mkpk v0.4.2

macOS-client–focused release. The Go CLI / provisioner is functionally unchanged from v0.4.1 (rebuilt under this tag).

Highlights

• macOS client is now Developer ID signed + notarized — a downloaded DMG/app no longer trips Gatekeeper quarantine (no xattr -cr needed).
• External-IP re-check — the client re-resolves your public (egress) IP on network changes (Wi-Fi ↔ cellular / reconnect), periodically while a port is open, and via a manual refresh button. If a service is open for an address that no longer matches, it flags it (menu-bar attention + in-app warning + a notification) so you know to re-knock. Closes the silent "port is open, but for my old IP" trap after a reconnect.

Fixed

• macOS client .app is now codesignable (brand icons flattened into Contents/Resources, loaded via Bundle.main).

Notes

• iCloud Keychain sync of invites stays off pending a Developer ID provisioning profile; the Settings toggle falls back to the local file store.

Assets

• CLI — mkpk and mkpk-provision for linux / darwin / windows × amd64 / arm64 (.zip; the binary keeps its executable bit).
• macOS client — mkpk-client_v0.4.2_darwin_arm64.dmg (signed + notarized, drag-to-Applications).

See the CHANGELOG for details.