git-cliff: the changelog that writes itself (almost)

107 commits. Impeccable conventional commits from day one. Feat, fix, refactor, chore — everything perfectly labeled. And the CHANGELOG? Empty. Non-existent. A file that “I’ll write tomorrow” for two months straight. If this sounds familiar, you’re not alone. Writing a changelog by hand is an Olympic-level pain in the ass. It’s not that it’s difficult — it’s just tedious, repetitive, and there’s always something more urgent to do. And that’s exactly why git-cliff exists. ...

February 22, 2026 · Fernando

macOS Notarization: the nightclub bouncer Apple put on your app

It’s 2 AM. Your app compiles. You sign it. You package it in a DMG. You run notarytool submit. Apple says “In Progress”. You wait 5 minutes. 10. 20. An hour. Two hours. The submission is still “In Progress”. You go to bed. The next morning: Invalid. With no more explanation than “The signature of the binary is invalid”. For both architectures. Thanks, Apple. Very helpful. Notarization is one of those processes that works perfectly… until it doesn’t. And when it fails, it leaves you with a .dmg that Gatekeeper won’t let open and an error that tells you nothing. After fighting with this for a couple of days with Tokamak (my menu bar app for monitoring Claude quota), I decided to document everything I learned and write a linter so I never have to go through this again. ...

February 22, 2026 · Fernando

macOS Virtual Machines in a Single Command

I’m building a menu bar app for macOS. It works perfectly on my Mac. Now I need to know if it works on a clean macOS: without my settings, without my permissions, without my data. A user installing it from scratch. How do you test that? You need a virtual machine. “Easy,” I thought. “I have UTM installed. I’ll open the wizard, create a macOS VM, and we’re good to go.” ...

February 21, 2026 · Fernando

When security asks for permission so often you stop reading

Knock, knock. Who’s there? Touch ID. Again. Picture this: you’re working in your terminal, pulling secrets from 1Password with op read. You need the Linear API key. Touch ID. The OpenRouter one. Touch ID. The Gitea one. Touch ID. In half an hour it asked for my finger fourteen times. You know what happens when a security tool interrupts you fourteen times in thirty minutes? By the fifth time you’re not reading what it’s asking for. You put your finger down like a reflex. “Yeah, whatever, let me work.” ...

February 12, 2026 · Fernando