Fix hard-coded Apple signing key, move to env variable, update readme
diff --git a/README.md b/README.md
index 2e59453..981c46e 100644
--- a/README.md
+++ b/README.md
@@ -137,9 +137,16 @@
     * Windows 64bit exe installer and zip
 * Userguides
 
+### Signing keys
+
+Define the PGP key used to sign the artifacts and the Apple signing ID used to sign the DMG:
+
+    export RELEASE_KEY=28686142
+    export APPLE_SIGNING_ID=2GLGAFWEQD
+
+Note: those are Stefan's keys, replace with your own.
 
 ### Preparation
-
 Update the copyright year. Full text search/replace "2006-2020". Also change in `plugins/rcp/src/main/resources/splash.bmp` image.
 
 Test the release build: rat check, javadoc and source jar generation, installer generation, GPG signing, userguide generation:
@@ -152,7 +159,6 @@
 Test the build and sign process for distribution packages:
 
     export VERSION=2.0.0-SNAPSHOT
-    export RELEASE_KEY=28686142
     cd dist
     ./dist.sh
 
@@ -230,10 +236,6 @@
 
 There is a script that collects and signs all update sites and distribution packages.
 
-For non-interactive signing with GPG agent define env variable:
-
-    export RELEASE_KEY=28686142
-
 Run the dist script:
 
     cd dist
@@ -259,9 +261,9 @@
     svn commit -m "Add release $VERSION"
     cd ../../..
 
-Note: This publishes the user guides directly to the production CMS!
+Note 1: This publishes the user guides directly to the production CMS!
 
-Also update the `content/extpaths.txt` and whitelist the new version.
+Note 2: In `content/extpaths.txt` the parent folder is already whitelisted.
 
 ### Call the vote
 
diff --git a/dist/dist.sh b/dist/dist.sh
index 7cd8225..fa6dd22 100755
--- a/dist/dist.sh
+++ b/dist/dist.sh
@@ -46,8 +46,8 @@
 # source release
 cp ../target/org.apache.directory.studio.parent-${VERSION}-source-release.zip ${DIST_DIR}/ApacheDirectoryStudio-${VERSION}-src.zip
 # archives generated by Eclipse Tycho
+# note: macOS archive isn't signed and fails to launch
 cp ../product/target/products/ApacheDirectoryStudio-${VERSION}-linux.gtk.x86_64.tar.gz ${DIST_DIR}/
-cp ../product/target/products/ApacheDirectoryStudio-${VERSION}-macosx.cocoa.x86_64.tar.gz ${DIST_DIR}/
 cp ../product/target/products/ApacheDirectoryStudio-${VERSION}-win32.win32.x86_64.zip ${DIST_DIR}/
 # installers
 cp ../installers/windows/64bit/target/ApacheDirectoryStudio-${VERSION}-win32.win32.x86_64.exe ${DIST_DIR}/
diff --git a/installers/macos/src/dmg/createDMG.sh b/installers/macos/src/dmg/createDMG.sh
index 7f81b1c..0626ec1 100755
--- a/installers/macos/src/dmg/createDMG.sh
+++ b/installers/macos/src/dmg/createDMG.sh
@@ -39,7 +39,7 @@
 ln -s /Applications dmg/Applications
 
 # Codesign the App with the ASF key, and verify
-codesign --force --deep -s 2GLGAFWEQD dmg/ApacheDirectoryStudio.app
+codesign --force --deep -s ${APPLE_SIGNING_ID} dmg/ApacheDirectoryStudio.app
 codesign -dv --verbose=4 dmg/ApacheDirectoryStudio.app
 
 # Creating the disk image