Notarize releases so macOS opens the app without a warning

Gatekeeper blocked the app on other machines because it was signed but
not notarized. Sign with a secure timestamp and submit to Apple during
release, so a stapled ticket ships in the zip.

💘 Generated with Crush

Assisted-by: Crush:deepseek-v4.1-flash

AGENTS.md

@@ -103,6 +103,13 @@ wants it in the final answer every time. Keep it to the cask upgrade commands
 (see the README release section for the exact block), because the app is
 installed through the tap.
 
+Notarization: `release.sh` submits to Apple when the `SIMPLETOPBAR_NOTARY_*`
+env vars are set (provider, `.p8` path, key id, issuer id). The credentials are
+the same App Store Connect key used by Kapture (`~/.config/kapture/AuthKey_*.p8`,
+team `RX6767S6BW`); the issuer id is a non-secret UUID from App Store Connect.
+Verify with `spctl -a -vv SimpleTopBar.app` → `source=Notarized Developer ID`.
+Without the vars it still builds, zips and prints the sha, just unnotarized.
+
 ## Status item placement (why not MenuBarExtra)
 
 On a full menu bar, a newly created status item is placed leftmost, which on a

README.md

@@ -55,7 +55,8 @@ brew install --cask simpletopbar
 ```
 
 The tap is hosted on Gitea, so the full URL is required. Homebrew may print an
-"Unsupported tap" warning — it's harmless.
+"Unsupported tap" warning — it's harmless. Releases from 0.4.8 on are notarized,
+so the app opens without a Gatekeeper warning.
 
 ## Upgrade
 

build-app.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-VERSION="${1:-0.4.7}"
+VERSION="${1:-0.4.8}"
 
 swift build -c release
 
@@ -58,7 +58,7 @@ chmod +x scripts/make-icon.sh
 
 if [ -n "$IDENT" ]; then
     security unlock-keychain "$HOME/Library/Keychains/login.keychain-db" 2>/dev/null || true
-    codesign --force --options runtime --sign "$IDENT" "$APP"
+    codesign --force --options runtime --timestamp --sign "$IDENT" "$APP"
     echo "Built $APP ${VERSION} (signed with Developer ID '$IDENT') — open $APP"
 else
     codesign --force --sign - "$APP"