We're switching the download link over to HTTPS.
Is there a reason the OSX binary needs to be signed? We don't do anything special.
Edit: HTTPS up: https://servo-builds.s3.amazonaws.com/index.html
(This comment written in Servo :P )
Is there a reason the OSX binary needs to be signed? We don't do anything special.
Edit: HTTPS up: https://servo-builds.s3.amazonaws.com/index.html
(This comment written in Servo :P )
In the latest Sierra beta I've heard you can't disable the check without an involved workaround.
It's just OSX users being lazy ;)
Can it be signed by any old cert or does it need to be part of the trust chain?
Outside of that, Gatekeeper applies to executables fetched from the Web, can be disabled (harder on Sierra), and is easy enough to bypass--and you only have to do it once per executable. If signed, the certificate does need to be trusted to count--otherwise, it'd just be a fancy checksum.
Here's the relevant tracking issue for the same problem in Rust.
Windows 10 has a similar feature.
It's unfortunate that a LetsEncrypt style project can't be done for code signing, due to malware/admin overhead.