Macvim: Sign MacVim Builds

[cycloon]

It looks like MacVim.app is not signed. I get "MacVim.app can't be opened because it is from an unidentified developer."

As this is a first barrier for new users, please sign the binary.

[splhack]

I don't have Apple Developer Program.

[EarthCitizen]

My work laptop is locked down, so no possible way to use MacVim.

[ychin]

Reopen for investigation.

[chdiza]

I'm opposed to this if it means we won't be able to build it on our own machines without a Developer Cert.

[ychin]

MacVim is open-sourced so you can always still build it yourself :). We also still need to support Homebrew builds (which builds from source) of course.

Part of the investigation is coming up with a satisfactory way to enable code signing in the build system (Travis CI) while keeping the main Xcode project in the repo pristine.

I do think for distributed binary we should try to sign it. Sparkle (our update system) already checks for a code signature but it’s nice to have an Apple-signed binary for peace of mind (not to mention Apple is heavily encouraging this which makes the first-time user experience quite annoying otherwise).

As a side note, #763 is related to this for some weird reason. I suspect the fact that MacVim is unsigned causes some slow validation path to trigger in Mojave when calling external application.

[chdiza]

Well, Hammerspoon is also open-source, but if I want to build it from source and not have it be a console-spamming debug build, I have to make a self-signed cert and "sign" it with that. What a PITA; I hope this never happens to MacVim.

[ychin]

I think this is because Hammerspoon requires system permission which would be annoying if you don’t self-sign the app. So a little bit of a different circumstance from MacVim.

[eirnym]

Could we accept a limited amount of donations for this purpose?

[ychin]

I thought about it but I have already purchased an account. Maybe I’ll do it next year for renewal.

[ychin]

Latest release (https://github.com/macvim-dev/macvim/releases/tag/snapshot-154) now signs the app.