Sign & notarize OSX executable of PIE

[asgrim]

#443 - slated for 1.4.0 release - introduces an experimental executable version of PIE. However, this does not immediately run on OSX platforms, as it seems binaries have to go through some kind of Apple signature process. For this, we would need to get an Apple Developer account (a.k.a Apple tax) at $99/yr, and then set up CI to sign the executable as part of the process.

As per thread #443 (comment) there are a few potentially helpful resources here:

• https://users.rust-lang.org/t/distributing-cli-apps-on-macos/70223/12
• GitHub Actions workflow to build and sign macOS binary executables simonw/datasette#1171
• @shyim set a similar thing up on https://github.com/anchore/quill

[asgrim]

FWIW, it seems this is only really an issue if you try to run PIE from the GUI. I was able to successfully download and run PIE on an ARM64 Mac by doing:

$ wget <the url>
$ gh attestation verify --owner php pie-macOS-ARM64
$ chmod +x pie-macOS-ARM64
$ ./pie-macOS-ARM64 -v

My initial impressions are that this probably doesn't need to be done then? 🤔 Feedback welcome.

[theofidry]

Worked for me for 1.3.3 (the wget steps).

[asgrim]

@theofidry the 1.3.3 doesn't have a binary release yet 🥰 you'd have to use the "nightly" build:

https://github.com/php/pie/blob/1.4.x/docs/usage.md#executable-pie-experimental

For ARM Mac it would be https://php.github.io/pie/pie-macOS-ARM64

[theofidry]

Same result: the binary was executed without any extra work.

[asgrim]

Thank you! 🥰