Notarize CoqIDE for macOS >= 10.15

[Blaisorblade]

Description of the problem

As described in https://coq.zulipchat.com/#narrow/stream/237656-Coq-devs.20.26.20plugin.20devs/topic/Testing.20the.20signed.20installers.20for.208.2E12.2E0

After installing CoqIDE on Catalina, running it gives:

“CoqIDE_8.12.0.app” can’t be opened because Apple cannot check it for malicious software.
This software needs to be updated. Contact the developer for more information.

There's no visible option to open it anyway, but the usual workaround for unsigned code (right-click + open) seems to work.

IIUC, that warning means that the software is not notarized — that is, submitted for automated review to Apple (this is not the review for the App Store). Notarization is necessary since macOS 10.15 Catalina:

https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution

One can also notarize existing software — I'm not sure if one has to update the released package, or if the notarization can be stored Apple-side.

Coq Version

I verified this for 8.12.0; @TheoWinterhalter verified this for both 8.12.0 and 8.11.1.

[Zimmi48]

From the documentation:

Notarization requires Xcode 10 or later. Building a new app for notarization requires macOS 10.13.6 or later. Stapling an app requires macOS 10.12 or later.

This means that using the current VM for signing macOS packages, we cannot notarize them, but we can "staple" them.

I found this software which could be useful for us to automate the whole process and avoid maintaining our own intricate scripts: https://github.com/mitchellh/gon

[Zimmi48]

In addition to the software I mentioned above, there also exists this under-development tool and its corresponding GitHub Action: https://cidertool.github.io/cider/

[Zimmi48]

An alternative to notarization is distributing through Apple's App Store. Since we are now doing something similar for Snap, I wonder if it wouldn't make sense to do the same for macOS (and even Windows, with the Windows Store).

[rtetley]

Triage note: working on this on the Inria side.