Release DiskMount 0.2.4 with bilingual install guidance

Author: samni728

CHANGELOG.md

@@ -1,13 +1,15 @@
 # Changelog
 
-## Unreleased
+## 0.2.4 - 2026-08-03
 
 - Added sleep/wake recovery that pauses automatic disk actions until external storage has stabilized.
 - Detects active anylinuxfs mounts by their exact device-backed NFS source instead of guessing from a volume name.
 - Prevents a surviving NTFS read/write mount from being mistaken for a newly inserted read-only disk after wake.
 - Removes only the duplicate macOS read-only NTFS mount when the same device already has an active anylinuxfs read/write mount.
 - Avoids starting a second anylinuxfs process or requesting administrator authorization when the remembered read/write mount is still active.
 - Prevents failure recovery from creating a normal read-only duplicate while an anylinuxfs NFS mount still owns the device.
+- Added bilingual Gatekeeper, third-party app installation, Full Disk Access, Removable Volumes, and administrator authorization instructions.
+- Clarified that the current package is development-signed but not Apple-notarized, so another Mac may require the per-app “Open Anyway” flow.
 
 ## 0.2.3 - 2026-08-03
 

DiskMount/DiskMount.xcodeproj/project.pbxproj

@@ -312,7 +312,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development: samni728@gmail.com (4BVG532TG3)";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 8;
+				CURRENT_PROJECT_VERSION = 9;
 				DEVELOPMENT_TEAM = YU9NH29226;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -322,7 +322,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 0.2.3;
+				MARKETING_VERSION = 0.2.4;
 				PRODUCT_BUNDLE_IDENTIFIER = com.samni.DiskMount;
 				PRODUCT_NAME = DiskMount;
 				SDKROOT = macosx;
@@ -401,7 +401,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development: samni728@gmail.com (4BVG532TG3)";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 8;
+				CURRENT_PROJECT_VERSION = 9;
 				DEVELOPMENT_TEAM = YU9NH29226;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -411,7 +411,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 0.2.3;
+				MARKETING_VERSION = 0.2.4;
 				PRODUCT_BUNDLE_IDENTIFIER = com.samni.DiskMount;
 				PRODUCT_NAME = DiskMount;
 				SDKROOT = macosx;

DiskMount/Resources/index.html

@@ -14,7 +14,7 @@
         <img class="brand-icon" src="logo.png" alt="">
         <div>
           <div class="eyebrow" data-i18n="eyebrow">DISK CONTROL</div>
-          <h1>DiskMount <span id="version">0.2.3</span></h1>
+          <h1>DiskMount <span id="version">0.2.4</span></h1>
         </div>
       </div>
       <div class="toolbar">

DiskMount/Web/WebPanelController.swift

@@ -486,7 +486,7 @@ final class WebPanelController: NSViewController, WKScriptMessageHandler {
 
     private func publish() {
         let state = PanelState(
-            version: Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.2.3",
+            version: Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.2.4",
             devices: devices,
             dependency: anyLinuxFS.dependencyState(),
             proMode: proMode,

DiskMount/project.yml

@@ -24,8 +24,8 @@ targets:
         PRODUCT_BUNDLE_IDENTIFIER: com.samni.DiskMount
         PRODUCT_NAME: DiskMount
         ARCHS: arm64
-        MARKETING_VERSION: 0.2.3
-        CURRENT_PROJECT_VERSION: 8
+        MARKETING_VERSION: 0.2.4
+        CURRENT_PROJECT_VERSION: 9
         INFOPLIST_FILE: Info.plist
         GENERATE_INFOPLIST_FILE: NO
         CODE_SIGN_STYLE: Manual

DiskMount/scripts/build_dmg.sh

@@ -48,4 +48,10 @@ hdiutil create \
   -format UDZO \
   "$DMG_PATH"
 
+# Sign the disk image as well as the embedded app so recipients can verify that the
+# package was not modified after it was built. An Apple Development identity is still
+# not a substitute for Developer ID distribution signing and Apple notarization.
+codesign --force --timestamp=none --sign "$SIGN_IDENTITY" "$DMG_PATH"
+codesign --verify --verbose=2 "$DMG_PATH"
+
 echo "DMG 已生成：$DMG_PATH"

INSTALLATION.md

@@ -0,0 +1,51 @@
+# DiskMount installation and permissions
+
+[简体中文](INSTALLATION.zh-CN.md)
+
+## Before you install
+
+Download DiskMount only from the official [GitHub Releases page](https://github.com/samni728/diskmount/releases). Version 0.2.4 is self-contained and does not require Homebrew, Xcode, or a separate anylinuxfs installation.
+
+The current package is signed with the developer's Apple Development certificate, but it is not signed with a Developer ID Application certificate and is not Apple-notarized. A Mac that downloads the DMG from the internet may therefore block the first launch. This Gatekeeper approval is separate from the disk permissions requested after DiskMount starts.
+
+## Normal installation
+
+1. Download `DiskMount-0.2.4-macOS26.dmg` and its `.sha256` file.
+2. Optionally verify the download in Terminal:
+
+   ```bash
+   cd ~/Downloads
+   shasum -a 256 -c DiskMount-0.2.4-macOS26.dmg.sha256
+   ```
+
+3. Open the DMG and drag `DiskMount.app` to `Applications`.
+4. Open DiskMount from `Applications`. Its controls remain in the macOS menu bar.
+
+## If macOS blocks the app
+
+Do not disable Gatekeeper globally. Use the per-app exception provided by macOS:
+
+1. Try to open DiskMount once and close the warning.
+2. Open **System Settings → Privacy & Security**.
+3. Scroll to **Security** and find the message that DiskMount was blocked.
+4. Click **Open Anyway**. macOS normally shows this button for about one hour after the blocked launch.
+5. Authenticate with the Mac login password, review the warning, and choose **Open**.
+
+macOS then remembers DiskMount as an exception on that Mac. On organization-managed Macs, an administrator or MDM policy may still prevent this override. See Apple's [Open apps safely on your Mac](https://support.apple.com/en-ie/102445) guidance.
+
+Avoid instructions that permanently disable Gatekeeper or indiscriminately remove quarantine attributes. Download a new copy from the official release if the checksum fails or macOS says the app is damaged.
+
+## Permissions after launch
+
+The following approvals serve different purposes:
+
+1. **Administrator authorization:** NTFS read/write mounting and failure recovery need elevated access. The password is passed transiently to macOS `sudo`; DiskMount does not store, log, or upload it.
+2. **Full Disk Access:** enable **System Settings → Privacy & Security → Full Disk Access → DiskMount**.
+3. **Removable Volumes:** when macOS shows this switch, enable **System Settings → Privacy & Security → Files & Folders → DiskMount → Removable Volumes**.
+4. Fully quit and reopen DiskMount after changing either privacy permission.
+
+DiskMount does not format, erase, repartition, or convert disks. NTFS read/write changes only the active mount method.
+
+## Commercial distribution status
+
+Version 0.2.4 is a development-signed community release. Warning-free public distribution requires a Developer ID Application certificate, hardened-runtime signing of the app and all bundled helpers, Apple notarization, and a stapled notarization ticket.

INSTALLATION.zh-CN.md

@@ -0,0 +1,51 @@
+# DiskMount 安装与授权说明
+
+[English](INSTALLATION.md)
+
+## 安装前须知
+
+请仅从项目的 [GitHub Releases 页面](https://github.com/samni728/diskmount/releases)下载 DiskMount。0.2.4 是自包含版本，不需要用户安装 Homebrew、Xcode 或独立的 anylinuxfs。
+
+当前安装包使用开发者本人的 Apple Development 证书签名，但尚未使用 Developer ID Application 证书，也没有通过 Apple 公证。从互联网下载 DMG 后，其他 Mac 可能会在第一次启动时进行拦截。这个 Gatekeeper 安装放行与 App 启动后的磁盘权限是两套相互独立的授权。
+
+## 正常安装流程
+
+1. 下载 `DiskMount-0.2.4-macOS26.dmg` 和对应的 `.sha256` 文件。
+2. 可以在终端验证下载完整性：
+
+   ```bash
+   cd ~/Downloads
+   shasum -a 256 -c DiskMount-0.2.4-macOS26.dmg.sha256
+   ```
+
+3. 打开 DMG，把 `DiskMount.app` 拖入“应用程序”。
+4. 从“应用程序”打开 DiskMount；运行后，主要操作入口常驻在 macOS 顶部菜单栏。
+
+## 如果 macOS 阻止打开
+
+不建议永久关闭 Gatekeeper。请使用 macOS 提供的单 App 放行流程：
+
+1. 先尝试打开一次 DiskMount，然后关闭系统警告。
+2. 打开 **系统设置 → 隐私与安全性**。
+3. 滚动到 **安全性**，找到 DiskMount 被阻止的提示。
+4. 点击 **仍要打开**。通常该按钮会在被阻止启动后保留约一小时。
+5. 输入当前 Mac 的登录密码，阅读提示后点击 **打开**。
+
+完成后，macOS 会把 DiskMount 记录为这台 Mac 上的单独例外。如果设备受公司 IT 或 MDM 管理，管理员策略仍可能禁止用户自行放行。可参考 Apple 官方的[安全地打开 Mac App](https://support.apple.com/en-ie/102445)说明。
+
+不要使用永久关闭 Gatekeeper 或无差别移除所有 quarantine 属性的安装教程。如果 SHA-256 校验失败，或 macOS 提示 App 已损坏，请删除该文件并从官方 Release 重新下载。
+
+## App 启动后的权限
+
+以下权限的用途不同，需要分别处理：
+
+1. **管理员授权：** NTFS 读写挂载和失败恢复需要更高权限。密码只会短暂交给 macOS `sudo`，DiskMount 不会保存、记录或上传密码。
+2. **完全磁盘访问权限：** 前往 **系统设置 → 隐私与安全性 → 完全磁盘访问权限 → DiskMount** 开启。
+3. **可移动卷权限：** 如果系统显示该选项，前往 **系统设置 → 隐私与安全性 → 文件与文件夹 → DiskMount → 可移动卷** 开启。
+4. 修改上述任一隐私权限后，请完全退出并重新打开 DiskMount。
+
+DiskMount 不会格式化、抹掉、重新分区或转换磁盘格式。NTFS 读写只会改变当前挂载方式。
+
+## 商业分发状态
+
+0.2.4 仍属于开发签名的社区版本。要实现面向普通用户、无未知开发者拦截的公开分发，还需要 Developer ID Application 证书、对 App 和所有内嵌程序进行 Hardened Runtime 签名、提交 Apple 公证并装订公证票据。

README.md

@@ -17,7 +17,7 @@
 
 # DiskMount
 
-Current version: **0.2.3**
+Current version: **0.2.4**
 
 DiskMount detects USB drives and external disks, displays them in a compact menu bar panel, and provides mount, unmount, Finder, and safe-eject actions. NTFS volumes can be remounted with read/write access through the bundled `anylinuxfs` runtime without changing their file-system format.
 
@@ -102,20 +102,30 @@ Expert Mode confirmation is an additional in-app safety check. It does not repla
 - administrator approval when a mount operation requires elevated access;
 - user approval for removable-volume access on first NTFS raw-disk access.
 
-Intel/x86 Macs are not supported in 0.2.3 because the upstream `anylinuxfs/libkrun` runtime currently targets Apple Silicon.
+Intel/x86 Macs are not supported in 0.2.4 because the upstream `anylinuxfs/libkrun` runtime currently targets Apple Silicon.
 
 ## Installation
 
-1. Download `DiskMount-0.2.3-macOS26.dmg` from [Releases](https://github.com/samni728/diskmount/releases);
+1. Download `DiskMount-0.2.4-macOS26.dmg` from [Releases](https://github.com/samni728/diskmount/releases);
 2. open the DMG and drag `DiskMount.app` to `Applications`;
 3. launch DiskMount from Applications;
 4. use the menu bar item after the initial panel appears.
 
+### Gatekeeper and third-party app warning
+
+The 0.2.4 package is signed with the developer's Apple Development certificate but is not Apple-notarized. A different Mac may block the first launch after downloading the DMG from the internet.
+
+If macOS blocks DiskMount, try to open it once, then go to **System Settings → Privacy & Security → Security → Open Anyway**, authenticate, and confirm **Open**. Use this per-app exception; do not permanently disable Gatekeeper. Organization-managed Macs may require approval from an IT administrator.
+
+See the complete [English installation and permissions guide](INSTALLATION.md) or [Simplified Chinese guide](INSTALLATION.zh-CN.md). Apple also documents this flow in [Open apps safely on your Mac](https://support.apple.com/en-ie/102445).
+
+### Permissions after launch
+
 The first NTFS read/write mount may require an administrator password, Full Disk Access, and Removable Volumes access. These approvals are independent. DiskMount explains why each permission is needed and does not persist the administrator password.
 
 The DMG bundles the ARM64 `anylinuxfs` executable, Linux kernel, VM helpers, modules, and `libblkid`. End users do not need Homebrew, Xcode, XcodeGen, or a separately installed anylinuxfs package.
 
-The current release uses an Apple Development certificate for project testing. Warning-free public distribution still requires a Developer ID Application certificate, Apple notarization, and stapling.
+The current release uses an Apple Development certificate for project testing. Warning-free public distribution still requires a Developer ID Application certificate, Apple notarization, and stapling. The Gatekeeper exception above does not grant disk access; macOS privacy permissions must still be enabled separately.
 
 ## Build and test
 
@@ -145,9 +155,9 @@ Release sequence:
 
 ```bash
 # Update VERSION and release notes first
-git tag -a v0.2.3 -m "DiskMount 0.2.3"
+git tag -a v0.2.4 -m "DiskMount 0.2.4"
 git push origin main
-git push origin v0.2.3
+git push origin v0.2.4
 ```
 
 Automated packages are ad-hoc signed unless Developer ID signing and notarization secrets are configured. See [RELEASING.md](RELEASING.md) for the maintenance checklist.

README.zh-CN.md

@@ -17,7 +17,7 @@
 
 # DiskMount
 
-当前版本：**0.2.3**
+当前版本：**0.2.4**
 
 DiskMount 会识别 U 盘和移动硬盘，并在紧凑的菜单栏面板中提供加载、卸载、Finder 打开和安全弹出操作。NTFS 卷通过 App 内嵌的 `anylinuxfs` 运行时以读写方式重新加载，不会改变原有文件系统格式。
 
@@ -102,20 +102,30 @@ DiskMount 运行期间会维持 macOS 的 `sudo` 授权时间戳。这样，已
 - 挂载需要更高权限时，需通过 macOS 管理员授权；
 - 第一次进行 NTFS 原始磁盘访问时，需允许访问可移动卷。
 
-0.2.3 不支持 Intel/x86 Mac，因为上游 `anylinuxfs/libkrun` 运行时目前主要支持 Apple Silicon。
+0.2.4 不支持 Intel/x86 Mac，因为上游 `anylinuxfs/libkrun` 运行时目前主要支持 Apple Silicon。
 
 ## 安装
 
-1. 从 [Releases](https://github.com/samni728/diskmount/releases) 下载 `DiskMount-0.2.3-macOS26.dmg`；
+1. 从 [Releases](https://github.com/samni728/diskmount/releases) 下载 `DiskMount-0.2.4-macOS26.dmg`；
 2. 打开 DMG，将 `DiskMount.app` 拖入“应用程序”；
 3. 从“应用程序”启动 DiskMount；
 4. 首次显示面板后，App 会继续常驻顶部菜单栏。
 
+### Gatekeeper 与第三方 App 提示
+
+0.2.4 安装包使用开发者本人的 Apple Development 证书签名，但尚未通过 Apple 公证。其他 Mac 从互联网下载 DMG 后，第一次启动时可能会被系统阻止。
+
+如果 macOS 阻止 DiskMount，请先尝试打开一次，然后前往 **系统设置 → 隐私与安全性 → 安全性 → 仍要打开**，输入当前 Mac 的登录密码并确认 **打开**。请使用这种单 App 放行方式，不要永久关闭 Gatekeeper。公司或学校管理的 Mac 可能还需要 IT 管理员批准。
+
+完整流程请阅读[中文安装与授权指南](INSTALLATION.zh-CN.md)或[英文指南](INSTALLATION.md)。Apple 官方也提供了[安全地打开 Mac App](https://support.apple.com/en-ie/102445)说明。
+
+### App 启动后的磁盘权限
+
 第一次进行 NTFS 读写加载时，可能需要管理员密码、完全磁盘访问权限和可移动卷权限。这些授权相互独立。DiskMount 会说明每项权限的用途，并且不会持久化管理员密码。
 
 DMG 内嵌 ARM64 的 anylinuxfs、Linux kernel、VM helpers、modules 和 `libblkid`。最终用户不需要安装 Homebrew、Xcode、XcodeGen 或独立的 anylinuxfs。
 
-当前发布包使用 Apple Development 证书，适合项目测试。若需面向所有用户无警告公开分发，仍需要 Developer ID Application 证书、Apple 公证和 stapling。
+当前发布包使用 Apple Development 证书，适合项目测试。若需面向所有用户无警告公开分发，仍需要 Developer ID Application 证书、Apple 公证和 stapling。上面的 Gatekeeper 单 App 放行不会自动授予磁盘权限，用户仍需另行开启 macOS 隐私权限。
 
 ## 构建与测试
 
@@ -148,9 +158,9 @@ cd DiskMount
 
 ```bash
 # 先更新 VERSION 和更新说明
-git tag -a v0.2.3 -m "DiskMount 0.2.3"
+git tag -a v0.2.4 -m "DiskMount 0.2.4"
 git push origin main
-git push origin v0.2.3
+git push origin v0.2.4
 ```
 
 如未配置 Developer ID 签名和公证 Secrets，自动产物使用 ad-hoc 签名。详细维护清单见 [RELEASING.md](RELEASING.md)。