MacOS Binaries need to be notarized

[MylesBorins]

I can't wrap my head around why, but when testing the MacOS built binaries on my local machine it take many seconds to start. This is not the case with a locally built binary using the exact same commands. I'm confused

[devsnek]

Does it happen on any other platform? MacOS pings apple's servers when an unknown binary is exec()'d and that can take a few seconds.

[MylesBorins]

@devsnek that sounds like it could be a reasonable explanation. Do we need to notarize the binaries to avoid this?

[devsnek]

I don't really know that much about it. If you have a Linux x64 build I can test it to see if it's also slow.

[solumos]

The Windows binary appears to be OK, in case anyone was wondering

[MylesBorins]

I just confirmed that the node.js binary is similarly slow on 10.15.6... so this is definitely a notarization thing 😭

Looks like we need a developer account in order to get notarization working. Almost feels like it would be easier to get jstime into homebrew for binary distribution than to work out how to get notarization working in CD.

[MylesBorins]

Found some good documentation on how some other folks automate notarization with actions

https://www.kencochrane.com/2020/08/01/build-and-sign-golang-binaries-for-macos-with-github-actions/

Seems like gon is a widely used tool to automate notarization

https://github.com/mitchellh/gon

Some existing code from the nodejs repo that they use to notarize the Node.js pkg installer

https://github.com/nodejs/node/blob/master/tools/osx-productsign.sh
https://github.com/nodejs/node/blob/master/tools/osx-codesign.sh
https://github.com/nodejs/node/blob/master/tools/osx-entitlements.plist
https://github.com/nodejs/node/blob/master/tools/osx-gon-config.json.tmpl
https://github.com/nodejs/node/blob/master/tools/osx-notarize.sh

[MylesBorins]

I did some more research + testing... simply moving the binary out of the downloads folder is enough to stop the slow down. Even weirder, moving it out of the download folder and back also stops the slow down. WAT.

The node.js binary is also affected by this, and has the same solution when moved from download folder.