fix: macOS build and sign app instructions

Based on what I needed to learn about to make v3.0.4.

While there, reorganise the README and split into small sections.

Part of ooni/ooni.org#600.

Readme.md

@@ -27,51 +27,74 @@ You will also need to have copied a compiled binary of `probe-cli` into the
 directory for the platform you plan to do development on.
 
 You can download them by running:
-```
+
+```bash
 yarn run probe-cli
 ```
 
-## Usage
+## Run app in development mode
 
 To build and run a development mode electron instance run:
-```
+
+```bash
 yarn run start
 ```
 
-To update the translations:
+## Update the translations
+
 * Save the strings from the canonical spreadsheet into `data/lang-en.csv`
 * Run `$ node scripts/update-translations.js`
 * Commit `data/lang-en.csv`, `lang/en.json` and `renderer/static/translations.js`
 into git
 
-To create a signed packaged app you will need to have configured the following
-environment variables:
+## Build and sign macOS app
+
+Obtain the development certificate and private key for our team (`YWCG8FZTLT`)
+from another OONI developer who has access to it. They need to ensure they export
+not only the certificate but also the related private key. You should receive a
+password encrypted `.p12` file containing both. Just double click on this file and
+provide the password to import the certificate and the key into your keyring. At
+time point, dispose of the the `.p12` file using `rm -P`.
 
+Create a `.env` file in the root directory with the following content:
+
+```bash
+[email protected]
+OONI_APPLEIDPASS=XXXX
+OONI_TEAMID=YWCG8FZTLT
 ```
-CSC_NAME=Hermes OONI Dev Key
-APPLEIDPASS=XXXX
-[email protected]
 
-CSC_LINK=/path/to/secrets/file.p12
-CSC_KEY_PASSWORD=XXXX
+where `[email protected]` is the Apple ID you are using as part of our
+team, `XXXX` is a password specific application created by visiting
+https://appleid.apple.com and logging in as `[email protected]`, and
+`YWCG8FZTLT` is the team ID used by OONI.
+
+Then, run:
+
+```bash
+yarn install
+yarn pack:mac
 ```
 
-You can place them inside of `.env` file and they will be picked up by the
-following build commands.
+This will build `./dist/OONI Probe-$VERSION.dmg`.
+
+## Build and sign an app on Windows
 
-To publish a release you should run:
+```bash
+yarn install
+yarn run pack:win
 ```
+
+## Publish a release
+
+Run:
+
+```bash
+yarn install
 yarn run publish
 ```
 
 **Important caveat** be sure to not push the tag for the upcoming release until
 after the `yarn run publish` command has run successfully. If you do so users
 of the OONI Probe Desktop app will get an error when they start the app because
 the auto-update system will try to fetch the metadata associated with that tag.
-
-You can also make a build, but not publish it by running the following commands:
-```
-yarn run pack:mac
-yarn run pack:win
-yarn run pack:linux
-```

scripts/notarize.js

@@ -18,7 +18,8 @@ exports.default = async function notarizing(context) {
   return await notarize({
     appBundleId: appBundleId,
     appPath: `${appOutDir}/${appName}.app`,
-    appleId: process.env.APPLEID,
-    appleIdPassword: process.env.APPLEIDPASS,
+    appleId: process.env.OONI_APPLEID,
+    appleIdPassword: process.env.OONI_APPLEIDPASS,
+    ascProvider: process.env.OONI_TEAMID,
   })
 }