facebook / facebook/watchman

macOS binaries are not signed.

Open
#1,359 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
13.7k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

The `watchman` binaries available for macOS via Homebrew / GitHub Releases are currently distributed without code signing.

```sh
codesign -dvv /opt/homebrew/bin/watchman

Executable=/opt/homebrew/Cellar/watchman/2026.07.27.00_1/bin/watchman
Identifier=watchman-55554944b7021d8cce1231d88e5056ae7fba3734
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=93610 flags=0x2(adhoc) hashes=2919+2 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=0 size=12
```

To reduce risks posed by the execution of untrusted binaries, enterprises environments are beginning to enforce aggressive binary authorisation policies that restrict the execution of unsigned code. Having `watchman` signed with one of Meta's Developer ID certificates would allow folks to maintain these policies without disrupting engineers' workflows.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.