macOS 10.15 requires code signing

[Tom Kornack]

macOS 10.15 requires that all software including command line tools be signed and notarized by the developer.

Without code signing, authorization of each command line tools can be manually approved by the user in System Preferences; however, loading a shared library presently cannot be authorized by a user in a straightforward manner. Users may find an error such as this error issued when using ld:

/usr/local/gcc-arm-none-eabi-8-2018-q4-major/bin/../lib/gcc/arm-none-eabi/8.2.1/../../../../arm-none-eabi/bin/ld: /usr/local/gcc-arm-none-eabi-8-2018-q4-major/bin/../lib/gcc/arm-none-eabi/8.2.1/liblto_plugin.so: error loading plugin: dlopen(/usr/local/gcc-arm-none-eabi-8-2018-q4-major/bin/../lib/gcc/arm-none-eabi/8.2.1/liblto_plugin.so, 2): no suitable image found. Did find:
/usr/local/gcc-arm-none-eabi-8-2018-q4-major/bin/../lib/gcc/arm-none-eabi/8.2.1/liblto_plugin.so: code signature in (/usr/local/gcc-arm-none-eabi-8-2018-q4-major/bin/../lib/gcc/arm-none-eabi/8.2.1/liblto_plugin.so) not valid for use in process using Library Validation: Library load disallowed by System Policy
collect2: error: ld returned 1 exit status

This was tested using the 8-2018q4-major release on a MacBook Pro. To reproduce the issue, install and try to run any of the binaries without any inputs.

It is possible to sign using the macOS codesign command line tool. For notarization the signed binary must be submitted to Apple and the result stapled to the distribution. One of many summaries is

https://successfulsoftware.net/2018/11/16/how-to-notarize-your-software-on-macos/

macOS 10.15 will be released around the end of summer 2019. Perhaps this new requirement has already been anticipated by the developers. Thank you all for your hard work!

[Tom Kornack (kornack)]

This issue remains in the 10.15 release, but it is now possible to manually whitelist each executable, including the share libraries.

[Przemyslaw Wirkus (wirkus)]

Hi,
Although this is still under discussion I can let you know that we are working on to include with our next official GNU Embedded toolchain release MacOS 10.14 and 10.15 signed (by Arm) packages.

kind regards
Przemek