Add notarization to release pipeline; sign with hardened runtime

release.sh now submits the zip to Apple's notary via notarytool, staples
the ticket, and repackages, so users no longer hit Gatekeeper warnings.
build-app.sh signs Developer ID builds with the hardened runtime and
unlocks the login keychain to avoid transient signing errors. The private
API key (.p8) is gitignored.

💘 Generated with Crush

Assisted-by: Crush:deepseek-v4-flash-0731

This commit is contained in:

TZGyn

2026-08-12 11:31:14 +08:00

parent af15f9a865

commit 234a4226c5

3 changed files with 79 additions and 5 deletions

.gitignore

View File

@@ -5,6 +5,9 @@
 # App bundle (build artifact, regenerate with ./build-app.sh)
 Kapture.app/
 # Secrets
 *.p8
 # macOS
 .DS_Store