The v0.1.0 .dmgs are unsigned, so every first launch is blocked by Gatekeeper and users must right-click → Open (documented in the README and User Guide, but it's real friction — and it looks untrustworthy).
Work
- Enroll in the Apple Developer Program ($99/year) — prerequisite for everything below.
- Create a Developer ID Application certificate; export as
.p12.
- Add secrets to the repo and wire them into
.github/workflows/release.yml — tauri-action supports this natively:
APPLE_CERTIFICATE / APPLE_CERTIFICATE_PASSWORD (signing)APPLE_ID / APPLE_PASSWORD (app-specific) / APPLE_TEAM_ID (notarization)
- Tauri handles signing + notarization + stapling during
tauri build when those env vars are present — no workflow restructuring expected.
- Remove the Gatekeeper workaround sections from
README.md and docs/USER_GUIDE.md once verified.
Acceptance
A fresh download of the release .dmg opens on a clean macOS machine with no Gatekeeper bypass.
Blocked on: Apple Developer enrollment (maintainer action).
The v0.1.0
.dmgs are unsigned, so every first launch is blocked by Gatekeeper and users must right-click → Open (documented in the README and User Guide, but it's real friction — and it looks untrustworthy).Work
.p12..github/workflows/release.yml— tauri-action supports this natively:APPLE_CERTIFICATE/APPLE_CERTIFICATE_PASSWORD(signing)APPLE_ID/APPLE_PASSWORD(app-specific) /APPLE_TEAM_ID(notarization)tauri buildwhen those env vars are present — no workflow restructuring expected.README.mdanddocs/USER_GUIDE.mdonce verified.Acceptance
A fresh download of the release
.dmgopens on a clean macOS machine with no Gatekeeper bypass.Blocked on: Apple Developer enrollment (maintainer action).