Dashboard › fossilize › Session 0QO9FwkGMGDt
0QO9FwkGMGDtvMTwxResearch the following topics and provide a detailed, practical report:
macOS Gatekeeper behavior with unsigned binaries: What exactly happens when a user tries to run an unsigned binary downloaded from the internet? What's the difference between "unsigned", "ad-hoc signed", and "self-signed"? Which of these still gets killed immediately vs. showing a dialog?
Ad-hoc signing (codesign -s -): Does ad-hoc signing help at all with Gatekeeper for downloaded binaries? What does it actually do?
Self-signed certificate signing: Can you create a self-signed certificate and sign a binary with it to avoid the immediate kill? What's the user experience difference vs. unsigned?
Apple Developer ID signing WITHOUT notarization: If you have a paid Apple Developer account but skip notarization, what happens?
Apple Developer ID signing WITH notarization: Full process — what's needed, what the user experience is.
The com.apple.quarantine extended attribute: How does this interact with each signing level? Can users bypass via xattr -d com.apple.security.quarantine?
Fossilize's sign option: What does fossilize (npm package) do when sign: true? Look at: https://www.npmjs.com/package/fossilize and https://github.com/nicolo-ribaudo/fossilize — specifically what signing capabilities it has.
Node.js SEA signing: Does Node.js itself recommend or support signing SEA binaries? Any special considerations?
Practical CI approach: How to sign macOS binaries in GitHub Actions using: a. A self-signed certificate (no Apple Developer account) b. An Apple Developer ID certificate (paid account, with notarization)
For each, detail: what secrets are needed, what CI steps, what tools, and what the end-user experience is.
What other open-source CLI tools do: How do projects like deno, bun, tailscale, cloudflared handle macOS binary signing in their CI? ...
I'll research each of these topics systematically. Let me start by gathering information from multiple sources in parallel.
Notarizing macOS software before distribution | Apple Developer Documentation # This page requires JavaScript. Please turn on JavaScript in your browser and refresh the page to view its content.
fossilize - npm skip to:[content](#main)[package search](#search)[sign in](#signin) - [Pro](/products/pro) - [Teams](/products/teams) - [Pricing](/products) - [Documentation](https://docs.npmjs.com) npm [](/) Search [Sign Up](/signup)[Sign In](/login) # fossilize  0.9.0 • Public • Published 2 days ago - [Readme](?activeTab=readme) - [Code Beta](?activeTab=code) - [11 Dependencies](?activeTab=dependencies) - [0 Dependents](?activeTab=dependents) - [16 Versions](?activeTab=versions) # Fossilize [](#fossilize) [ [Node.js](/ "Go back to the home page") --- - [About this documentation](documentation.html) - [Usage and example](synopsis.html) - [Assertion testing](assert.html) - [Asynchronous context tracking](async_context.html) - [Async hooks](async_hooks.html) - [Buffer](buffer.html) - [C++ addons](addons.html) - [C/C++ addons with Node-API](n-api.html) - [C++ embedder API](embedding.html) - [Child processes](child_process.html) - [Cluster](cluster.html) - [Command-line options](cli.html) - [Console](console.html) - [Crypto](crypto.html) - [Debugger](debugger.html) - [Deprecated APIs](deprecations.html) - [Diagnostics Channel](diagnostics_channel.html) - [DNS](dns.html) - [Domain](domain.html) - [Environment Variables](environment_variables.html) - [Errors](errors.html) - [Events](events.html) - [File system](fs.html) - [FFI](ffi.html) - ...
Let me continue gathering more information on the remaining topics.
GitHub - BYK/fossilize: Create Node SEA binaries across platforms with ease · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2FBYK%2Ffossilize)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any workflow
...
Now let me look at the actual fossilize source code for signing, and research how other OSS projects handle macOS signing.
fossilize/src at main · BYK/fossilize · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2FBYK%2Ffossilize%2Ftree%2Fmain%2Fsrc)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any workflow
](https://github.com/features/actions)
- [
...
Safely open apps on your Mac - Apple Support
- [Apple](https://www.apple.com/)
- - [Store](https://www.apple.com/us/shop/goto/store)
- [Mac](https://www.apple.com/mac/)
- [iPad](https://www.apple.com/ipad/)
- [iPhone](https://www.apple.com/iphone/)
- [Watch](https://www.apple.com/watch/)
- [Vision](https://www.apple.com/apple-vision-pro/)
- [AirPods](https://www.apple.com/airpods/)
- [TV & Home](https://www.apple.com/tv-home/)
- [Entertainment](https://www.apple.com/entertainment/)
- [Accessories](https://www.apple.com/us/shop/goto/buy_accessories)
- [Support](https://support.apple.com/?cid=gn-ols-home-hp-tab)
- [](https://support.apple.com/kb/index?page=search&locale=en_US)
- ...
Let me now look at the fossilize source code and research how other projects handle signing.
import { execFile } from "node:child_process";
import { promises as fs } from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";
import { promisify } from "node:util";
import * as esbuild from "esbuild";
import { inject } from "postject";
import type { LocalContext } from "./context";
import { getNodeBinary, resolveNodeVersion } from "./node-util";
import pLimit from "p-limit";
export interface FossilizeOptions {
readonly nodeVersion: string;
readonly platforms?: string[];
readonly assets?: string[];
readonly assetManifest?: string;
readonly outDir: string;
readonly outputName?: string;
readonly cacheDir: string;
readonly noCache?: boolean;
readonly noBundle: boolean;
readonly sign: boolean;
readonly holePunch: boolean;
readonly concurrencyLimit: number;
}
export type SEAConfig = {
main: string;
output: string;
disableExperimentalSEAWarning?: boolean;
useSnapshot?: boolean;
useCodeCache?: boolean;
assets?: ...
import type { CommandContext } from "@stricli/core";
import type { StricliAutoCompleteContext } from "@stricli/auto-complete";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
export interface LocalContext extends CommandContext, StricliAutoCompleteContext {
readonly process: NodeJS.Process;
// ...
}
export function buildContext(process: NodeJS.Process): LocalContext {
return {
process,
os,
fs,
path,
};
}
Now let me research how Deno, Bun, Tailscale, and Cloudflared handle macOS signing, plus more details on Gatekeeper behavior and the quarantine attribute.
bun/.github/workflows/release.yml at main · oven-sh/bun · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2Foven-sh%2Fbun%2Fblob%2Fmain%2F.github%2Fworkflows%2Frelease.yml)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any workflow
...
GitHub - indygreg/apple-platform-rs: Rust crates supporting Apple platform development · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2Findygreg%2Fapple-platform-rs)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any workflow
...
Now let me look at how Deno and Tailscale handle signing, and get more details on the quarantine attribute and Gatekeeper internals.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- This file should be the same as https://github.com/nodejs/node/blob/main/tools/osx-entitlements.plist -->
<plist version="1.0">
<dict>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.disable-executable-page-protection</key>
<true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<key>com.apple.security.get-task-allow</key>
<true/>
</dict>
</plist>
tailscale/Makefile at main · tailscale/tailscale · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2Ftailscale%2Ftailscale%2Fblob%2Fmain%2FMakefile)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any workflow
...
Let me get the remaining pieces of research — Deno's signing approach and cloudflared's release process.
cloudflared/Makefile at master · cloudflare/cloudflared · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2Fcloudflare%2Fcloudflared%2Fblob%2Fmaster%2FMakefile)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any workflow
...
deno compile[Skip to main content](#content) [](https://deno.com "Deno main website") [ Docs](/runtime/)[API reference](/api/)[Examples](/examples/)[Deno Deploy](/deploy/) ⌘K ↑↓Up or down tonavigate↵Enter toselectESCEscape toclose Toggle Theme Toggle navigation menu ## Getting started - [Welcome to Deno](/runtime/) - [Installation](/runtime/getting_started/installation/) - [First project](/runtime/getting_started/first_project/) - [Setup your environment](/runtime/getting_started/setup_your_environment/) - [Command line interface](/runtime/getting_started/command_line_interface/) ## Fundamentals - [TypeScript](/runtime/fundamentals/typescript/) - [Node](/runtime/fundamentals/node/) - [Migrating from Node](/runtime/fundamentals/migrate_from_node/) - [Security](/runtime/fundamentals/security/) - [Modules and dependencies](/runtime/fundamentals/modules/) - [Configuration](/runtime/fundamentals/configuration/) - [Web ...
node/doc/api/single-executable-applications.md at main · nicolo-ribaudo/node · GitHub
[Skip to content](#start-of-content)
## Navigation Menu
Toggle navigation
[](/)
[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2Fnicolo-ribaudo%2Fnode%2Fblob%2Fmain%2Fdoc%2Fapi%2Fsingle-executable-applications.md)
Appearance settings
- Platform
- AI CODE CREATION
- [
GitHub CopilotWrite better code with AI
](https://github.com/features/copilot)
- [
GitHub Copilot appDirect agents from issue to merge
](https://github.com/features/ai/github-app)
- [
MCP RegistryNewIntegrate external tools
](https://github.com/mcp)
- DEVELOPER WORKFLOWS
- [
ActionsAutomate any ...
Now I have comprehensive information from all sources. Let me compile the full report.
Gatekeeper is triggered by the quarantine flag (com.apple.quarantine), an extended attribute automatically applied by macOS-aware download tools (browsers, curl in some contexts, git clone in some cases, Archive Utility, etc.). When a user tries to execute a quarantined binary, Gatekeeper checks:
| Level | What it is | Gatekeeper result (quarantined binary) |
|---|---|---|
| Unsigned | No code signature at all | Killed immediately with no dialog. On Apple Silicon, the binary literally cannot execute — the kernel refuses it. On Intel, macOS shows "damaged" or "cannot verify" and blocks it. |
| Ad-hoc signed (codesign -s -) | A signature with no identity — just a hash of the code pages. No certificate involved. | Same as unsigned for Gatekeeper purposes. Gatekeeper does not distinguish ad-hoc from unsigned. The binary is blocked with "cannot be opened because Apple cannot check it for malicious software" or killed immediately. |
| Self-signed certificate | Signed with a certificate you created yourself (not from Apple). | Blocked with a dialog — "cannot be verified" / "unidentified developer." The user CAN go to System Settings > Privacy & Security > "Open Anyway" to allow it. This is the key difference from unsigned/ad-hoc: the user gets a path to override. |
| Developer ID (no notarization) | Signed with Apple-issued Developer ID certificate. | Dialog shown: "Apple cannot check it for malicious software." User can go to ...
<observations> Date: June 9, 2026 * 🟡 (11:49) Agent compiled full macOS binary signing research report covering Gatekeeper behavior, signing levels, quarantine flag, fossilize, Node.js SEA, and industry practices. * 🟡 (11:49) Gatekeeper signing levels and outcomes (quarantined binary): (1) Unsigned — killed immediately on Apple Silicon (kernel refuses execve), "damaged"/"cannot verify" on Int…
<observations> Date: June 9, 2026 * 🟡 (11:49) Agent fetched cloudflare/cloudflared Makefile (master branch, 297 lines / 248 loc, 9.04 KB) * 🟡 (11:49) cloudflared Makefile VERSION line: `VERSION := $(shell git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")` * 🔴 (11:49) User stated VERSION match pattern is always `--match "[0-9][0-9][0-9][0-9].*.*"` (4-digit year prefix tag format…
<observations> Date: June 9, 2026 * 🟡 (11:46) Agent fetched macOS entitlements plist (same as nodejs/node tools/osx-entitlements.plist): com.apple.security.cs.allow-jit=true, com.apple.security.cs.allow-unsigned-executable-memory=true, com.apple.security.cs.disable-executable-page-protection=true, com.apple.security.cs.allow-dyld-environment-variables=true, com.apple.security.cs.disable-library…
<observations> Date: June 9, 2026 * 🟡 (11:46) Agent fetched oven-sh/bun .github/workflows/release.yml (368 lines, 12.9 KB) — full content reviewed * 🟡 (11:46) bun release.yml env vars: BUN_VERSION set from github.event.inputs.tag OR github.event.release.tag_name OR 'canary'; BUN_LATEST set from github.event.inputs.is-latest OR github.event.release.tag_name * 🟡 (11:46) bun release.yml triggers…
<observations> Date: June 9, 2026 * 🟡 (11:46) Agent fetched fossilize src/impl.ts — full source reviewed; key implementation details below * 🟡 (11:46) impl.ts imports: node:child_process (execFile), node:fs (promises), node:path, node:url (fileURLToPath), node:util (promisify), esbuild, postject (inject), p-limit; local imports: LocalContext, getNodeBinary/resolveNodeVersion (node-util), pLimi…
Date: June 9, 2026 * 🟡 (11:46) Agent fetched BYK/fossilize GitHub repo page — confirmed: 20 stars, 1 fork, 1 watcher, 3 open issues, 0 pull requests, 10 releases (latest: 0.9.0, Jun 7, 2026), 55 commits on main branch, TypeScript 96.9% / JavaScript 3.1% * 🟡 (11:46) fossilize repo src/ directory contents: bin/ (subdirectory), app.ts, archive-util.ts, context.ts, env-to-bool.ts, impl.ts, index.t…
<observations> Date: June 9, 2026 * 🔴 (11:46) User stated goal: wants a single-executable Node.js application * 🔴 (11:46) User asked "I need `fossilize`?" — questioning whether fossilize is necessary for their use case * 🔴 (11:46) User stated: wants to include a bundler; both `esbuild` and `rollup` have native components (this is a blocker for fossilize being a SEA itself, and relevant to use…
<observations> Date: June 9, 2026 * 🟡 (11:46) User asked for detailed research report on macOS binary signing and Gatekeeper behavior, covering 10 topics: 1. Gatekeeper behavior with unsigned binaries (unsigned vs. ad-hoc vs. self-signed differences; which get killed vs. show dialog) 2. Ad-hoc signing (`codesign -s -`) — whether it helps with Gatekeeper for downloaded binaries 3. Self-sig…