Release status
Only local ad-hoc builds exist; signing and notarization are not done.
No public release exists
No public release has been made yet. Builds are local: scripts/ makes development builds, and scripts/ makes the release archive zudo-stl-fix-<version>-macos-arm64.zip (macOS 27 or later, Apple silicon only) and attaches it to a draft GitHub Release for the owner to publish. See Continuous integration.
These archives are ad-hoc signed only: not Developer ID signed and not notarized, so Gatekeeper asks for confirmation on first launch. A development launch is not evidence that a downloaded copy would pass Gatekeeper.
What Developer ID distribution would still need
Public Developer ID signing and notarization is a separately authorized task, and no credential-based signing is enabled in the repository scripts. A future signed release process should:
Accept the signing identity, Team ID and notarization profile as private configuration.
Sign nested code from the inside out with the needed hardened-runtime settings, then sign the outer app.
Notarize and staple.
Test the downloaded artifact with Gatekeeper, and verify nested signatures and first launch.
Review licence and source obligations for the shipped dependencies.
Warning
Never instruct users to remove quarantine wholesale, disable Gatekeeper, or use administrator access to install the app.
Release verification runs in release.yml only when a Release is published. Daily commits do not run native builds, notarization, or full packaging.