3 ms·

How can it tell you've compiled it and haven't just signed it yourself? Or does it only check signatures when you're launching things from the GUI?

by swiley 7y ago

Angostura 7y ago
Or does it only check signatures when you're launching things from the GUI? Yes. If you;re tinkering with Homebre, you are not the target demographic.
- swiley 7y ago
  So you could easily install a graphical shell that doesn't check that. heh people probably need to chill out about all this. I got a mechanical engineering student (read: "doesn't understand computers") to play open arena with me the other month dispite all of this. It's just a couple buttons you have to press.
- flohofwoe 7y ago
  ...which makes it all the more annoying for "power users" that there's no simple switch anymore to allow all apps to run without the scare/confirmation popups (there used to be a third option in "Security & Privacy" settings next to "App Store" and "App Store and identified developers" for this).
  - my123 7y ago
    That third option is hidden in the GUI, but can be re-enabled via: sudo spctl --master-disable
  - Angostura 7y ago
    I use quite a few applications that aren't from the App store. I've had 'App store and identified developers' as my default for ever and I've come across, possibly three? unidentified developers in the last three years. It's not a massive inconvenience and to be honest, I welcome the 'Hmmm - its not signed' pause for thought.
jmull 7y ago
The check happens at a lower level than the Finder, I believe. I think it checks things with the quarantine flag set on the executable or app. This is set by your browser and other similar software when downloading an app. Once cleared, the notarization check isn't done. Brew doesn't set the quarantine flag in the first place as far as I know.
- jleedev 7y ago
  brew cask quarantines, but not regular brew.
sjwright 7y ago
I don't know how Catalina works specifically, but if I was designing for this contingency I'd have it so that any software compiled locally by a user with sudo rights would be automatically notarized against a localhost certificate.
delinka 7y ago
It doesn't need to know that. When you use a GUI app to download an app (web browser, for example), the executable is marked 'quarantine.' When you build an app yourself, it doesn't get marked 'quarantine.' Items marked 'quarantine' get the "Are you sure?" (or "you can't" or "find another way" or whatever) dialog.

How can it tell you've compiled it and haven't just signed it yourself? Or does it only check signatures when you're launching things from the GUI?

by swiley 7y ago

How can it tell you've compiled it and haven't just signed it yourself? Or does it only check signatures when you're launching things from the GUI?

Angostura 7y ago

Or does it only check signatures when you're launching things from the GUI? Yes. If you;re tinkering with Homebre, you are not the target demographic.

swiley 7y ago
So you could easily install a graphical shell that doesn't check that. heh people probably need to chill out about all this. I got a mechanical engineering student (read: "doesn't understand computers") to play open arena with me the other month dispite all of this. It's just a couple buttons you have to press.
flohofwoe 7y ago
...which makes it all the more annoying for "power users" that there's no simple switch anymore to allow all apps to run without the scare/confirmation popups (there used to be a third option in "Security & Privacy" settings next to "App Store" and "App Store and identified developers" for this).
- my123 7y ago
  That third option is hidden in the GUI, but can be re-enabled via: sudo spctl --master-disable
- Angostura 7y ago
  I use quite a few applications that aren't from the App store. I've had 'App store and identified developers' as my default for ever and I've come across, possibly three? unidentified developers in the last three years. It's not a massive inconvenience and to be honest, I welcome the 'Hmmm - its not signed' pause for thought.

jmull 7y ago

The check happens at a lower level than the Finder, I believe. I think it checks things with the quarantine flag set on the executable or app. This is set by your browser and other similar software when downloading an app. Once cleared, the notarization check isn't done. Brew doesn't set the quarantine flag in the first place as far as I know.

jleedev 7y ago
brew cask quarantines, but not regular brew.

sjwright 7y ago

I don't know how Catalina works specifically, but if I was designing for this contingency I'd have it so that any software compiled locally by a user with sudo rights would be automatically notarized against a localhost certificate.

delinka 7y ago

It doesn't need to know that. When you use a GUI app to download an app (web browser, for example), the executable is marked 'quarantine.' When you build an app yourself, it doesn't get marked 'quarantine.' Items marked 'quarantine' get the "Are you sure?" (or "you can't" or "find another way" or whatever) dialog.