A way to build the NSIS installer and the dmg from CI: a self-hosted runner on each platform, or GitHub-hosted runners in a mirror repo if that is cheaper than keeping two machines. Code signing with a Windows certificate and Apple Developer ID, notarization for the dmg. Until the credentials exist, ship unsigned with a documented warning in the release notes.
Operator decision to record here before starting
Apple Developer account and Windows certificate: which entity, and where the secrets live (Gitea secrets, never the repo).
Acceptance
The installer runs on Windows 11 without SmartScreen blocking; the dmg opens on macOS 15 without a Gatekeeper override.
Depends on
The release workflow.
Parent: #5
## Scope
A way to build the NSIS installer and the dmg from CI: a self-hosted runner on each platform, or GitHub-hosted runners in a mirror repo if that is cheaper than keeping two machines. Code signing with a Windows certificate and Apple Developer ID, notarization for the dmg. Until the credentials exist, ship unsigned with a documented warning in the release notes.
## Operator decision to record here before starting
Apple Developer account and Windows certificate: which entity, and where the secrets live (Gitea secrets, never the repo).
## Acceptance
The installer runs on Windows 11 without SmartScreen blocking; the dmg opens on macOS 15 without a Gatekeeper override.
## Depends on
The release workflow.
grenade
added the child label 2026-09-15 12:41:43 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #5
Scope
A way to build the NSIS installer and the dmg from CI: a self-hosted runner on each platform, or GitHub-hosted runners in a mirror repo if that is cheaper than keeping two machines. Code signing with a Windows certificate and Apple Developer ID, notarization for the dmg. Until the credentials exist, ship unsigned with a documented warning in the release notes.
Operator decision to record here before starting
Apple Developer account and Windows certificate: which entity, and where the secrets live (Gitea secrets, never the repo).
Acceptance
The installer runs on Windows 11 without SmartScreen blocking; the dmg opens on macOS 15 without a Gatekeeper override.
Depends on
The release workflow.