macOS binary release blocked by Gatekeeper

[jordancarlin]

The macOS binary release is not signed so Gatekeeper tries to block it from running:

“sail” Not Opened
Apple could not verify “sail” is free of malware that may harm your Mac or compromise your privacy.

Unfortunately overriding this locally is not a realistic option because after going to into System Settings and explicitly allowing sail, the same issue occurs for each of the .cmxs sail plugins.

Seems like we need to actually sign the generated binaries for macOS.

[Alasdair]

We could sign them, but you also need notarisation on macOS. We would need to pay for an apple developer account for that and I think I would have to do it locally with xcode which rather defeats the point of having it built with CI and artifact attestation.

In my opinion the process of distributing binaries on macOS is so painful it's better to just distribute source.

[Alasdair]

I commented out the macOS part of the release CI job for now to avoid being blocked by this.

I'll ask around and see if anyone here as any experience releasing macOS software.