v1.4.2 — Signed and notarized: no more Gatekeeper warning

No more Gatekeeper warning, and no Node.js to install. Downloads are now signed with an Apple Developer ID certificate and notarized by Apple: double-click and it opens.

What changed

Previous releases were ad-hoc signed, so macOS blocked the first launch. The workaround the docs gave — right-click → Open — stopped working in macOS 15; there was no path left except System Settings → Privacy & Security → Open Anyway. That's fixed.

Three things it took:

• Sign inside-out instead of codesign --deep, which is deprecated and can't apply per-binary entitlements.
• New app/entitlements-node.plist. The hardened runtime that notarization requires blocks V8 from allocating executable memory, so without allow-jit and allow-unsigned-executable-memory the bundled Node aborts on launch.
• Sign the DMG itself. Stapling a notarization ticket onto an unsigned disk image isn't enough — Gatekeeper still reads it as no usable signature.

The .app is notarized and stapled before it goes into the DMG, so it stays valid when dragged out of the DMG or launched with no network.

Upgrading from 1.4.1

Grant Full Disk Access to Mac Cleaner again after replacing the app. macOS ties that permission to the code signature, and the signature changed from ad-hoc to Developer ID. This is a one-time step — future updates keep the same identity, so the grant sticks from now on.

Verify it yourself

spctl -a -vvv "/Applications/Mac Cleaner.app"
# accepted
# source=Notarized Developer ID
# origin=Developer ID Application: Eslam Faisal (CDRX96YDNZ)

Downloads

File	For
Mac.Cleaner.dmg	Universal — Apple Silicon and Intel
Mac.Cleaner-AppleSilicon.dmg	Apple Silicon only (smaller)
Mac.Cleaner-Intel.dmg	Intel only (smaller)

No behaviour changes to scanning or deletion in this release.