[BuildWu19940706]

Summary

• build arm64 and x86_64 release binaries and combine them into one Universal app
• verify the ad-hoc signature, architecture set, archive name, and SHA-256 checksum during packaging
• publish matching v* tags as GitHub pre-releases without Apple credentials
• document Gatekeeper warnings, checksum verification, and the supported manual opening flow

Why

MacAppLock cannot retain its core termination behavior in the Mac App Store sandbox, while Developer ID signing and notarization require a paid Apple Developer Program membership. This keeps the existing zero-cost ad-hoc distribution model but makes its artifacts clearer, architecture-independent, reproducible, and transparent about their trust limitations.

User impact

Users receive a single ZIP that supports Apple Silicon and Intel Macs. Releases are explicitly marked as development previews and include a checksum plus instructions for opening an unidentified application. Gatekeeper warnings remain expected because the app is not Developer ID signed or notarized.

Validation

• swift test: 10 tests passed
• ./scripts/package_release.sh: passed
• Universal binary: x86_64 arm64
• minimum deployment target: macOS 13.0 for both architectures
• signature: ad-hoc; strict codesign verification passed
• SHA-256 archive verification passed
• shell syntax and workflow YAML parsing passed

The current local Mac has Gatekeeper assessments disabled, so the clean-machine “Open Anyway” interaction still requires manual verification on a Mac with Gatekeeper enabled.