From 49839b853217e64b04a53dccd06782f400638747 Mon Sep 17 00:00:00 2001 From: sttlab-tech Date: Sun, 9 Aug 2026 13:52:52 +0200 Subject: [PATCH] sign Release build with the sttlab-apps identity, add install README MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The app bundle was ad-hoc signed (Xcode's automatic default), so trusting the sttlab-apps cert wouldn't have done anything for Gatekeeper on the outer .app — only the embedded audiotee binary was actually signed with it. Switch the Release config to sign with sttlab-apps too, matching what audiotee already does, so the two documented install paths in README.md (trust the cert, or bypass Gatekeeper per-download) both actually work. Co-Authored-By: Claude Sonnet 5 --- .gitignore | 5 +++ README.md | 62 ++++++++++++++++++++++++++ transcriptor.xcodeproj/project.pbxproj | 3 +- 3 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 README.md diff --git a/.gitignore b/.gitignore index 9d74a45..d0b2324 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,8 @@ DerivedData/ # compute WER against transcriptor-ai) — large binary media, not source. # See CLAUDE.md for what's in here and the results obtained from it. /test/ + +# Distribution zips — built locally and uploaded to Gitea releases directly, +# not committed (large binary, would bloat the repo; the release is already +# the canonical place to find them). +*.app.zip diff --git a/README.md b/README.md new file mode 100644 index 0000000..28bae37 --- /dev/null +++ b/README.md @@ -0,0 +1,62 @@ +# transcriptor + +Native macOS app for fully local, no-cloud meeting transcription. Download, unzip, run — +the only runtime download is the ASR model itself (see `CLAUDE.md` for how the app is built). + +## Installing from a downloaded release + +Grab `transcriptor-vX.Y.Z.app.zip` from the +[releases page](https://gitea.sttlab.eu/stt/transcriptor/releases), unzip it, and drag +`transcriptor.app` to `/Applications`. + +The app is signed with a self-signed identity (`sttlab-apps`), not an Apple Developer ID — +there's no paid Apple account behind this project. macOS's Gatekeeper doesn't trust that +signature by default, so on first launch of a version downloaded from a browser (which +macOS marks with a quarantine flag) you'll likely see it refuse to open, or ask to move it to +the bin. Pick **one** of the two options below to get past that — you don't need both. + +### Option 1 — Trust the `sttlab-apps` certificate + +This tells your Mac to trust anything signed by this specific certificate going forward, so +you won't need to repeat this for future versions of the app (as long as it keeps being signed +with the same identity). + +1. Get the certificate: `sttlab-apps.cer` (ask for it, or export it yourself if you have + access to the machine it was created on: `security find-certificate -c "sttlab-apps" -p + > sttlab-apps.cer`). +2. Import it into your login keychain: + ```bash + security import sttlab-apps.cer -k ~/Library/Keychains/login.keychain-db + ``` +3. Trust it, but **only** for code signing (not as a general root CA): + ```bash + security add-trusted-cert -r trustRoot -p codeSign \ + -k ~/Library/Keychains/login.keychain-db sttlab-apps.cer + ``` + macOS will prompt for your login password — that's it asking permission to change + keychain trust settings, not this command asking for a password directly. +4. Open `transcriptor.app` normally (double-click, or `open /Applications/transcriptor.app`). + +### Option 2 — Bypass Gatekeeper for this app only + +No trust changes, no certificate needed — just tells macOS to stop flagging this specific +app. You'll need to repeat this for each new version you download (the quarantine flag is +set per downloaded file). + +Either: + +- Right-click `transcriptor.app` in Finder → **Open** → **Open** again in the confirmation + dialog. (Regular double-click won't offer this the first time; right-click → Open does.) + +Or, from a terminal: + +```bash +xattr -dr com.apple.quarantine /Applications/transcriptor.app +``` + +(`-r` because it's a bundle — the quarantine flag can be set on files inside it too, not just +the top-level `.app`.) + +Both achieve the same result: the app opens. Option 1 is the better choice if you expect to +download future versions and don't want to repeat the bypass each time; Option 2 is faster +for a one-off. diff --git a/transcriptor.xcodeproj/project.pbxproj b/transcriptor.xcodeproj/project.pbxproj index 03dbee4..02d6198 100644 --- a/transcriptor.xcodeproj/project.pbxproj +++ b/transcriptor.xcodeproj/project.pbxproj @@ -459,7 +459,8 @@ buildSettings = { ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon; ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor; - CODE_SIGN_STYLE = Automatic; + CODE_SIGN_STYLE = Manual; + CODE_SIGN_IDENTITY = "sttlab-apps"; CURRENT_PROJECT_VERSION = 1; ENABLE_APP_SANDBOX = NO; ENABLE_USER_SCRIPT_SANDBOXING = NO;