mason.release: Sign the .dmg on macOS.

Fixes #1896.

extra/mason/release/release.factor

@@ -12,6 +12,7 @@ IN: mason.release
     sign-factor-app
     archive-name {
         [ make-archive ]
+        [ sign-archive ]
         [ upload ]
         [ save-archive ]
         [ notify-release ]

extra/mason/release/sign/sign.factor

@@ -47,3 +47,18 @@ M:: windows sign-factor-app ( -- )
             }
         ] dip make-factor-path suffix short-running-process
     ] each ;
+
+HOOK: sign-archive os ( path -- )
+
+M: object sign-archive drop ;
+
+! Sign the .dmg on macOS as well to avoid Gatekeeper marking
+! the xattrs as quarantined.
+! https://github.com/factor/factor/issues/1896
+M: macosx sign-archive ( path -- )
+    ${
+        "codesign" "--force" "--sign"
+        "Developer ID Application"
+        cert-path
+    } swap suffix
+    short-running-process ;