Binaries on macOS are not notarized for GateKeeper
Describe the bug The binaries for the latest release don't appear to be signed correctly for macOS. When trying to run, I had to manually approve every single binary to be able to run rather than it being accepted automatically.
To Reproduce Steps to reproduce the behavior:
- Download v0.4.254 for macOS on a Mac
- Extract and run
devskim
Expected behavior The program should run without issue
Versions(please complete the following information):
- OS: macOS 11.6
- Devskim Version [e.g. 0.4.254]
Additional context
I haven't tried any other versions. And the first time I ran it, it ran correctly. When I wanted to run it via a call from python, I had to chmod +x devskim and then run via subprocess. That's when I started seeing it. The method of calling shouldn't make a different, but I've seen weirder things.
This is a known issue. Newer versions of Mac OS require apps be notarized - we are not able to "notarize" .NET binaries at this time due to restrictions from our signing service.
As a workaround you can install the .NET SDK and then dotnet tool install -g Microsoft.CST.DevSkim.CLI and then you'll be able to just call devskim from the terminal (this adds to the global path, you can also install it locally without the -g).