Code signing OSS casks for Apple Sillicon

[agologan]

Hey, I maintain https://github.com/liquidx/webviewscreensaver I'm looking at any options/suggestions on how to approach the M1 signature requirement.
One idea could be to enhance brew with a code-signing stanza to invoke the apply_ad_hoc_signature after install.
Another is to migrate from cask to a formula though non-CLI artifacts are not usually encouraged in core.

Any other ideas? How have other cask maintainers approached this?

[carlocab]

apply_ad_hoc_signature just calls codesign. This is only needed when using install_name_tool to change binary install names or rpaths. If your build doesn't do anything like that, there should be no need to apply an ad-hoc signature. If you do need to apply one, why don't you do so as part of your build?

[agologan]

The binary is distributed as an unsigned cask https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/webviewscreensaver.rb
To run on Apple Sillicon it requires a signature.
As far as I know ad hoc signing works only for local builds, not distributed binaries.
The proper way to do it is to pay for a developer account and then sign and notarize the binary using the Developer ID.

Since this is an open-source hobby project going that route does not seem reasonable.
So I'm looking for other recommendations from the community.

[SMillerDev]

Homebrew doesn't really have a solution for this. You'd be better off asking on the Apple forums or Stackoverflow.

[agologan]

After testing adhoc codesigning (codesign --sign -) and distribution at @carlocab suggestion it seems to work fine.

[tlk]

@agologan Thanks for the update.

I saw your change at liquidx/webviewscreensaver@5cb16aa and noticed that code signing is disabled manually when running xcodebuild with CODE_SIGNING_REQUIRED=NO, so perhaps not doing that would be an alternative way to solve the issue. Anyway, happy to hear that you found a way.

[agologan]

Adhoc codesigning is different then typical signatures because they don't contain an actual cryptographic message instead just adding sha of the object without any way of verifying the signing identity.
This seems to be enough to run the code on Apple Silicon but it doesn't get rid of the unidentified developer prompt and it doesn't enable notarisation.

To adhoc sign a build locally you can do codesign --sign - <target> on an unsigned object (or pass --force to resign) or during the build process by passing CODE_SIGN_IDENTITY="-" CODE_SIGNING_REQUIRED=YES.
I don't have a preference for either but it may be easier to specify that as part of the build if you have multiple objects to sign.

[tlk]

Have you checked out the --no-quarantine flag?

See https://github.com/Homebrew/homebrew-cask/blob/HEAD/doc/faq/app_cant_be_opened.md

[agologan]

As seen from our README.md I already direct users to install with --no-quarantine to avoid the prompts on x86.
This does not answer my inquiry though, as codesigning is still required for Apple Sillicon as opposed to running on Intel.

[tlk]

Oh, I see. I guess you can maintain a local tap (as an alternative to core) with a formula.

Maybe reach out to Apple and ask them for advice? It would be interesting to know what their thoughts are on this subject.