fix: ad-hoc sign the macOS app so it opens after install

.github/workflows/release.yml

@@ -30,7 +30,8 @@ jobs:
       - run: npm ci
       - run: npm test
       - run: npm run build
-      # Builds are unsigned until signing certificates are configured as repository secrets.
+      # No signing certificates are configured as repository secrets yet: Windows is unsigned and macOS
+      # is ad-hoc signed (electron-builder.yml `mac.identity`), so no keychain search is wanted.
       - run: npx electron-builder ${{ matrix.target }} --publish never
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: 'false'

CHANGELOG.md

@@ -17,6 +17,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   This release sets up the connection; layouts, drawings and settings start syncing in a later
   update.
 
+### Fixed
+
+- macOS no longer says OpenTerm5 "is damaged and can't be opened" after installing it. The app is
+  now signed (ad hoc, until a publisher certificate is set up), so macOS asks once on first launch
+  instead; [Getting started](docs/getting-started.md) shows how to allow it.
+
 ## [0.11.0] - 2026-11-03
 
 ### Added

docs/getting-started.md

@@ -28,11 +28,16 @@ Download the installer for your platform from the
 | Linux | `OpenTerm5-<version>.AppImage` | `chmod +x` the file and run it |
 | Debian, Ubuntu | `openterm5_<version>_amd64.deb` | `sudo apt install ./openterm5_<version>_amd64.deb` |
 
-Release builds are not yet code-signed. Windows SmartScreen and macOS Gatekeeper may warn on first
-launch:
+Release builds are not yet signed with a publisher certificate. Windows SmartScreen and macOS
+Gatekeeper ask once on first launch:
 
 - **Windows:** choose **More info → Run anyway**.
-- **macOS:** right-click the app, choose **Open**, then confirm.
+- **macOS 15 (Sequoia) and later:** open OpenTerm5 once and close the warning. Then open **System
+  Settings → Privacy & Security**, scroll to the message about OpenTerm5, and choose **Open Anyway**.
+- **macOS 14 and earlier:** right-click the app in Applications, choose **Open**, then confirm.
+- **If macOS says OpenTerm5 is damaged** (versions up to 0.11.0 did this): drag it to Applications,
+  then run `xattr -dr com.apple.quarantine /Applications/OpenTerm5.app` in Terminal and open it again.
+  Or install a newer version, which no longer has this problem.
 
 ### Updates
 

electron-builder.yml

@@ -26,5 +26,12 @@ mac:
   # Squirrel.Mac updates from the zip, not the dmg.
   target: [dmg, zip]
   category: public.app-category.finance
+  # Without a Developer ID, electron-builder leaves the app unsigned (it never falls back to ad-hoc),
+  # and packaging breaks Electron's own signature, so macOS on Apple Silicon calls the download
+  # damaged. Ad-hoc signing gives a valid signature; Gatekeeper then asks once instead. Hardened
+  # runtime is off because, with ad-hoc signing, its library validation rejects Electron's
+  # frameworks, and it only matters for notarization. Replace both once a Developer ID exists.
+  identity: '-'
+  hardenedRuntime: false
 win:
   target: [nsis]