OSX packages Unsigned

Question

theopolis · Answer

did you use ` DCMAKE OSX DEPLOYMENT TARGET=10 11` when configuring cmake

seph · Answer

Yes

theopolis · Answer

heart

seph · Answer

I did not code sign but that s a thing that requires extra options now

seph · Answer

I m not sure what scripts you re using but I ll PR the update

theopolis · Answer

I published the signed pkg to the usual place on S3 I did not add the extra signing options runtime etc since my signing VM is semi offline and runs 10 12

seph · Answer

I think that s an issue now apple s notarization process changed in feb Can t notarize without those

seph · Answer

I can sign a seph kolide though that feels like an undesirable change

theopolis · Answer

Is there a way to tell if it ll be a problem concretely I can sign again tonight perhaps

seph · Answer

Sure I Just tried notarizing it As expected it failed ``` path osquery 4 2 0 pkg osquery 4 2 0 pkg Contents Payload usr local bin osqueryd message The executable does not have the hardened runtime enabled ```

seph · Answer

I ve started a packaging repo to start playing with tools scripts in

seph · Answer

Are the scripts you use somewhere

theopolis · Answer

Last comment here <https github com osquery osquery issues 5689|https github com osquery osquery issues 5689>

seph · Answer

danke

theopolis · Answer

ok it took a series of 5min windows all day to get it resigned with the hardened runtime I will update the hash for the website PR and overwrite the 4 2 0 pkg in S3 in a sec

theopolis · Answer

It s updated if you want to try to notarize again

seph · Answer

<https pkg osquery io darwin osquery 4 2 0 pkg> has been notarized