Ad-hoc sign macOS binaries; document Gatekeeper workaround

Author: mariusrueve

.github/workflows/release.yml

@@ -57,6 +57,10 @@ jobs:
         if: runner.os != 'Linux'
         run: cargo build --release --target ${{ matrix.target }} -p molprint-cli
 
+      - name: Ad-hoc sign (macOS)
+        if: runner.os == 'macOS'
+        run: codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime "target/${{ matrix.target }}/release/molprint"
+
       - name: Package (Unix)
         if: matrix.archive == 'tar.gz'
         shell: bash

README.md

@@ -12,6 +12,15 @@ Molecular fingerprint computation and similarity search in Rust — fast enough
 
 ## Install
 
+**From a release binary** — download from [Releases](https://github.com/mariusrueve/molprint/releases), unpack, and place `molprint` on your `PATH`.
+
+> **macOS note:** binaries are ad-hoc signed but not notarized. After downloading, clear the quarantine flag once:
+> ```bash
+> xattr -dr com.apple.quarantine molprint
+> ```
+
+**From source:**
+
 ```bash
 cargo install --git https://github.com/mariusrueve/molprint molprint-cli
 ```