3ffbb1cb9f
With the repository variable MACOS_SIGN_IDENTITY set, the launcher's Horizon.app and .dmg and the game's three programs are signed with the hardened runtime and a timestamp, notarized and (app, dmg) stapled, from a keychain of the Mac mini's own that keychain.sh unlocks with its password from 1Password. Unset, everything is signed ad hoc as before. The launcher checks an updated bundle's signature before and after swapping it in, and puts the old one back when it doesn't hold. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>