macOS builds are unsigned ("identity": null) — arm64 dmg shows "damaged and can't be opened" on Apple Silicon

[Logic-Bored]

Problem

Installing ReticulumMeshChat-v2.4.0-mac-arm64.dmg on an Apple Silicon Mac fails to launch: macOS reports "Reticulum MeshChat" is damaged and can't be opened. You should move it to the Trash. This happens even with Gatekeeper disabled (spctl --master-disable).

Cause

The electron-builder mac config in package.json sets "identity": null, so the macOS builds are not code-signed (and not notarized). On Apple Silicon, macOS requires arm64 native code to carry a valid signature independently of Gatekeeper, so a quarantined unsigned app produces the misleading "damaged" dialog instead of launching. The x64 build runs under Rosetta, which is not held to the same signing requirement — which is why only the arm64 asset is affected.

Same pattern in other unsigned Electron apps: SpacingBat3/WebCord#173, jeffvli/feishin#104.

Workaround (for anyone else hitting this)

xattr -cr "/Applications/Reticulum MeshChat.app"
# if it still won't open:
codesign --force --deep --sign - "/Applications/Reticulum MeshChat.app"

Suggested fix

• Minimum: drop "identity": null so electron-builder applies its default ad-hoc signature, and/or document the xattr workaround in the README and release notes.
• Ideal: sign with a Developer ID certificate and notarize the dmg so it opens out of the box.

Thanks for shipping the arm64 build in v2.4.0!