macOS release binaries are neither code-signed nor notarized. On a managed Mac, Gatekeeper blocks them, so operators have to strip the quarantine attribute by hand.
Wanted: sign and notarize the darwin builds in the release pipeline.
Notes
- Needs a Developer ID Application certificate and an App Store Connect API key or notarytool credentials, stored as repository secrets — no credentials in the repo.
- goreleaser supports post-build signing hooks; notarization runs after signing and before the archive is uploaded.
- Should be validated by downloading a release artifact onto a Jamf-managed Mac and confirming it launches without a Gatekeeper prompt.
Priority: P3
macOS release binaries are neither code-signed nor notarized. On a managed Mac, Gatekeeper blocks them, so operators have to strip the quarantine attribute by hand.
Wanted: sign and notarize the darwin builds in the release pipeline.
Notes
Priority: P3