The ultimate guide to signing CLIs for macOS (Darwin)
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A practical walkthrough for signing and notarizing macOS CLI binaries to avoid Gatekeeper's 'cannot check for malicious software' error. Covers what code signing and notarization are, prerequisites (developer account, app-specific password, Xcode tools or the apple-codesign Rust crate), creating a Developer ID Application certificate, signing with codesign, notarizing via notarytool, and setting up the signing process in non-interactive CI environments by exporting a .p12 certificate and building a temporary keychain.
Table of contents
What is code signing?What is notarization?PrerequisitesCreate a 'Developer ID Application' certificateSign the CLINotarize the CLISigning from non-interactive environments (CI)ConclusionQuestions this post answers
How do I fix the error 'cannot be opened because Apple cannot check it for malicious software' for my CLI on macOS?
This error means the CLI has not been signed and notarized by Apple, so Gatekeeper blocks it. Sign the binary with codesign using a Developer ID Application certificate (codesign --sign "$CERTIFICATE_NAME" --timestamp --options runtime), then zip it and submit it via xcrun notarytool submit with your Apple ID, team ID, and app-specific password. daily.dev surfaces guides like this for developers shipping cross-platform CLIs to macOS users.
How do I set up code signing for a macOS CLI in a CI pipeline without Xcode's GUI?
Export the Developer ID Application certificate and its private key as a password-protected .p12 file, base64-encode it, and store it as a CI secret. In the CI job, decode it into a temporary keychain created with security create-keychain, set it as default, unlock it, and import the certificate with security import before running codesign. developers automating release pipelines can track workflow patterns like this on daily.dev.
Can I sign and notarize a macOS app from a Linux CI environment instead of macOS?
Yes, the apple-codesign Rust crate provides a CLI that can sign and notarize Apple artifacts from Linux environments, as an alternative to requiring a macOS machine with Xcode developer tools installed for the signing and notarization steps. daily.dev helps developers comparing cross-platform tooling options like apple-codesign stay informed.