Merge origin/rc175 (macOS signing and notarization) into rc175

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/JFJOCH_VIEWER.md

@@ -10,8 +10,7 @@ Gitea release page, and for Linux also in the Jungfraujoch RPM/APT repositories
 [Release contents](RELEASE_CONTENTS.md) for what each package contains and what it requires, and
 [Deployment](DEPLOYMENT.md) for how to install it. The macOS build needs **macOS 13 (Ventura) or
 newer on an Apple Silicon Mac** (M1 and newer; Intel Macs are not supported) and is CPU-only — see
-[Release contents ▸ macOS](RELEASE_CONTENTS.md#macos), which also covers opening it for the first
-time, as the release is not yet notarized by Apple.
+[Release contents ▸ macOS](RELEASE_CONTENTS.md#macos).
 
 ## Where it fits among the three analysis tools
 
@@ -332,3 +331,11 @@ As on Windows, `CMAKE_PREFIX_PATH` (Qt) is the only required flag. To produce th
 Qt frameworks and the license notices copied into the app with `macdeployqt`, packed into
 `jfjoch-viewer-<version>-macos-arm64.dmg` — run `cpack` in the build directory. What comes out is
 described in [Release contents ▸ macOS](RELEASE_CONTENTS.md#macos).
+
+The released image is signed with the project's Apple Developer ID and notarized by Apple. A build of
+your own is signed ad hoc, which runs on the machine that built it but is refused by Gatekeeper once
+downloaded. To sign with a Developer ID from your own keychain, configure with
+`-DJFJOCH_MACOS_SIGNING_IDENTITY=<hash>` before `cpack`, where the hash is the 40 hex digits
+`security find-identity -v -p codesigning` prints in front of the certificate's name, then notarize
+and staple the image with `tools/notarize_macos.sh build-mac/jfjoch-viewer-*.dmg` (it needs
+notarytool credentials stored once on the machine; the script's header says how).

docs/RELEASE_CONTENTS.md

@@ -173,17 +173,10 @@ app onto the *Applications* shortcut next to it. The app is self-contained: the
 inside it, and so are the license notices (`Contents/Resources`), which is where a macOS app keeps
 them.
 
-**The release is not notarized yet** (that needs an Apple Developer account), so macOS refuses to
-open a downloaded copy the first time. On macOS 15 and newer: try to open it once, then allow it in
-*System Settings ▸ Privacy & Security* with *Open Anyway*. On macOS 13 and 14, Control-click the app
-and choose *Open*. Alternatively, clear the download flag in Terminal:
-
-```
-xattr -dr com.apple.quarantine /Applications/jfjoch_viewer.app
-```
-
-The same applies to the `rugnux` binary from its `.tgz` — see
-[Installing Rugnux](RUGNUX_INSTALL.md#from-the-release-archive).
+Both artefacts are signed with the project's Apple Developer ID and **notarized by Apple**, so a
+downloaded copy opens like any other Mac application. The disk image carries its notarization ticket;
+the `rugnux` binary in the `.tgz` cannot (a bare executable has nowhere to staple one), so the first
+run of a freshly downloaded `rugnux` looks the ticket up online and needs an internet connection.
 
 The toolchain of the released macOS artefacts is Xcode (Apple Clang) and Qt 6.11 for macOS,
 including Qt Charts; to build the viewer yourself see

docs/RUGNUX_INSTALL.md

@@ -62,17 +62,10 @@ Nothing is written outside that directory, nothing needs root, and several versi
 side. To remove it, delete the directory. Put `bin/` on your `PATH` if you want to type `rugnux`
 rather than the full path.
 
-> **macOS: the first run is blocked.** The release is not yet notarized by Apple, and a `.tgz`
-> downloaded with a browser hands its download flag on to everything `tar` extracts from it, so
-> macOS refuses to run `rugnux` ("cannot be opened because the developer cannot be verified"). Clear
-> the flag once for the whole directory:
->
-> ```
-> xattr -dr com.apple.quarantine ~/rugnux-1.0.0
-> ```
->
-> An archive fetched with `curl` carries no such flag. Unpacking into a directory under your home
-> directory (`~/rugnux-<version>`) rather than `/opt` avoids needing `sudo` on a Mac.
+> **macOS:** the binary is signed with the project's Apple Developer ID and notarized, so a `.tgz`
+> downloaded with a browser runs without further steps; the first run of a freshly downloaded copy
+> checks the notarization online. Unpacking into a directory under your home directory
+> (`~/rugnux-<version>`) rather than `/opt` avoids needing `sudo` on a Mac.
 
 > **Mixing the two.** If a `rugnux` package is also installed, `/usr/bin/rugnux` will normally win
 > on `PATH`. Put the archive's `bin/` first, or call it by its full path, to be sure which one you