Answer product-owner round 1: 0 🔴, 1 🟡; check the apk repository on Alpine 3.24's apk-tools 3, and say how macOS runs a downloaded binary

README.md

@@ -64,6 +64,8 @@ apk add fejkdata
 
 Each [release](https://github.com/larvit/fejkdata/releases) also carries the binaries for
 Linux, macOS and Windows on amd64 and arm64, and the `.deb`, `.rpm` and `.apk` packages.
+The binaries are not signed, so macOS refuses one a browser downloaded until
+`xattr -d com.apple.quarantine fejkdata` clears its quarantine flag.
 
 ## CLI
 

release-tooling/package-repos.Dockerfile

@@ -55,7 +55,7 @@ RUN --mount=type=secret,id=gpg,required=true --mount=type=tmpfs,target=/root/.gn
 	&& printf '[fejkdata]\nname=fejkdata\nbaseurl=%s/rpm\nrepo_gpgcheck=1\ngpgcheck=0\ngpgkey=%s/fejkdata.asc\n' \
 		"$BASE_URL" "$BASE_URL" > fejkdata.repo
 
-FROM alpine:3.22.2 AS apk
+FROM alpine:3.24.2 AS apk
 RUN apk add --no-cache abuild openssl
 COPY --from=packages *.apk /packages/
 RUN --mount=type=secret,id=rsa,required=true,target=/keys/fejkdata.rsa \
@@ -92,7 +92,7 @@ RUN sed -e 's#^baseurl=.*#baseurl=file:///site/rpm#' -e 's#^gpgkey=.*#gpgkey=fil
 	&& fejkdata --version > /checked \
 	&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
 
-FROM alpine:3.22.2 AS check-apk
+FROM alpine:3.24.2 AS check-apk
 ARG EXPECTED_VERSION
 COPY --from=site / /site
 RUN cp /site/apk/fejkdata.rsa.pub /etc/apk/keys/ \