Repository navigation
Sign macOS binaries with hardened runtime #13103
Description
Activity
Thanks for reporting this, @kgn! 🙏
The official release binaries are already signed with hardened runtime (
--options=runtime). You can verify this by downloading a release directly from https://github.com/cli/cli/releases (zip archive, not the.pkguniversal installer).For example, this is what I get on the latest release:
% codesign -dvv Downloads/gh_2.92.0_macOS_arm64/bin/gh CodeDirectory v=20500 size=294222 flags=0x10000(runtime) hashes=9189+2 location=embedded Signature size=9052 Authority=Developer ID Application: GitHub (VEKTX9H2N7) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=28 Apr 2026 at 12:30:03
The
adhoc,linker-signedoutput you're seeing is because Homebrew compilesghfrom source usinggo build, which produces an ad-hoc signed binary. Homebrew doesn't have access to our Apple Developer ID signing identity, so it can't apply hardened runtime signing.If hardened runtime is important for your setup, we'd recommend installing via our official binaries (not
.pkgthough) instead of Homebrew.I'm closing this, but feel free to comment if you think otherwise.
The macOS
ghbinary is ad-hoc signed without hardened runtime:This means any process can inject code into
ghviaDYLD_INSERT_LIBRARIESand intercept HTTP requests, including authentication headers.Developer workstations are increasingly targeted by supply chain attacks that exploit developer tooling. The
ghCLI is a high-value target because it handles GitHub API authentication.Signing with
--options runtimewould block this. macOS prevents dylib injection into hardened runtime binaries by default.codesign --sign "Developer ID Application: ..." --options runtime --timestamp ghRelated: #9139 (installer signing), #2176 (FIDO2 for API auth)