DevSkim
DevSkim copied to clipboard
Binaries on macOS are not notarized for GateKeeper
Describe the bug The binaries for the latest release don't appear to be signed correctly for macOS. When trying to run, I had to manually approve every single binary to be able to run rather than it being accepted automatically.
To Reproduce Steps to reproduce the behavior:
- Download v0.4.254 for macOS on a Mac
- Extract and run
devskim
Expected behavior The program should run without issue
Versions(please complete the following information):
- OS: macOS 11.6
- Devskim Version [e.g. 0.4.254]
Additional context
I haven't tried any other versions. And the first time I ran it, it ran correctly. When I wanted to run it via a call from python, I had to chmod +x devskim
and then run via subprocess. That's when I started seeing it. The method of calling shouldn't make a different, but I've seen weirder things.
This is a known issue. Newer versions of Mac OS require apps be notarized - we are not able to "notarize" .NET binaries at this time due to restrictions from our signing service.
As a workaround you can install the .NET SDK and then dotnet tool install -g Microsoft.CST.DevSkim.CLI
and then you'll be able to just call devskim
from the terminal (this adds to the global path, you can also install it locally without the -g).