Choose the release mode
- Ad-hoc builds are for controlled development testing and are not a production distribution method.
- Production builds require an Apple Developer ID Application certificate, hardened runtime signing, notarization, and stapling.
- Keep the existing bundle identifier so installed clients and update records remain compatible.
Test an ad-hoc build
- Build the tenant package on a macOS runner.
- Transfer the DMG only through the protected tenant download.
- Open the application. If Gatekeeper blocks the ad-hoc build, use System Settings → Privacy & Security to review and explicitly allow that known test artifact.
- Verify enrollment, login-item behavior, notification permission, realtime delivery, and polling fallback.
Prepare official distribution
When the organization is ready to release publicly, add Apple signing and notarization secrets to the protected build environment. Never commit certificate material or an app-specific password to the repository.