George BrancoviciandClaude Opus 4.6
c9492c90ea
Add code signing, notarization, and DMG packaging scripts
Enables distributing Galaxy.app to end users without Gatekeeper warnings.
Uses Samsung Developer ID Application certificate with hardened runtime.
Pipeline: cargo bundle → sign.sh → notarize.sh → package.sh → Galaxy.dmg
Entitlements:
- network.client (AWS Bedrock API calls)
- automation.apple-events (osascript for CLI install)
- cs.allow-unsigned-executable-memory (Metal shader compilation)
Orchestration scripts:
- build-debug.sh: full pipeline with debug build
- build-release.sh: full pipeline with release build
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>