chore: release 26.0.65

Sign the Sparkle framework before signing the whole app to ensure
proper code signature chain for sandboxed installation.

Sparkle/appcast.xml

@@ -2,6 +2,14 @@
 <rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
     <channel>
         <title>iKeyMon</title>
+        <item>
+            <title>26.0.65</title>
+            <pubDate>Tue, 30 Dec 2025 20:19:28 +0100</pubDate>
+            <sparkle:version>142</sparkle:version>
+            <sparkle:shortVersionString>26.0.65</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>15.2</sparkle:minimumSystemVersion>
+            <enclosure url="https://git.24unix.net/tracer/iKeyMon/releases/download/v26.0.65/iKeyMon-26.0.65.zip" length="2993625" type="application/octet-stream" sparkle:edSignature="HfLBuEydNbR1aV2LVRY0osEOJypRliYmZzrtIw6P+BJXOBaonUUMI7YoqN8s0BxmQPPFptK1cbGxWDCMd0cHBA=="/>
+        </item>
         <item>
             <title>26.0.64</title>
             <pubDate>Tue, 30 Dec 2025 20:14:01 +0100</pubDate>
@@ -18,13 +26,5 @@
             <sparkle:minimumSystemVersion>15.2</sparkle:minimumSystemVersion>
             <enclosure url="https://git.24unix.net/tracer/iKeyMon/releases/download/v26.0.63/iKeyMon-26.0.63.zip" length="2993596" type="application/octet-stream" sparkle:edSignature="udQ57rAo8alD9s0yHclEODCiWTTC+OJzQsg2V7LXEKWE03dR7F4qFqm++SMYWeOaxEuQlUTVgb3FLQHa5ceCDg=="/>
         </item>
-        <item>
-            <title>26.0.62</title>
-            <pubDate>Tue, 30 Dec 2025 19:55:54 +0100</pubDate>
-            <sparkle:version>136</sparkle:version>
-            <sparkle:shortVersionString>26.0.62</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.2</sparkle:minimumSystemVersion>
-            <enclosure url="https://git.24unix.net/tracer/iKeyMon/releases/download/v26.0.62/iKeyMon-26.0.62.zip" length="2993466" type="application/octet-stream" sparkle:edSignature="TVEg0UZJewO0AIu58Q67jMhan7aINhb843UdKAMz1kxc4dDmryXye4RBj4vs7cnsUXY0R2S5kqgNoWxYF2WdDg=="/>
-        </item>
     </channel>
 </rss>

iKeyMon.xcodeproj/project.pbxproj

@@ -322,7 +322,7 @@
 				CODE_SIGN_ENTITLEMENTS = iKeyMon.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 140;
+				CURRENT_PROJECT_VERSION = 142;
 				DEVELOPMENT_ASSET_PATHS = "\"Preview Content\"";
 				DEVELOPMENT_TEAM = Q5486ZVAFT;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -337,7 +337,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 26.0.64;
+				MARKETING_VERSION = 26.0.65;
 				PRODUCT_BUNDLE_IDENTIFIER = net.24unix.iKeyMon;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -353,7 +353,7 @@
 				CODE_SIGN_ENTITLEMENTS = iKeyMon.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 140;
+				CURRENT_PROJECT_VERSION = 142;
 				DEVELOPMENT_ASSET_PATHS = "\"Preview Content\"";
 				DEVELOPMENT_TEAM = Q5486ZVAFT;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -368,7 +368,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 26.0.64;
+				MARKETING_VERSION = 26.0.65;
 				PRODUCT_BUNDLE_IDENTIFIER = net.24unix.iKeyMon;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_EMIT_LOC_STRINGS = YES;

scripts/build_release.sh

@@ -159,6 +159,14 @@ if [[ ! -d "$APP_PATH" ]]; then
 fi
 
 if [[ -n "${CODESIGN_IDENTITY:-}" ]]; then
+  echo "🔏 Codesigning Sparkle framework..."
+  codesign \
+    --force \
+    --options runtime \
+    --timestamp \
+    --sign "$CODESIGN_IDENTITY" \
+    "$APP_PATH/Contents/Frameworks/Sparkle.framework"
+
   echo "🔏 Codesigning app with identity: $CODESIGN_IDENTITY"
   codesign \
     --deep \

version.json

@@ -1,3 +1,3 @@
 {
-  "marketing_version": "26.0.64"
+  "marketing_version": "26.0.65"
 }