From 1de232333c472857cef5e848056bcc10203ea24a Mon Sep 17 00:00:00 2001
From: Dami <dami.etoile@gmail.com>
Date: Sat, 25 Jul 2026 19:06:14 -0600
Subject: [PATCH] release: enable the Portal download for v0.1.1

Flips website/portal-release.json to the published v0.1.1 build, which is what
takes goq.sh's download button out of its disabled state.

The runbook asks for the artifact to be verified before this flip rather than
after, so the bytes were checked as a stranger receives them: SHA-256 recomputed
against the published checksum, `gh attestation verify` clean, and the app
inside the mounted DMG reports Signature=adhoc with identifier sh.goq.portal.
`spctl --assess` rejects it, which is the documented and expected result for an
ad-hoc build that is deliberately not notarized.

The Sigil install note also stops calling the signed channel pending, since
v0.1.1 published it and install-sigil now pins that tag.
---
 website/index.html          |  2 +-
 website/portal-release.json | 16 ++++++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/website/index.html b/website/index.html
index d006940..a99fe34 100644
--- a/website/index.html
+++ b/website/index.html
@@ -87,7 +87,7 @@
               <code class="install-cmd"><span class="install-prompt">$</span> <span class="install-text">curl -fsSL https://goq.sh/install-sigil | bash</span></code>
               <button class="install-copy" type="button" aria-label="Copy Sigil install command">copy</button>
             </div>
-            <p class="release-note">dedicated bazzite machine</p>
+            <p class="release-note">dedicated bazzite machine · signed release channel open</p>
           </div>
         </div>
         <p class="hero-note">Games over QUIC: low-latency SteamOS streaming over iroh <br> Work in progress. Not a finished product.</p>
diff --git a/website/portal-release.json b/website/portal-release.json
index f425469..29bccbb 100644
--- a/website/portal-release.json
+++ b/website/portal-release.json
@@ -1,8 +1,20 @@
 {
   "builds": {
     "macos-arm64": {
-      "available": false,
-      "reason": "No public Portal release has been promoted yet. Portal is ad-hoc signed and GitHub-attested, never Apple-notarized."
+      "architecture": "arm64",
+      "asset": "Portal-0.1.1-arm64.dmg",
+      "available": true,
+      "checksum_asset": "Portal-0.1.1-arm64.dmg.sha256",
+      "checksum_url": "https://github.com/FelineStateMachine/goq/releases/download/v0.1.1/Portal-0.1.1-arm64.dmg.sha256",
+      "download_url": "https://github.com/FelineStateMachine/goq/releases/download/v0.1.1/Portal-0.1.1-arm64.dmg",
+      "manifest_asset": "Portal-0.1.1-arm64.json",
+      "manifest_url": "https://github.com/FelineStateMachine/goq/releases/download/v0.1.1/Portal-0.1.1-arm64.json",
+      "platform": "macos",
+      "release_tag": "v0.1.1",
+      "release_url": "https://github.com/FelineStateMachine/goq/releases/tag/v0.1.1",
+      "sha256": "d354f4dff9ed96eb7405afd3ac7c4f36507c888de595b6aabcffaa891436afb2",
+      "verification": "adhoc-signed+github-attested+sha256",
+      "version": "0.1.1"
     }
   },
   "format": 1,