Mac OS use of Notary CLI fails due to lack of developer verification

[toddysm]

After downloading notation CLI from the releases, starting it failed with error that developer cannot be verified. The workaround is to allow the binary in the security settings but even then another prompt is shown to confirm that the user wants to run it.

We need to improve the experience for Mac OS developers.

[toddysm]

The best approach we can take for installation on Mac is to use Brew. Installation via Brew will avoid users seeing security prompts suggesting deleting the binary.

[priteshbandi]

Other way to handle this is start singing binary for macOS

[yizha1]

Update the milestone to rc-3 based on the discussion.

[mintbomb27]

I kinda looked into this, and what I found was that as per the two ways to go about this:

1. To sign the binaries, we'll need an Apple Developer Program account, and we can follow the procedure at https://developer.apple.com/developer-id/ , and can even get the binary notarized.
2. Using homebrew we can either create a third party repository for homebrew, aka a tap. Through which the users will be able to install using brew tap org/repo and brew install notation, or else we can submit a PR to https://github.com/Homebrew/homebrew-core/ so that its not a third party repo.

I don't have an ADP account currently, but I'm free to take up the homebrew method mentioned if y'all agree with it. @yizha1 @toddysm

[yizha1]

@mintbomb27 Thanks. IMO the 2nd option is the way to go. Adding @shizhMSFT @FeynmanZhou for comments.

[FeynmanZhou]

@mintbomb27 Hi, the 2nd is doable. I think you can follow the guideline of https://docs.brew.sh/Adding-Software-to-Homebrew to complete this submission. I also raised a separate issue #571 to track this plan.

However, Homebrew only allows accepting a stable release package and any alpha/RC release is not acceptable. So we still need to defer this implementation until a stable Notation CLI v1.0.0 release is available, which is mid of Apr. Before v1.0.0, we need to provide a workaround in a document for installing Notation on macOS.

How about we assign #571 to you first?

[mintbomb27]

Sure, please go ahead. @FeynmanZhou

[yizha1]

duplicated with #571

[yizha1]

@toddysm can we close this one as duplicated with #571

[toddysm]

Sure, closing.