# Create a signed, notarized KJMix Pro DMG

Run these commands from the project folder in Terminal. Do not paste account passwords, private keys or app-specific passwords into chat or source files.

## One-time setup

Install a **Developer ID Application** certificate and its private key in your login Keychain. Apple Development certificates are for development, not this distribution workflow. View available signing identities with:

```sh
security find-identity -v -p codesigning
```

Save notarization credentials interactively:

```sh
./scripts/setup-notarization.sh
```

The helper runs `xcrun notarytool store-credentials KJMixPro`. Apple prompts for the developer Apple ID, team ID and an app-specific password, then validates and saves the credentials in Keychain. `notarytool` alone may not be on PATH: use `xcrun notarytool`, or the helper.

If you already have a profile with a different name, use that name through `KJMIX_NOTARY_PROFILE`. The profile name is a label you chose when saving the credentials; “Keychain” is not automatically a profile name.

## Verified release

```sh
./scripts/release.sh
```

The script builds Release, stages a copy, signs the app with Developer ID and hardened runtime, submits it to Apple, checks Accepted status, staples/validates its ticket, and checks app Gatekeeper assessment. It then creates the compressed DMG with the colourful app/volume/file icon and Applications shortcut, signs and notarizes the DMG, staples/validates its ticket, checks its Gatekeeper assessment and mounts the finished image to recheck the enclosed app. A fresh-Mac launch/install check is still recommended before public distribution.

Outputs are versioned, for example:

- `dist/KJMixPro-0.6.4-macOS.dmg`
- `dist/KJMixPro-0.6.4-macOS.zip` (stapled app)
- SHA-256 sidecars and `dist/KJMixPro-0.6.4-macOS-verification/` reports

The script publishes these files only after the checks succeed. A failed run returns nonzero and never labels that attempt Gatekeeper verified. Existing files from earlier builds can remain in dist; check the current report and successful script completion.

You can configure another saved profile or signing identity without editing the script:

```sh
KJMIX_NOTARY_PROFILE='your-profile' ./scripts/release.sh
KJMIX_SIGNING_IDENTITY='certificate SHA-1' ./scripts/release.sh
```

The script auto-selects a Developer ID identity if all available matching certificates share the same name; otherwise it asks for an explicit identity. It forwards remaining arguments to xcodebuild. Signing/notarization require network access and may take several minutes; reports retain the submission IDs if Apple processing times out.

## Explicit local previews

```sh
./scripts/release.sh --signed-only
./scripts/release.sh --unsigned
```

These modes have clearly marked filenames and status reports. **They are not notarized or Gatekeeper verified.** Signed-only does not need notarization credentials. Unsigned creates the compatibility ZIP as well. Neither mode changes Gatekeeper settings or bypasses macOS security.

References: [Apple notarization](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution), [packaging for distribution](https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution).