release-mac-app

No strong, direct evidence of malicious behavior (e.g., hardcoded secrets exfiltration, reverse shells, crypto-mining, or obvious backdoor/persistence) is present in this fragment. The main supply-chain security concerns are high-risk primitives: (1) `source` of a manifest file which could be a direct code execution vector if an attacker can alter that manifest/path, and (2) `eval` usage for building shell variables. Additionally, the script downloads untrusted enclosure zips from URLs obtained from appcast metadata and extracts them before signature/codesign checks; signature verification and codesign validation are performed, reducing the likelihood of sabotage via tampered artifacts. This should be reviewed in context (how the manifest and environment values are controlled) to rule out attacker-controlled inputs reaching `source`/`eval`.