Distillation

🟡 (11:49) Agent compiled full macOS binary signing research report covering Gatekeeper behavior, signing levels, quarantine flag, fossilize, Node.js SEA, and industry practices.

🟡 (11:49) Gatekeeper signing levels and outcomes (quarantined binary): (1) Unsigned — killed immediately on Apple Silicon (kernel refuses execve), "damaged"/"cannot verify" on Intel, no recovery path; (2) Ad-hoc (codesign -s -) — same as unsigned for Gatekeeper, blocked, but satisfies Apple Silicon kernel requirement; (3) Self-signed cert — "unidentified developer" dialog, user can bypass via System Settings > Privacy & Security > "Open Anyway"; (4) Developer ID no notarization — "Apple cannot check for malicious software" dialog + System Settings bypass, developer name shown; (5) Developer ID + notarization — standard "downloaded from Internet" dialog, user clicks "Open", runs immediately.

🟡 (11:49) Apple Silicon kernel detail: requires valid code signature for ANY binary at execve() time — unsigned Mach-O killed before Gatekeeper. Ad-hoc signing satisfies kernel but NOT Gatekeeper for quarantined binaries.

🟡 (11:49) Ad-hoc signing (codesign -s -): embeds SHA-256 hashes of every 4KB code page in Mach-O __LINKEDIT segment; no certificate/identity; sufficient for: Apple Silicon kernel, locally-built binaries, Homebrew-installed binaries, binaries with quarantine stripped; NOT sufficient for downloaded/quarantined binaries.

🟡 (11:49) Self-signed cert creation: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=My Code Signing" + openssl pkcs12 -export -out cert.p12 -inkey key.pem -in cert.pem -passout pass:mypassword; sign with rcodesign sign --p12-file cert.p12 --p12-password mypassword ./mybinary (cross-platform) or codesign -s "My Code Signing" --force ./mybinary (macOS only).

🟡 (11:49) com.apple.quarantine xattr: set by browsers/curl/Archive Utility on download; format 0083;TIMESTAMP;BUNDLEID;UUID; triggers Gatekeeper; without it Gatekeeper never consulted. Remove with xattr -d com.apple.quarantine ./mybinary or recursively xattr -dr com.apple.quarantine ./mybinary. Alternative: spctl --add ./mybinary (admin, adds to system-wide allowed list).

🟡 (11:49) Fossilize (BYK/fossilize) signing implementation in src/impl.ts: when sign: true for darwin-* platforms, requires rcodesign + env vars APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD, optional APPLE_API_KEY_PATH; runs rcodesign sign --team-name $APPLE_TEAM_ID --p12-file $APPLE_CERT_PATH --p12-password $APPLE_CERT_PASSWORD --for-notarization -e entitlements.plist <binary>; if `