kn binary needs to be signed for Mac OS X

[maximilien]

Feature request

Current kn-darwin-amd64 binary artifact for Mac OS X is not signed. This means that a user that downloaded this binary is not able to "easily" use it on their Mac OS X machine.

If they try to execute the current binary they are prompted with the following dialog box.

The way out of this is to open Finder and right-click on the binary and choose "open". Then you get an additional option in this dialog "open". Chose that, and then you can run the binary also from the CLI.

Technical Note 2206 on the Apple Developer web site details how to do this. Particularly the recipe above table 2. We (Knative or Client team) will likely need to get an identify from a trusted certificate authority.

This is clearly an annoyance for Mac OS X users that need to be resolved by properly signing our Mac OS X deliverables. This is also likely an issue for any CLI produced by any Knative working group.

afterwards.

Executable for Mac OS X, in our case: kn-darwin-amd64 just works without initial or subsequent additional steps from users.

Use case

1. download kn-darwin-amd64
2. open terminal window
3. type ~/Download/kn-darwin-amd64 version
4. above should work w/o any prompts

UI Example

N/A

/kind bug
/kind cleanup

[maximilien]

cc @navidshaikh @rhuss

[rhuss]

As @dsimansk found out it's the matter who and how you download the binary. See https://discourse.brew.sh/t/code-signing-installed-executables/2131/15 . E.g. when you download with curl -O -LCopy and chmod a+x then it works out of the box.

I wonder whether it wouldn't be better to relase as tar.gz or zip archives with a single binary which would trick browsers ? This would also have the advantage that we already have the proper name when extracting the archive (and we save all that signing hassle).

The user needs to perform an extra action after download anyway. Either mv knative-something kn or now tar xvf knative-something.tgz (directly within the bin dir).

Wdyt should we adapt our release process accordingly ?

[dsimansk]

From my further tests, archives like .tar.gz and .zip are flagged by browser with com.apple.quarantine attribute as well. The important part is what tools is used to unpack the archive. The build-in MacOS's tar will preserve the attributes on unpack, therefore the binary is still unable to run without further actions. However, that's not the case for GNU tar available from brew as "gnu-tar".

Current possible workarounds:

• curl -O -L <ur-to-kn> and chmod a+x /path/to/bin etc.
• Download via browser and one of :
  • xattr -d com.apple.quarantine /path/to/bin
  • Navitage to Security setting and allow the binary upon initial run.

[rhuss]

Where do we stand with this issue ? Do we have a plan, e.g. which cert could sign our binaries so that the workaround mentioned above would not be needed anymore? // @navidshaikh @dsimansk

[navidshaikh]

Signing needs to happen in test-infra before publishing the release binaries (can be done for Windows binary as well with macOS).

@chaodaiG @chizhg WDYT about feasibility of this and required certs?

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[chizhg]

Signing needs to happen in test-infra before publishing the release binaries (can be done for Windows binary as well with macOS).

@chaodaiG @chizhg WDYT about feasibility of this and required certs?

@navidshaikh is this still an issue? Can you sign the release binaries in the build_release function - https://github.com/knative/client/blob/master/hack/release.sh#L23? If not what is missed now?

[rhuss]

@navidshaikh Not really sure about the mechanics of signing, but i guess we would need a certificate for this that is signed by Apple ? I know we have something for OpenShift Serverless (so, the kn binaries in OpenShift are signed)

@chizhg Do we have a "knative.dev" cert for performing the signing ? If not would be curious what need to be done to get one ...