Problem
The published Windows and macOS binaries are unsigned and un-notarised. Windows SmartScreen warns with "unknown publisher"; macOS Gatekeeper blocks or warns on first run.
Impact
Install friction for users, and no cryptographic guarantee of publisher identity (easier to spoof a malicious build as "cpool").
Fix
- Authenticode-sign the Windows
.exes before zipping (e.g. Azure Trusted Signing or a code-signing cert).
- Sign + notarise + staple the macOS binaries (
codesign, xcrun notarytool submit, xcrun stapler staple).
- Do this in
release.yml after dotnet publish, before zip.
Priority: Medium — acceptable to defer for a hobby CLI; required before shipping anything like this at work.
Problem
The published Windows and macOS binaries are unsigned and un-notarised. Windows SmartScreen warns with "unknown publisher"; macOS Gatekeeper blocks or warns on first run.
Impact
Install friction for users, and no cryptographic guarantee of publisher identity (easier to spoof a malicious build as "cpool").
Fix
.exes before zipping (e.g. Azure Trusted Signing or a code-signing cert).codesign,xcrun notarytool submit,xcrun stapler staple).release.ymlafterdotnet publish, beforezip.Priority: Medium — acceptable to defer for a hobby CLI; required before shipping anything like this at work.