Properly sign and notarize release builds

[tnagatomi]

Summary

Distribute Octoradar with proper code signing and notarization so users can launch it without manually bypassing Gatekeeper (macOS) or SmartScreen (Windows).

Current state

The macOS release job only applies an ad-hoc signature:

# .github/workflows/release.yml
codesign --deep --force -s - "$app"

This is the minimum required for the universal binary to launch on Apple Silicon, but the app is not notarized. As a result every user has to bypass Gatekeeper on first launch — the README currently documents the "Open Anyway" / xattr -dr com.apple.quarantine workaround. Windows builds are unsigned, and Linux packages are unsigned as well.

Goal

Ship signed (and where applicable notarized) artifacts so the documented Gatekeeper/SmartScreen workarounds are no longer needed for a normal install.

Tasks

macOS (priority)

• Sign the .app with a Developer ID Application certificate instead of an ad-hoc signature.
• Enable the hardened runtime and supply the required entitlements.
• Notarize the .dmg (or the app) via notarytool and staple the ticket.
• Store the signing certificate (.p12), its password, and the App Store Connect / notarization credentials as encrypted GitHub Actions secrets; import the cert into a temporary keychain during the release job.
• Verify the result: spctl -a -vv and codesign --verify --deep --strict pass on a clean machine.
• Remove the Gatekeeper-bypass instructions from the README once notarized builds ship.

Windows (optional / follow-up)

• Sign the executable / installer with an Authenticode certificate to avoid SmartScreen warnings.

Linux (optional / follow-up)

• Consider GPG-signing the .deb / .rpm packages and publishing the public key.

Notes / open questions

• Requires a paid Apple Developer Program membership ($99/yr) for the Developer ID certificate and notarization. Decide whether this cost is acceptable before starting.
• Windows Authenticode signing also requires a (paid) code-signing certificate.
• Keep all signing material in encrypted secrets — never commit certificates or credentials to the repo.