[Bug]: wrongly signed binary triggers ASP protection on macos and prevents safe execution

[pdesgarets]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Installed through homebrew, calling the binary triggers a security warning

In the logs (Console.app) we see ASP: Security policy would not allow process: 37023, /opt/homebrew/Caskroom/ovhcloud-cli/0.8.1/ovhcloud

Expected Behavior

Expected : the binary is launched

Steps To Reproduce

$ brew install --cask ovh/tap/ovhcloud-cli
$ ovhcloud --help

Anything else?

codesign shows no valid Authority for the signature

$ codesign -dvvv $(which ovhcloud)
Executable=/opt/homebrew/Caskroom/ovhcloud-cli/0.8.1/ovhcloud
Identifier=a.out
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=278366 flags=0x20002(adhoc,linker-signed) hashes=8696+0 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=b61fe35cecee881481034f93fd11814188864445
CandidateCDHashFull sha256=b61fe35cecee881481034f93fd11814188864445252326753faec47bea30d8e3
Hash choices=sha256
CMSDigest=b61fe35cecee881481034f93fd11814188864445252326753faec47bea30d8e3
CMSDigestType=2
CDHash=b61fe35cecee881481034f93fd11814188864445
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements=none

[rbeuque74]

Hello @pdesgarets
Sorry for late reply.

We haven't been able to reproduce it on our MacOS here.
Would you share your MacOS version, architecture, or if you have enabled specific security options so we can reproduce it ?

Regarding binary signature, do you know if it require a CA from WebPKI (such as DigiCert, etc...), or a simple signature from the Github Actions workflow would work ?

Thanks
Romain

[drademacher-senacor]

I have the same issue with homebrew:

I am using a company macbook and have work restrictions on it. I do not know every detail of security. But it is the first time a homebrew installation has caused this issue in in the last years. I believe there is something you do different compared to other homebrew installations.

[pdesgarets]

@rbeuque74 please see https://goreleaser.com/customization/notarize/

[m-tse]

ran into same issue