[agustingroh]

Closes #126

Why

The darwin binaries are neither signed with a Developer ID certificate nor notarized. A browser download is quarantined, so on first run Gatekeeper blocks it with "Apple could not verify scanoss-cli is free of malware" and offers only Move to Trash.

Scope

• .goreleaser.yaml: a notarize.macos block signs and notarizes the scanoss build (darwin amd64 and arm64). It runs from the existing Ubuntu runner, so no macOS runner is needed. It is enabled only when MACOS_SIGN_P12 is set, so forks and local runs are unchanged.
• release.yml: passes the five MACOS_* secrets to GoReleaser.
• release.yml: test-release-binaries checks on macOS that the published binary carries a Developer ID Application signature. The existing smoke test cannot catch this, because a gh download is not quarantined.
• CHANGELOG entry under Unreleased / Fixed.

Secrets

Already set on the repository:

Secret	Value
MACOS_SIGN_P12	Developer ID Application certificate and key (.p12, base64)
MACOS_SIGN_PASSWORD	.p12 password
MACOS_NOTARY_KEY	App Store Connect API key (.p8, base64)
MACOS_NOTARY_KEY_ID	API key ID
MACOS_NOTARY_ISSUER_ID	API issuer ID

Blast Radius

Release pipeline only. Linux and Windows archives, the libscanoss libraries and the Docker image are unchanged. A notarization failure fails the release job before anything is published, and releases are created as drafts.

Out of scope

The libscanoss .dylib files are built outside GoReleaser and remain unsigned. They need a codesign + notarytool step in build-libscanoss.yml, as a follow-up.

Verification

• goreleaser check passes.
• The .p12 decodes to Developer ID Application: SCAN Open Source Solutions SL (SS9FAM7FV6) with its private key.
• goreleaser release --snapshot --clean --skip=docker on this branch, with the same credentials, signed and notarized both darwin binaries (53s for notarization).
• Both binaries pass codesign --verify --strict with Authority=Developer ID Application: SCAN Open Source Solutions SL (SS9FAM7FV6), and the binary inside scanoss-cli-darwin-arm64.tar.gz is signed.
• A copy marked with a browser quarantine attribute ran (scanoss-cli --version) without the Gatekeeper dialog.

Release

Also cuts v0.14.2 in the CHANGELOG. Tag v0.14.2 after merge; the release job then signs and notarizes, and test-release-binaries checks the signature.