boostsecurityio / boostsecurityio/bagel
Sign and notarize macOS release binaries
- Dominant language
- Go
- Stars
- 196
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
We're looking to deploy bagel to our macOS fleet via MDM (Kandji/Iru) and ran into an issue with the binaries being unsigned. Without an Apple Developer ID signature and notarization, Gatekeeper blocks execution on first run, requiring either a manual user approval or a post-install workaround to strip quarantine attributes.
Would you consider signing and notarizing the macOS release binaries? This would:
Allow MDM deployment without Gatekeeper workarounds
Provide a verifiable chain of custody for a tool that itself audits security posture
Make the Homebrew install path smoother for managed fleets
Happy to help test if needed. Thanks!
Contributor guide
Research direction
No files, tests, or release entry points are named. Start by locating how macOS binaries are built and published, then review the release workflow and its signing and notarization inputs. Done means the macOS artifacts are signed and notarized so managed installation no longer requires Gatekeeper workarounds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, macos
- Domain
- cli, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100