This is a great question! For some added context, this is the tool that bootstraps the developer environment. It installs Nix and Homebrew, configures the Postg

This is a great question! For some added context, this is the tool that bootstraps the developer environment. It installs Nix and Homebrew, configures the PostgreSQL service, and so on. I also work on developer UX full time, so I had hoped code signing would be a way to make the developer experience smooth and seamless (we already pay Apple for the signing certs, after all!). > in an internal, trusted environment, why not post a "curl ... | sh" command? It's internal code, so we can't use a public (e.g.) GitHub URL, and developers running this tool may not yet have SSH keys or the VPN set up yet. > point them at the master/main.zip of the repo Basically the same issue -- developers would have to install a Rust toolchain and compile the code themselves. > Alternatively, since you're already using nixpkgs, that contains some wrappers and examples for signing Darwin binaries. It would! But this tool is what developers use to install and configure Nix in the first place, so it's not a great fit here. (Although we do have it packaged in Nix for users that already have Nix installed.)