Homebrew notarisation process

[johnalanwoods]

Why are executables that I install via homebrew trusted by MacOS (gatekeeper)? i.e. after installation I can run an executable and don't get a security popup and don't have to allow an exception - why is that?

I initially thought that homebrew might sign/notarize the binaries in their CI, but looking at some random executables it doesn't look like they have a signature: spctl -a -v $(which ).

Wondering about bottles more than complied locally.

[SMillerDev]

I'm guessing because they're not .app files. But you should probably ask Apple about the specifics of gatekeeper.

[carlocab]

If you compile an executable (say, one that does Hello, world!) on one Mac and try to run it on another, you don't get a security popup on the second Mac, do you?

[gromgit]

The following might be useful reading material:

• https://wiki.lazarus.freepascal.org/Code_Signing_for_macOS
• https://wiki.lazarus.freepascal.org/macOS_Big_Sur_changes_for_developers#Code_signing_-_Intel_vs_M1

[infa-jowoods]

thanks for that, read through it, I have an intel and M1 Mac, and I understand the adhoc signature process.

My question is about notarisation though, why isn't it required? Is it because the apps from home-brew aren't actually signed with a dev cert, they are ad-hoc signed and as such cannot be notarised?

[gromgit]

Sorry, I read one thing and thought another.

As I understand it, notarization isn't required for command-line utilities. It's also pointles with adhoc-signed stuff, since notarization really says "we (Apple) vouchsafe that this software was received:

• in this same condition (nothing's changed)
• from this known entity (Developer ID)".

With ad-hoc signing, that last condition can't be met.

https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution

[infa-jowoods]

thanks, answered :)