Distribute signed macOS `.dmg` package

[jcfr]

Please follow these instructions for your issue to be worked on:

Prerequisites

• Are you running the latest version of Cleaver2?
• Are you reporting to the correct repository?
• Did you perform a cursory search to see if your bug or enhancement is already reported?

For more information on how to write a good bug report or enhancement request, see the CONTRIBUTING guide. These links point to another project, but most of the advice holds in general.

Description

On recent macOS version (e.g macOS Monterey), running signed & notarized application is required by default.

This prevent from running the .dmg package currently available for distribution.
See https://github.com/SCIInstitute/Cleaver2/releases/tag/v2.4

Steps to Reproduce

1. Download Cleaver_2.4_osx.dmg
2. Extract and attempt to run

Expected behavior: Successful execution

Actual behavior: A warning dialog indicating the application is from an unidentified developer is reported.

Versions

Cleaver 2.4

[jcfr]

To help move forward with this, I suggest to:

• for signing, adapt the following signing script: https://github.com/jcfr/macos-codesign-scripts

• for notarizing:

  • You need to use an app-specific password:
    • Visit https://appleid.apple.com/account/manage to generate an app-specific password.
    • Enter the name altool-notarize (used below)
  • See https://github.com/akeru-inc/xcnotary
    brew install akeru-inc/tap/xcnotary
  • Running the following command will allow to do the notarization:
    xcnotary notarize /path/to/TheApp.app -d "$appleid" -k altool-notarize