DevSkim icon indicating copy to clipboard operation
DevSkim copied to clipboard

Binaries on macOS are not notarized for GateKeeper

Open dalemyers opened this issue 3 years ago • 1 comments

Describe the bug The binaries for the latest release don't appear to be signed correctly for macOS. When trying to run, I had to manually approve every single binary to be able to run rather than it being accepted automatically.

To Reproduce Steps to reproduce the behavior:

  1. Download v0.4.254 for macOS on a Mac
  2. Extract and run devskim

Expected behavior The program should run without issue

Versions(please complete the following information):

  • OS: macOS 11.6
  • Devskim Version [e.g. 0.4.254]

Additional context I haven't tried any other versions. And the first time I ran it, it ran correctly. When I wanted to run it via a call from python, I had to chmod +x devskim and then run via subprocess. That's when I started seeing it. The method of calling shouldn't make a different, but I've seen weirder things.

dalemyers avatar Oct 12 '21 10:10 dalemyers

This is a known issue. Newer versions of Mac OS require apps be notarized - we are not able to "notarize" .NET binaries at this time due to restrictions from our signing service.

As a workaround you can install the .NET SDK and then dotnet tool install -g Microsoft.CST.DevSkim.CLI and then you'll be able to just call devskim from the terminal (this adds to the global path, you can also install it locally without the -g).

gfs avatar Oct 12 '21 16:10 gfs