Repository navigation
Never ship a macOS download Gatekeeper refuses - #257
Merged
Merged
Conversation
The standalone macOS binaries were only signed ad hoc, so a browser download could only be moved to the Trash. They are now signed with the Codext GmbH Developer ID (hardened runtime, timestamp) and notarized. Official releases fail instead of shipping unsigned: the Apple secrets, the certificate's team and expiry are checked up front, and every DMG, app, update bundle and binary goes through scripts/macos-verify.sh. A daily workflow downloads what usegodmode.com serves, checks it the same way and opens an issue when a download would be refused.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On a Mac a download could end in "can't be opened, move it to the Trash". I checked every macOS file v0.2.30 ships:
Godmode.Bot_0.2.30_aarch64.dmg/_x64.dmg+ the app insidesyspolicy_checkpasses.app.tar.gz, in-app updater)godmode-darwin-arm64/-x64(headless server, on the download page)Releases were also only protected by a warning: without the Apple secrets the workflow built an unsigned app and still published it.
Changes
scripts/macos-sign-binaries.sh, temporary keychain, notarytool status must beAccepted, log printed otherwise). Tested locally on the v0.2.30 binary: notarization Accepted,godmode versionstill runs.create-releasechecks that every Apple secret exists, the identity is a Developer ID of the team, the .p12 opens, belongs to the team and isn't expired (warning 45 days before; the current certificate runs until 2027-11-15).scripts/macos-verify.sh(signer = Codext GmbH team, hardened runtime, timestamp, deep strict verify, stapled ticket,spctlsays "Notarized Developer ID",syspolicy_check, mounts DMGs incl. the licence prompt). It runs on the built app + update bundle, on the notarized DMG before upload and on the signed binaries.verify-downloads.yml: every morning and after each published release it downloads what usegodmode.com and the update feed serve, marks the files as browser downloads, runs the same check and opens or updates an issue when a download would be refused.Verification
scripts/macos-verify.shon the live v0.2.30 DMGs and update bundles: pass. On the live server binary: fails with "not signed with a Developer ID of team STSYBH724K (Signature=adhoc)". So the watchdog goes green with the next release.