- https://brew.sh (Download and run an unsigned script.)
- https://atom.io/download/mac (Binary not signed.)
- https://emacsformacosx.com/builds (Binaries are not signed.)
Is there any way to safely get such tools? At the moment I just need an HTML editor.
- atom and emacs are both signed with a Developer ID certificate issued from Apple. macOS doesn't even let you run unsigned binaries downloaded from the internet by default. You can confirm using:
$ codesign -vv ~/Downloads/Atom.app # verify
$ codesign -dvv ~/Downloads/Atom.app # display signature infoI right-clicked the apps and clicked "Get Info", found no signature info, and assumed there are no sigs. Double-clicking shows a scary warning about the app being downloaded from the Internet, with no signature information. Do you have any idea why Apple decided not to show signatures?
Then there is the "designated requirement", which allows you to determine what requirements there are on code signatures. Some resources could be optional (eg. so that thinning the bundle by stripping 32bit code wouldn't invalidate the signature). The designated requirement can also be overridden by the OS (Apple has made it a lot stricter over the years, eg. unsigned resources in a subfolder are no longer allowed).
Finally, sandbox entitlements are also embedded in the code signature, making sure that you can't change sandbox permissions without invalidating the signature (and re-signing).
For the user, all that matters is whether the code signature meets the designated requirement (ie. is it valid) or not. I guess Apple could have shown the identity of the developer who signed it, but since they don't do extensive identity verification when you sign up for a developer account, that would just be an opportunity for abuse...
If you want to know more about the code signature + sandbox permissions of an app, I recommend the excellent "RB App Checker Lite" [1], but unfortunately it seems that it is no longer maintained.
I use littlesnitch and ClamXav as an extra security measure, along with what the OS brings but as far as CLI third party tools go, we are all blind: pip, npm, gems, random prexompiled go apps, docker containers and te list goes on and on...