docs+ci(macos): ad-hoc sign bundle, add Homebrew cask, clarify install

- release.yml: ad-hoc codesign the .app before packaging so a quarantined
  download avoids the "app is damaged" Gatekeeper verdict; emit the cask
  version + sha256 to the job summary each release for easy tap bumps.
- packaging/homebrew: Homebrew cask + tap/usage notes; install via
  --no-quarantine (the actual Gatekeeper bypass for an unsigned app).
- README: split macOS install into Homebrew and manual .dmg paths with
  the xattr / Settings "Open Anyway" fallbacks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -188,6 +188,17 @@ jobs:
           [ -z "$VERSION" ] && VERSION="0.0.0"
           sed "s/__VERSION__/$VERSION/g" packaging/Info.plist > "$APP/Contents/Info.plist"
 
+      - name: Ad-hoc code-sign the bundle
+        run: |
+          # No paid Apple Developer ID is available, so the app cannot be
+          # notarised. An *ad-hoc* signature (identity "-") at least gives the
+          # bundle a valid self-signature: this avoids the harshest Gatekeeper
+          # verdict ("app is damaged, Move to Trash") on a quarantined download
+          # and is mandatory anyway for arm64 binaries to execute. Sign the
+          # whole bundle deeply, then verify.
+          codesign --force --deep --sign - --timestamp=none OpenCADStudio.app
+          codesign --verify --strict --verbose=2 OpenCADStudio.app
+
       - name: Create .dmg
         run: |
           hdiutil create \
@@ -203,3 +214,22 @@ jobs:
         run: |
           mv OpenCADStudio.dmg OpenCADStudio-${{ github.ref_name }}-macos-arm64.dmg
           gh release upload ${{ github.ref_name }} OpenCADStudio-${{ github.ref_name }}-macos-arm64.dmg --clobber --repo ${{ github.repository }}
+
+      - name: Emit Homebrew cask sha256
+        if: github.event_name == 'release'
+        run: |
+          # Print the values needed to bump the Homebrew cask
+          # (packaging/homebrew/open-cad-studio.rb) for this release, so the
+          # tap can be updated with a copy-paste instead of computing the
+          # digest by hand.
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#v}"
+          SHA=$(shasum -a 256 OpenCADStudio-${{ github.ref_name }}-macos-arm64.dmg | awk '{print $1}')
+          {
+            echo "## Homebrew cask bump"
+            echo "Update \`packaging/homebrew/open-cad-studio.rb\`:"
+            echo '```ruby'
+            echo "  version \"$VERSION\""
+            echo "  sha256 \"$SHA\""
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

README.md

@@ -118,9 +118,26 @@ Download `OpenCADStudio-*-windows-x86_64.exe` from the [latest release](https://
 
 ### macOS (Apple Silicon)
 
-Download `OpenCADStudio-*-macos-arm64.dmg` from the [latest release](https://github.com/HakanSeven12/OpenCADStudio/releases/latest) — Apple Silicon (M-series) only; Intel macOS isn't built.
+Apple Silicon (M-series) only; Intel macOS isn't built. The app is ad-hoc signed but **not Apple-notarised** (notarisation requires a paid Apple Developer ID), so macOS Gatekeeper guards the first launch. Pick whichever path is easiest:
 
-Open the .dmg and drag `OpenCADStudio.app` to `/Applications`. The first launch may be blocked by Gatekeeper because the app is not notarised — right-click `OpenCADStudio.app → Open` and confirm, or run once via `xattr -dr com.apple.quarantine /Applications/OpenCADStudio.app`.
+**Option A — Homebrew (recommended):**
+
+```bash
+brew install --cask --no-quarantine \
+  https://raw.githubusercontent.com/HakanSeven12/OpenCADStudio/main/packaging/homebrew/open-cad-studio.rb
+```
+
+`--no-quarantine` lets Gatekeeper skip the unsigned-app prompt. See [`packaging/homebrew/`](packaging/homebrew/) for publishing this as a `brew tap`.
+
+**Option B — manual .dmg:**
+
+Download `OpenCADStudio-*-macos-arm64.dmg` from the [latest release](https://github.com/HakanSeven12/OpenCADStudio/releases/latest), open it, and drag `OpenCADStudio.app` to `/Applications`. If the first launch is blocked, clear the quarantine flag once:
+
+```bash
+xattr -dr com.apple.quarantine /Applications/OpenCADStudio.app
+```
+
+On older macOS you can instead right-click `OpenCADStudio.app → Open` and confirm; on macOS Ventura and later, approve it via **System Settings → Privacy & Security → Open Anyway**.
 
 ### Build from Source
 

packaging/homebrew/README.md

@@ -0,0 +1,36 @@
+# Homebrew cask
+
+[`open-cad-studio.rb`](open-cad-studio.rb) is a [Homebrew Cask](https://docs.brew.sh/Cask-Cookbook)
+for installing the macOS (Apple Silicon) build.
+
+## Install without a tap (directly from this file)
+
+```bash
+brew install --cask --no-quarantine \
+  https://raw.githubusercontent.com/HakanSeven12/OpenCADStudio/main/packaging/homebrew/open-cad-studio.rb
+```
+
+`--no-quarantine` is required: the app is ad-hoc signed but **not** Apple-notarised
+(notarisation needs a paid Apple Developer ID), so without it Gatekeeper still
+blocks the first launch.
+
+## Publishing as a proper tap (recommended)
+
+Create a separate GitHub repo named `homebrew-tap` under the same account, put a
+copy of `open-cad-studio.rb` in its `Casks/` directory, then users can run:
+
+```bash
+brew install --cask --no-quarantine hakanseven12/tap/open-cad-studio
+```
+
+`brew upgrade` then keeps the app current automatically.
+
+## Updating for a new release
+
+Each release run prints the new `version` + `sha256` in the GitHub Actions job
+summary (the **Emit Homebrew cask sha256** step). Paste those two lines into the
+cask. To compute the digest manually:
+
+```bash
+shasum -a 256 OpenCADStudio-vX.Y.Z-macos-arm64.dmg
+```

packaging/homebrew/open-cad-studio.rb

@@ -0,0 +1,27 @@
+cask "open-cad-studio" do
+  version "0.4.8"
+  sha256 "8fa92be6045c57ac1994bd20fbb2def7269e25c327b7e62cb59745977c66f421"
+
+  url "https://github.com/HakanSeven12/OpenCADStudio/releases/download/v#{version}/OpenCADStudio-v#{version}-macos-arm64.dmg",
+      verified: "github.com/HakanSeven12/OpenCADStudio/"
+  name "Open CAD Studio"
+  desc "CAD application for 2D drafting and 3D modeling that reads/writes DWG and DXF"
+  homepage "https://github.com/HakanSeven12/OpenCADStudio"
+
+  # Only an Apple Silicon (arm64) build is published.
+  depends_on arch: :arm64
+
+  app "OpenCADStudio.app"
+
+  # The app is ad-hoc signed but not notarised (no paid Apple Developer ID).
+  # Install with `--no-quarantine` so Gatekeeper does not block first launch:
+  #   brew install --cask --no-quarantine packaging/homebrew/open-cad-studio.rb
+  # or, once published to a tap:
+  #   brew install --cask --no-quarantine hakanseven12/tap/open-cad-studio
+
+  zap trash: [
+    "~/Library/Application Support/OpenCADStudio",
+    "~/Library/Preferences/io.github.HakanSeven12.OpenCadStudio.plist",
+    "~/Library/Saved Application State/io.github.HakanSeven12.OpenCadStudio.savedState",
+  ]
+end