sign macOS binary releases

[boxlegs]

The biome binaries available for macOS via Homebrew / GitHub Releases are currently distributed without code signing.

codesign -dvv /opt/homebrew/bin/biome

Executable=/opt/homebrew/Cellar/biome/2.5.9/bin/biome
Identifier=biome-38b6a4ad2ae1acf7
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=656600 flags=0x20002(adhoc,linker-signed) hashes=20515+0 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements=none

To reduce risks posed by the execution of untrusted binaries, enterprises environments are beginning to enforce aggressive binary authorisation policies that restrict the execution of unsigned code. Having biome signed with a Developer ID certificate would allow folks to maintain these policies without disrupting engineers' workflows.

[nhedger]

Thanks for bringing this up.

There are two slightly different cases here:

• GitHub Releases: we build and publish these binaries ourselves. We don't currently have an Apple Developer ID certificate, but if we got one, we could sign the macOS binaries we ship.
• Homebrew Core: brew install biome uses binaries built by Homebrew from source in their own CI. Even if we had a Developer ID certificate, those binaries wouldn't be built or signed by us. They're currently ad-hoc signed, which is why there's no TeamIdentifier.

If we wanted signed binaries to also be installable through Homebrew, we'd probably need to maintain our own tap that installs the prebuilt binaries we sign ourselves.

That is doable, but it would also mean taking on quite a bit more maintenance: managing the Apple Developer account and signing credentials, updating release CI, potentially notarizing builds, maintaining another Homebrew distribution path, and keeping everything in sync across releases and architectures.

So I think the main question for us is whether there's enough demand to justify that extra maintenance.