Release binaries: upgrade from ad-hoc signing to Apple Developer ID + notarization

[veetihietasalo]

Current state

The macOS release binary is ad-hoc signed, not Apple Developer ID signed or notarized:

$ codesign -dvv ~/.grok/bin/grok
Executable=/Users/.../.grok/bin/grok
Identifier=a.out
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=583710 flags=0x20002(adhoc,linker-signed) hashes=18238+0 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set

Key markers: Signature=adhoc, TeamIdentifier=not set.

Impact

Ad-hoc signing works (binary runs on the user's machine after curl|bash), but:

1. No Gatekeeper quarantine identity — if a user downloads the binary manually via a browser (instead of curl), macOS shows a "cannot verify the developer" warning. The install.sh path avoids this because it doesn't set the quarantine bit, but any "download and run" path hits friction.
2. No revocation path — if a signing key is ever compromised, Apple can revoke a Developer ID certificate and every installed copy stops running. Ad-hoc has no identity, so nothing to revoke.
3. No notarization — Apple's malware scan hasn't inspected the binary. Some enterprise device-management policies block un-notarized binaries outright.
4. Supply-chain assurance is weaker — a Developer ID cert ties the binary to a specific legal entity (Superagent), not just "some GitHub CI runner".

Proposed fix

Standard macOS release flow:

1. Obtain Apple Developer ID (~$99/year, requires Apple Developer Program enrollment as an organization).

2. Add signing step to release.yml for the macOS matrix entry:

   • Import certificate from CI secret (DEVELOPER_ID_CERT, DEVELOPER_ID_CERT_PWD)
   • Sign binary: codesign --sign "Developer ID Application: Superagent, Inc." --options runtime --timestamp release/grok-darwin-arm64
   • Notarize: xcrun notarytool submit release/grok-darwin-arm64 --wait --apple-id <id> --team-id <team> --password <app-specific-password>
   • Staple: xcrun stapler staple release/grok-darwin-arm64

3. Required secrets (store in Actions → Secrets):

   • APPLE_DEVELOPER_ID_CERT (base64-encoded .p12)
   • APPLE_DEVELOPER_ID_CERT_PASSWORD
   • APPLE_ID (Apple account email)
   • APPLE_TEAM_ID
   • APPLE_APP_SPECIFIC_PASSWORD

Related

• PR chore(release): add sigstore build-provenance attestations #271 adds sigstore build-provenance attestations — complementary, not a substitute. Sigstore proves "CI built this from source"; Developer ID proves "Superagent produced this binary". Both together give the strongest chain of trust.

Not planning to send as a PR

This requires:

• Apple Developer Program enrollment (costs money, requires business verification)
• Access to the org-level Secrets settings

…neither of which a contributor can do externally. Filing as an issue so the maintainer team can pick it up when the Developer ID is provisioned.

Happy to draft the release.yml diff once the secrets are in place — just tag me.