Feature request: Notarize the MacOS binaries in the pipeline

Notarize the MacOS binaries in the pipeline

When installing the Openshift Client on MacOS the Gatekeeper warns that the binary is untrusted and blocks it.
Users then have to go into the settings and overrule the block.
The process is pretty involved every update and may lead to users disabling safety features on their devices.

Related RedHat blog post about it by @DonSchenck

Suggested solution

Integrating this tool in the pipeline submits the binaries to Apple for verification (malware checks etc)
https://github.com/Bearer/gon

Requirements to fix this issue

• An Apple developer account
• Knowledge of the build process (upstream at RedHat?) (a.k.a. the magic that puts everything at mirror.openshift.com)

The steps users have to take if they don't want to disable security settings

1. oc gets updated (by manual download or with Brew)
2. User tries to use it. (Or opens a new terminal and it gets used for shell completion)
3. A warning message appears and the user clicks Done

4. User opens System settings and finds the Security menu.
5. User resets/overrules the warning.

6. User tries to use oc again. Warning reappears.

7. User uses administrator/sudo rights to ignore the warning and stops being bothered until the next update.

Start by tracing the Go build and release pipeline that publishes binaries to mirror.openshift.com, then review how gon could submit the macOS artifacts for Apple verification. Done means released macOS binaries are notarized and no longer trigger the described Gatekeeper warnings; confirm the required Apple developer account and credentials handling as part of the pipeline design.