Skip to content

Code-sign and notarise release binaries #32

Description

@piers-sinclair

Problem

The published Windows and macOS binaries are unsigned and un-notarised. Windows SmartScreen warns with "unknown publisher"; macOS Gatekeeper blocks or warns on first run.

Impact

Install friction for users, and no cryptographic guarantee of publisher identity (easier to spoof a malicious build as "cpool").

Fix

  • Authenticode-sign the Windows .exes before zipping (e.g. Azure Trusted Signing or a code-signing cert).
  • Sign + notarise + staple the macOS binaries (codesign, xcrun notarytool submit, xcrun stapler staple).
  • Do this in release.yml after dotnet publish, before zip.

Priority: Medium — acceptable to defer for a hobby CLI; required before shipping anything like this at work.

Metadata

Metadata

Assignees

No one assigned

    Labels

    securitySecurity hardening

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions