kookaburra-releaselisted

# kookaburra-release Ship a signed, notarised, stapled `.app` + DMG that opens on any Mac with no Gatekeeper warning, offline. ## The split, in one paragraph **Tauri signs; we notarise.** Tauri walks the bundle and signs the ffmpeg/ffprobe sidecars and nested code inside-out, which is the fiddly part worth delegating. Everything else is ours: Tauri's built-in notarisation **cannot use a notarytool keychain profile**, and it **never notarises the DMG** — only the `.app`. We also build the DMG ourselves (`bundle.targets` is `["app"]`) because Tauri's DMG bundler accepts only a png/jpg/gif background — no multi-resolution TIFF, so the artwork is blurry on Retina — and cannot set a volume icon. ## One-time setup 1. A **Developer ID Application** cert in the keychain — `security find-identity -p codesigning -v`. 2. A **notarytool keychain profile** (prompts for an app-specific password from appleid.apple.com, never the Apple ID password): ```bash xcrun notarytool store-credentials "kookaburra-cut" \ --apple-id <email> --team-id <TEAMID> ``` 3. An **updater keypair** for the auto-update lane (once; keep the private key out of git): ```bash pnpm tauri signer generate -w ~/.tauri/kookaburra-cut-updater.key ``` Paste the printed public key into `plugins.updater.pubkey` in `src-tauri/tauri.conf.json`. 4. Export all of these, or the scripts refuse to start: ```bash export KOOKABURRA_SIGNING_IDENTITY="Developer ID Application: Your Name (<TEAMID>)"