mac binaries not codesigned for 1.2

[ViralBShah]

The mac binaries are not code signed for 1.2. I believe the 1.3 binaries for mac are also not code signed.

@ararslan suggests that in the builder, we should probably error out if the code signing step fails (or have some other solution to make mac signing more robust).

[dgleich]

Note that this throws an "unidentified developer" error on macOS, which is what I was googling and searching for to see if anyone had reported this already. (https://discourse.julialang.org/t/julia-1-2-not-signed-correctly-on-macos/28396)

More specifically, the full error is (for future Google-ability)

“Julia-1.2” can’t be opened because it is from an unidentified developer.

Your security preferences allow installation of only apps from the App Store and identified developers.

Also, note that you can still launch Julia by using Finder to browse to the Applications directory. Then right click on Julia, and click Open. This will allow you to override the unidentified developer prompt.

---

For what it's worth, I agree with erroring in the build if this fails. There have been enough man-in-the-middle attacks on open source projects on various platforms (e.g. look at the Handbrake scenario a few years ago -- https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2017/05/handbrake-hacked-to-drop-new-variant-of-proton-malware/), that this really did make me worry I had a tampered download.

[ararslan]

Apparently the issue is that our code signing certificate expired.

[ViralBShah]

Cc @mdpradeep

[ViralBShah]

@staticfloat @ararslan Please close this if new signed binaries are up.

[ViralBShah]

The 1.0.5 binaries also say "can't be opened because it is from an unidentified developer".

[ararslan]

That's bizarre, because I checked the signing for 1.0.5 before uploading. 😕

[staticfloat]

Did you clear the fastly cache? The curl -X PURGE thing?

…

On Sat, Sep 14, 2019 at 09:04 Alex Arslan ***@***.***> wrote: That's bizarre, because I checked the signing for 1.0.5 before uploading. 😕 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#33141?email_source=notifications&email_token=AAA762AHBKEX5NPRMRETEDTQJUDPJA5CNFSM4ITDVFVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6W6UXQ#issuecomment-531491422>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAA762FRU3OAN2LQRSKNEDLQJUDPJANCNFSM4ITDVFVA> .

[ararslan]

I did for all 1.0-latest URLs, yeah

[staticfloat]

Okay, I think I uploaded the unsigned 1.0.5 after signing it. I've re-uploaded a properly signed .dmg; try again.

[mbauman]

This is now fixed — both the 1.0 and 1.2 binaries are properly signed (but folks on 10.15 Catalina will start seeing issue #33331).