From 30d5aff906d9103d3e494eac053da1fadb0c799a Mon Sep 17 00:00:00 2001
From: TZGyn <spectator_brethren761@slmails.com>
Date: Mon, 28 Sep 2026 12:19:39 +0800
Subject: [PATCH] Notarize releases so macOS opens the app without a warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gatekeeper blocked the app on other machines because it was signed but
not notarized. Sign with a secure timestamp and submit to Apple during
release, so a stapled ticket ships in the zip.

💘 Generated with Crush

Assisted-by: Crush:deepseek-v4.1-flash
---
 AGENTS.md    | 7 +++++++
 README.md    | 3 ++-
 build-app.sh | 4 ++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index ad57dc3..7de4298 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -103,6 +103,13 @@ wants it in the final answer every time. Keep it to the cask upgrade commands
 (see the README release section for the exact block), because the app is
 installed through the tap.
 
+Notarization: `release.sh` submits to Apple when the `SIMPLETOPBAR_NOTARY_*`
+env vars are set (provider, `.p8` path, key id, issuer id). The credentials are
+the same App Store Connect key used by Kapture (`~/.config/kapture/AuthKey_*.p8`,
+team `RX6767S6BW`); the issuer id is a non-secret UUID from App Store Connect.
+Verify with `spctl -a -vv SimpleTopBar.app` → `source=Notarized Developer ID`.
+Without the vars it still builds, zips and prints the sha, just unnotarized.
+
 ## Status item placement (why not MenuBarExtra)
 
 On a full menu bar, a newly created status item is placed leftmost, which on a
diff --git a/README.md b/README.md
index bbf283c..c19dfd6 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,8 @@ brew install --cask simpletopbar
 ```
 
 The tap is hosted on Gitea, so the full URL is required. Homebrew may print an
-"Unsupported tap" warning — it's harmless.
+"Unsupported tap" warning — it's harmless. Releases from 0.4.8 on are notarized,
+so the app opens without a Gatekeeper warning.
 
 ## Upgrade
 
diff --git a/build-app.sh b/build-app.sh
index 3bfeb76..78fcea1 100755
--- a/build-app.sh
+++ b/build-app.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-VERSION="${1:-0.4.7}"
+VERSION="${1:-0.4.8}"
 
 swift build -c release
 
@@ -58,7 +58,7 @@ chmod +x scripts/make-icon.sh
 
 if [ -n "$IDENT" ]; then
     security unlock-keychain "$HOME/Library/Keychains/login.keychain-db" 2>/dev/null || true
-    codesign --force --options runtime --sign "$IDENT" "$APP"
+    codesign --force --options runtime --timestamp --sign "$IDENT" "$APP"
     echo "Built $APP ${VERSION} (signed with Developer ID '$IDENT') — open $APP"
 else
     codesign --force --sign - "$APP"