Unable to Install Mono Project due to package unsigned

[rolfbjarne]

From @llamaseer on Fri, 08 Sep 2023 17:18:39 GMT

The present Mono Project for Mac download for Mac 6.12.0.199 appears to be unsigned (both Visual Studio channgel and Stable channel.

This makes it impossible to install, at least for those of us who have a managed security policy which prevents it (I unfortunately don't have access to alternative systems to verify the behavior in other conditions). This includes by opening with Ctrl+click or using 'Open Anyway' from 'Privacy and Security' settings. 'Security' -> 'Allow applications downloaded from' is set to 'App store and identified developers'.

I was able to successfully install a previous binary (6.12.0.182) and confirmed with pkgutil --check-signature that the previous package was signed and the newer one is not.

Steps to Reproduce

1. Download latest package (MonoFramework-MDK-6.12.0.199.macos10.xamarin.universal.pkg) from https://www.mono-project.com/download/stable/#download-mac
2. Check signature

pkgutil --check-signature MonoFramework-MDK-6.12.0.199.macos10.xamarin.universal.pkg

Expected Behavior

Status: signed by a developer certificate issued by Apple for distribution

Actual Behavior

Status: no signature

Environment

Version information

Version: 1.81.1
Commit: 6c3e3dba23e8fadc360aed75ce363ba185c49794
Date: 2023-08-09T22:40:25.698Z
Electron: 22.3.18
ElectronBuildId: 22689846
Chromium: 108.0.5359.215
Node.js: 16.17.1
V8: 10.8.168.25-electron.0
OS: Darwin arm64 22.6.0

Build Logs

NA

Example Project (If Possible)

NA

Copied from original issue dotnet/macios#18977

[rolfbjarne]

CC @akoeplinger @steveisok

[adammfrank]

Can this please be addressed? This looks is a roadblock to most corporate users.

[pzkz692]

I can confirm that I'm seeing it with the 6.12.0.199 available from the download/stable page on mono-project.org. I'm eager to try Mono for the first time and I'm trying to be prudent by installing only software I can verify is authentic. Thanks to @rolfbjarne for mentioning 6.12.0.182, which I will use as a workaround.

[svendebont]

The 6.12.0.182 build is 18 months old.
Can this be addressed as this indeed a blocker for us.

[svendebont]

Seems 6.12.0.5 (preview) is signed.