Repository navigation
macOS Installer Requires Notarization To Be Run Under Catalina and Beyond #29216
Description
Activity
Reading through Customizing the Notarization Workflow, it sounds like it'd be a major PITA to integrate with our release process. Thanks, Apple!
I'm also facing the same problem. My package file bundle nodejs .PKG file. Now when I try to notarize my package file, apple rejects the package file saying it as invalid one. The below errors are coming in logs:
/node-v8.11.3.pkg/node-v8.11.3.pkg Contents/Payload/usr/local/bin/node",
"message": "The signature algorithm used is too weak.",These requirements do not apply to Homebrew, right? If Apple's processes prove too tricky, maybe we should make that the recommended installation method.
Transferring responsibility for distribution to package managers is, indeed, one answer to a fundamental requirement of the modern computing landscape.
I also ship an app that has
nodebundled inside the app bundle, depending on Homebrew is not a viable solution for me.Will the Node.js foundation ship a hardened (optionally also notarized) copy of Node.js soon, in time for the release of MacOS Catalina?
Reacted by Tyler Smalley, MajuMadhusudanan, Jason Tedor, Somesh Chatterjee, Fatima Ijaz, 流浪大法师, Matt Bishop, adnanalawiyat, Alex and Austin ReppApple has announced that Catalina will be coming in October. It would be great to hear from the OpenJS Foundation to understand if they intend on notarizing the macOS Binary.
perhaps we should just recommend people install via brew/n/nvm/etc, easier to upgrade that way anyway.
@devsnek, unfortunately, that isn't an option for folks who ship a version of Node in their software as myself and multiple folks on this thread do.
It's also relying on an assumption that Homebrew won't add the quarantine extended attribute that causes Gatekeeper to enforce signing/notarization requirements. Note that applications installed by Homebrew Cask do get the quarantine extended attribute.
Yea and resigning / hardening the node binary also doesn't work. As node tries to validate the signature and terminates if it's signed with any other certificate
sorry I don't know much about this packaging... Why can't you just bundle the node binary itself?
Node binary terminates without providing any details as to why, when I try to codesign the binary with a different cert.
53 remaining items
This should be closed now, the latest 10.x and 12.x releases went out yesterday with notorization right?
I'll leave this pinned for a few days for visibility. Node.js 10.20.0, 12.16.2 and 13.12.0 are all notarized.
- unpinned this issue
on Apr 13, 2020
Catalina and beyond refuse to execute installer package (because of lack of notarization). It is possible to circumvent this but the procedure is not discoverable and shouldn't be expected of normal users.
It is unlikely even this current work-around will be permitted in future versions of macOS. The installer package should either conform to platform security requirements or be removed from the distributions list entirely.