search

haskell / ghcup-hs

https://www.haskell.org/ghcup/
GNU Lesser General Public License v3.0
271 stars 82 forks source link

ghcup mac binaries should be signed #328

Open hasufell opened 2 years ago

hasufell commented 2 years ago

In GitLab by @simonmichael on Feb 27, 2022, 05:23

On macos monterrey (12.2.1) on m1, at least, the ghcup v0.1.17.5 binary installed by ghcup upgrade didn't run because of an invalid signature (probably disrupted by stripping). This has now been worked around by not stripping them. But such unsigned binaries are probably (can't recheck on my system) hard to run because of giving the "could not check for malicious software" warning, which must be bypassed eg in System Preferences > Security & Privacy for each new ghcup version. codesign -s - BINARY seems to be a way to fix stripped binaries, adding an adhoc signature and bypassing the warning. But ideally these binaries should be signed with an official Apple developer ID, to prove they are genuine. A Haskell Foundation developer ID or similar might be ideal.

hasufell commented 2 years ago

In GitLab by @maerwald on Mar 2, 2022, 20:54

mentioned in commit 8cc333d8d52d9d542ebd1e77d8e12b9309777cc5