Notirize application for macOS

[oneslash]

I think you need to Notarize application for macOS, otherwise it is not going to let users to run it.

Links:
https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution

https://g3rv4.com/2019/06/bundling-signing-notarizing-go-application

[fho]

Thanks for the report.

I'm not very familiar with Apple + MacOS.
If I understand it right, either:

• wehave to become a paid member of the Apple developer programs to get a certificate to sign the binaries or
• the user has to confirm 1x that he wants to run the unsafe binary?

[oneslash]

Yes, you would need a paid account, and second to answer, a user will see the message like here golang/go#34986 (comment) without a button to open the binary.

Currently the solution is to go to System Preferences -> Security & Privacy -> and Open it

However, I am not sure what Apple implement, it suppose to be launched Jan 2020

[fho]

@oneslash thanks for the information.
I'll evaluate internally if it's doable with reasonable effort to sign the MacOS.

[fho]

I got a bit more into the topic.
The component responsible for these security warning is Gatekeeper (https://en.wikipedia.org/wiki/Gatekeeper_(macOS)).
When files are downloaded via certain applications like Safari, the downloaded file is flagged with a quarantine flag.
When a file with this flag is opened, MacOS checks if it has a valid code signature, if not a warning is shown.
This only happens when the application that created the file adds the quarantine flag.
When files are downloaded via e.g. curl, the file is not flagged and no warning appears.

For now I won't notarize the baur applications:

• Apple requires a paid subscription and does not offer support for non-profit/open-source applications to do the signature without costs,
• it complicates the release process, I found some commandline tools that can be used in CI to simplify it though,
• baur can still be used on Mac OS without notarization,
  baur is used on CI systems or developer laptops, the installation is done by experienced people who can cope with the signature warning.