Sail Manifest checks the Mac release your green build missed

Field notes

The verifier takes a release artifact such as a DMG and can compare it with an appcast, dSYM archive, and previous build number. Its checks extend from code signing and Gatekeeper assessment to Sparkle enclosure bytes, embedded frameworks, XPC services, architectures, minimum system version, and credential-shaped files in the bundle. The page says disk images are mounted read-only and unmounted on exit, and that the command returns exit code 1 when a check fails.