Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] macOS app installer Notarization #6387

Open
DavidRvrsR3 opened this issue Jan 6, 2025 · 0 comments
Open

[SECURITY] macOS app installer Notarization #6387

DavidRvrsR3 opened this issue Jan 6, 2025 · 0 comments
Labels

Comments

@DavidRvrsR3
Copy link

Describe the security issue
A clear and concise description of what the security issue is. Ex. Security scan reports "specific library" is vulnerability to these CVEs.
In order to install the application on secured macOS devices it would greatly help if the app would be noterized by Apple.
https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution

Vulnerability Location
Is this a vulnerability in a 3rd party library or the Connect codebase itself?
NTA

Environment (please complete the following information if it is applicable to the issue)

  • OS: [e.g. Linux (CentOS), Windows 10, MacOS]
  • Java Distribution/Version [e.g. OpenJDK 11, Java 8 (201)]
  • Connect Version [e.g. 3.8.0]
    macOS

Suggested remediation
Recommendations on how to fix vulnerability. Ex. Update library to version "x.x.x".
Get an Apple Developer account and get the app Notarized by Apple.

Additional context
Add any other context about the problem here.
The latest macOS version come with Gatekeeper. It is a safety best practice to only allow Notarized apps by Apple or App store apps. Notarize your macOS software to give users more confidence that the Developer ID-signed software you distribute has been checked by Apple for malicious components

@DavidRvrsR3 DavidRvrsR3 changed the title [SECURITY] Your Issue Title [SECURITY] macOS app installer Notarization Jan 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant