Parent: #122
The macOS fallout-agent binary is codesigned with Developer ID Application, notarized via notarytool, and stapled — so Gatekeeper allows it without operator intervention.
Definition of done
- Hardened runtime enabled (
--options=runtime).
- Signed with a Developer ID Application certificate; identity stored in repo secrets (cert + password).
- Notarized via
xcrun notarytool submit --wait; Apple ID / Team ID / app-specific password sourced from repo secrets.
xcrun stapler staple applied to the binary (or to the bottle archive, whichever Homebrew expects — confirm during implementation).spctl --assess --type execute passes on a freshly downloaded bottle on a clean macOS VM.- Custody / rotation plan for the Developer ID cert + app-specific password is captured (link from the umbrella issue).
Parent: #122
The macOS
fallout-agentbinary is codesigned with Developer ID Application, notarized vianotarytool, and stapled — so Gatekeeper allows it without operator intervention.Definition of done
--options=runtime).xcrun notarytool submit --wait; Apple ID / Team ID / app-specific password sourced from repo secrets.xcrun stapler stapleapplied to the binary (or to the bottle archive, whichever Homebrew expects — confirm during implementation).spctl --assess --type executepasses on a freshly downloaded bottle on a clean macOS VM.