sign macos builds

Author: indirect

.github/workflows/release.yml

@@ -112,6 +112,9 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
+      CODESIGN_CERTIFICATE: ${{ secrets.CODESIGN_CERTIFICATE }}
+      CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}
+      CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
     steps:
       - name: enable windows longpaths
         run: |

dist-workspace.toml

@@ -17,6 +17,8 @@ install-path = "CARGO_HOME"
 install-updater = false
 # Build only the required packages, and individually
 precise-builds = true
+# Whether to sign macOS executables
+macos-sign = true
 
 [dist.github-custom-runners]
 aarch64-apple-darwin = "macos-14"