macOS GateKeeper support?

[nekoniaow]

On macOS with network monitoring tools such as Little Snitch installed, it is apparent during Nix installation that none of the nix binaries are signed using Apple GateKeeper system.

Here is what Little Snitch (rightly) reports:

“nix-channel” has no code signature. The executable can be maliciously modified without being detected. Click here to learn more about applications without a code signature.

The Apple registering fee (around $90) is relatively low and would allow automatic verification of the provenance of the Nix binaries by the system thus adding a layer of safety on top of Nix's.

[veprbl]

related: NixOS/nixpkgs#38624

[matthewbauer]

Yeah the only objection I would see to code signatures is that it adds impurity for bit-for-bit reproducibility but that is broken anyway on macOS for us.

[stale]

I marked this as stale due to inactivity. → More info

[stale]

I closed this issue due to inactivity. → More info

[nekoniaow]

Stale feature requests just get abandoned?
Why not simply sort them by priority instead so they have a chance to be worked on eventually?