts whose checksum matches. If the checksum file is missing or the hash does not match, stop and open a GitHub issue.

After installation, check the app signature before first launch:

codesign --verify --strict --verbose=2 "/Applications/Agent Browser Gateway.app"
spctl --assess --type execute --verbose "/Applications/Agent Browser Gateway.app"

Channels

Homebrew cask

The cask installs Agent Browser Gateway.app into /Applications and abg into Homebrew’s bin.

brew tap arcmanagement/agent-browser-gateway https://github.com/arcmanagement/agent-browser-gateway
brew trust --cask arcmanagement/agent-browser-gateway/agent-browser-gateway
brew install --cask agent-browser-gateway

If Homebrew reports that the latest version is already installed, the cask install path works and no update is needed.

A release is ready for Homebrew when the versioned macOS ZIP is published under the matching GitHub Release and this repository’s Casks/agent-browser-gateway.rb points at that version and SHA-256.

Chrome Web Store

Install the extension from the public Chrome Web Store listing.

To verify a release, confirm the listing is available, then record its displayed version and update date separately from the latest macOS release. The listing currently reports version 0.4.8, updated August 23, 2026. Extension v0.5.2 is in review.

WinGet

winget install --id ArcManagement.AgentBrowserGateway --source winget

For v0.5.2, this package is not indexed yet. The command returns no matching package until the signed Windows release workflow and WinGet submission complete.

A release is ready for WinGet after the public Windows setup ZIP is on GitHub Releases and the generated microsoft/winget-pkgs PR is merged and indexed.

Mac App Store

The Mac App Store path is separate from the Developer ID and Homebrew release path. Store builds use App Sandbox and App Store distribution signing and are uploaded to App Store Connect. The checklist lives in docs/app-store-submission.md.

Maintainer release build

Build signed artifacts

Build Developer ID signed and notarized artifacts on a trusted Mac:

export VERSION=0.5.2
make release-dmg VERSION="$VERSION" \
  SIGN_IDENTITY="Developer ID Application: ArcManagement Inc (M46W5MVAQP)" \
  NOTARY_PROFILE="abg-notary"

make release-dmg runs make dist first, so it writes the macOS ZIP, the DMG, the extension ZIP, and the generated cask under dist/.

Keep Developer ID signing local. Do not put the Developer ID private key, certificate password, App Store Connect credentials, or notarytool credentials into GitHub Actions secrets.

Verify the artifacts

codesign --verify --strict --verbose=2 \
  "dist/agent-browser-gateway-$VERSION-macos-arm64/Agent Browser Gateway.app"
codesign --verify --strict --verbose=2 \
  "dist/agent-browser-gateway-$VERSION-macos-arm64/abg"
spctl --assess --type execute --verbose \
  "dist/agent-browser-gateway-$VERSION-macos-arm64/Agent Browser Gateway.app"
shasum -a 256 \
  "dist/agent-browser-gateway-$VERSION-macos-arm64.zip" \
  "dist/agent-browser-gateway-extension-$VERSION.zip"

CI may build and test unsigned artifacts. Create signed release assets on a trusted maintainer Mac and upload them to the draft GitHub Release before publication.

Reproducible build dry run

Before a v1.0 release, run the unsigned reproducible dry run:

make reproducible-build

It writes extension and Gateway comparison artifacts, SHA256SUMS.txt, BUILD_INPUTS.txt, and agent-browser-gateway-$VERSION.spdx.json under dist/reproducible-build/. The checksum, signing, SBOM, provenance, and user verification plan is in docs/RELEASE_ARTIFACT_TRUST.md.

Install: install steps for each channel.
Security: what the Gateway sends and stores.