Context
Split out from #1, which was closed as not applicable — that issue conflated two separate things: an actual export bug (fixed, was a PyInstaller dylib collision, see LIBLCMS2_DYLIB_COLLISION.md) and this one, which is real but unrelated.
The actual remaining thing
.github/workflows/release.yml has no codesign/notarize step — the app ships ad-hoc signed only. That's fine for dlopen/AMFI purposes (confirmed not the cause of any bug found so far), but it's a distinct, real UX cost: anyone who downloads the .dmg from GitHub Releases gets it quarantined by Gatekeeper, and macOS shows the "cannot be opened because the developer cannot be verified" warning on first launch, requiring a right-click-Open (or xattr -d com.apple.quarantine) workaround.
Options
- Notarize the release build: Developer ID Application certificate (paid Apple Developer Program membership, $99/year) +
notarytool submit --wait + stapler staple, wired into release.yml. Removes the warning entirely.
- Document the workaround: add a note to the README/release notes telling users to right-click → Open (or run
xattr -cr) on first launch. Free, but a worse first-run experience.
This is a product/UX call (is the $99/year and CI complexity worth it for a better first-run experience), not an engineering question — there's no code fix here, only a documentation or paid-tooling decision. Filing so it's tracked as its own thing rather than getting bundled into a future bug investigation again.
Context
Split out from #1, which was closed as not applicable — that issue conflated two separate things: an actual export bug (fixed, was a PyInstaller dylib collision, see
LIBLCMS2_DYLIB_COLLISION.md) and this one, which is real but unrelated.The actual remaining thing
.github/workflows/release.ymlhas no codesign/notarize step — the app ships ad-hoc signed only. That's fine fordlopen/AMFI purposes (confirmed not the cause of any bug found so far), but it's a distinct, real UX cost: anyone who downloads the.dmgfrom GitHub Releases gets it quarantined by Gatekeeper, and macOS shows the "cannot be opened because the developer cannot be verified" warning on first launch, requiring a right-click-Open (orxattr -d com.apple.quarantine) workaround.Options
notarytool submit --wait+stapler staple, wired intorelease.yml. Removes the warning entirely.xattr -cr) on first launch. Free, but a worse first-run experience.This is a product/UX call (is the $99/year and CI complexity worth it for a better first-run experience), not an engineering question — there's no code fix here, only a documentation or paid-tooling decision. Filing so it's tracked as its own thing rather than getting bundled into a future bug investigation again.