Shrink release DMG 102MB -> 61MB: strip binaries, LZMA DMG, dead-code stripping

.github/workflows/nightly.yml

@@ -275,6 +275,12 @@ jobs:
           install -m 755 /tmp/cmux-ghostty-helper-universal "$DEST"
           echo "Injected Ghostty CLI helper architectures: $(lipo -archs "$DEST")"
 
+      - name: Strip app binaries
+        if: needs.decide.outputs.should_publish != 'true' || steps.current_head_prebuild.outputs.still_current == 'true'
+        run: |
+          set -euo pipefail
+          ./scripts/strip-app-binaries.sh "build-universal/Build/Products/Release/cmux.app"
+
       - name: Run bundled Ghostty theme picker helper regression
         if: needs.decide.outputs.should_publish != 'true' || steps.current_head_prebuild.outputs.still_current == 'true'
         run: |
@@ -573,6 +579,7 @@ jobs:
             fi
             mv "$created_dmg" "$dmg_release"
             rm -rf "$dmg_tmp_dir"
+            ./scripts/convert-dmg-ulmo.sh "$dmg_release"
             /usr/bin/codesign --force --timestamp --keychain build.keychain \
               --sign "$APPLE_SIGNING_IDENTITY" \
               "$dmg_release"

.github/workflows/release.yml

@@ -278,6 +278,12 @@ jobs:
             ghostty-cli-helper/ghostty \
             build-universal/Build/Products/Release/cmux.app
 
+      - name: Strip app binaries
+        if: steps.guard_release_assets.outputs.skip_all != 'true'
+        run: |
+          set -euo pipefail
+          ./scripts/strip-app-binaries.sh build-universal/Build/Products/Release/cmux.app
+
       - name: Verify binary architectures
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         run: |
@@ -452,6 +458,7 @@ jobs:
             "$APP_PATH" \
             ./
           mv ./cmux*.dmg "$DMG_RELEASE"
+          ./scripts/convert-dmg-ulmo.sh "$DMG_RELEASE"
           /usr/bin/codesign --force --timestamp --keychain build.keychain \
             --sign "$APPLE_SIGNING_IDENTITY" \
             "$DMG_RELEASE"

cmux.xcodeproj/project.pbxproj

@@ -5829,6 +5829,7 @@
 				CLANG_ENABLE_MODULES = YES;
 				CLANG_ENABLE_OBJC_ARC = YES;
 				COPY_PHASE_STRIP = NO;
+				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
@@ -5863,6 +5864,7 @@
 				CLANG_ENABLE_MODULES = YES;
 				CLANG_ENABLE_OBJC_ARC = YES;
 				COPY_PHASE_STRIP = NO;
+				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;

scripts/build-sign-upload.sh

@@ -52,6 +52,7 @@ APP_PATH="build/Build/Products/Release/cmux.app"
 GHOSTTYKIT_CRASH_REPORT_SUBDIR="cmux/crash"
 
 # --- Pre-flight ---
+# shellcheck source=/dev/null
 source ~/.secrets/cmuxterm.env
 export SPARKLE_PRIVATE_KEY
 for tool in zig xcodebuild create-dmg xcrun codesign ditto gh; do
@@ -94,6 +95,10 @@ echo "Sparkle keys injected"
 # installer handoff wait for an agent connection that never arrives.
 ./scripts/remove-sparkle-sandbox-xpc-services.sh "$APP_PATH"
 
+# --- Strip app binaries ---
+echo "Stripping app binaries..."
+./scripts/strip-app-binaries.sh "$APP_PATH"
+
 # --- Codesign ---
 echo "Codesigning..."
 ./scripts/sign-cmux-bundle.sh "$APP_PATH" "$ENTITLEMENTS" "$SIGN_HASH"
@@ -112,7 +117,14 @@ echo "App notarized"
 # --- Create and notarize DMG ---
 echo "Creating DMG..."
 rm -f cmux-macos.dmg
-create-dmg --codesign "$SIGN_HASH" cmux-macos.dmg "$APP_PATH"
+# No --codesign here: the ULMO conversion below invalidates the DMG signature,
+# so the DMG is signed once, after conversion. This is the Homebrew
+# (create-dmg/create-dmg) tool: signing is opt-in via --codesign and it has no
+# --no-code-sign flag. The npm create-dmg used by the CI workflows is a
+# different tool that signs by default and needs the explicit --no-code-sign.
+create-dmg cmux-macos.dmg "$APP_PATH"
+./scripts/convert-dmg-ulmo.sh cmux-macos.dmg
+codesign --force --timestamp --sign "$SIGN_HASH" cmux-macos.dmg
 echo "Notarizing DMG..."
 xcrun notarytool submit cmux-macos.dmg \
   --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" --wait

scripts/convert-dmg-ulmo.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Re-compress a DMG in place with ULMO (LZMA). Invalidates any existing DMG
+# signature, so callers must codesign the DMG after this script returns.
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 /path/to/image.dmg" >&2
+  exit 1
+fi
+
+DMG_PATH="$1"
+
+if [ ! -f "$DMG_PATH" ]; then
+  echo "DMG not found: $DMG_PATH" >&2
+  exit 1
+fi
+
+TMP_PATH="${DMG_PATH%.dmg}-ulmo.dmg"
+rm -f "$TMP_PATH"
+hdiutil convert "$DMG_PATH" -format ULMO -o "$TMP_PATH"
+mv "$TMP_PATH" "$DMG_PATH"
+ls -la "$DMG_PATH"

scripts/strip-app-binaries.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 /path/to/cmux.app" >&2
+  exit 1
+fi
+
+APP_PATH="$1"
+
+if [ ! -d "$APP_PATH" ]; then
+  echo "App bundle not found: $APP_PATH" >&2
+  exit 1
+fi
+
+strip_binary() {
+  local rel_path="$1"
+  shift
+  local binary_path="$APP_PATH/$rel_path"
+  local before_size
+  local after_size
+
+  if [ ! -f "$binary_path" ]; then
+    echo "Expected binary not found: $binary_path" >&2
+    exit 1
+  fi
+
+  before_size="$(stat -f %z "$binary_path")"
+  echo "Stripping $rel_path"
+  echo "  before: $before_size bytes"
+  /usr/bin/strip "$@" "$binary_path"
+  after_size="$(stat -f %z "$binary_path")"
+  echo "  after:  $after_size bytes"
+}
+
+strip_binary "Contents/MacOS/cmux" -rSTx
+strip_binary "Contents/Resources/bin/cmux" -rSTx
+strip_binary "Contents/Frameworks/libcmux_command_palette_nucleo_ffi.dylib" -x
+strip_binary "Contents/PlugIns/CmuxDockTilePlugin.plugin/Contents/MacOS/CmuxDockTilePlugin" -x