anchore / anchore/quill

App specific passwords not possible?

Open
#372 2 comments 2 reactions 0 assignees View on GitHub
enhancement needs-investigation
Dominant language
Go
Stars
518
Forks
23
PR merge metrics
No merged PRs in 30d

Description

We need to use app specific passwords with Team ID (https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool#App-specific-password). We do not have App Store applications to notarize and just notarize binaries.

Is this supported? I see TeamID is not according to https://github.com/anchore/quill/issues/147.

If not, this is extremely important as almost every one of our projects are just golang binaries that need signing and notarization to be distributed on github for example, Quill is the perfect solution for this if it supports app specific password/team ID.

Our current scripts (which run on mac) are as follows:

1. `codesign --sign "Developer ID Application" --force -o runtime --timestamp "$BINARY"`
2. run `notarytool submit`
```
if ! INFO=$(xcrun notarytool submit --team-id TTXXXXXX --apple-id "${NOTARIZE_USERNAME}" --password "${NOTARIZE_PASSWORD}" --wait "$TEMP"); then
echo "problem with notarization command -- run manually to determine failure reason"
exit 3
fi
```

Contributor guide

Open the contributing guide

Research direction

Start by reviewing Quill's handling of Team ID and the Apple notarytool submission path, using the linked issue #147 and the notarytool command in this report as context. Done means establishing whether app-specific passwords with a Team ID are supported for binary notarization and documenting or implementing the agreed behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, macos
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.