Add macOS binary code signing and package notarization by andyleejordan · Pull Request #27347 · PowerShell/PowerShell · GitHub

PR Summary

Apple notarized installer! Resolves #10874, #27262, #23974, #24088, #19363, #10141, #16467, #12139, #18353, #15203, #4547, #2546, #1881, #19053 etc.

PR Context

We still need to apply the template signing so that Guardian tasks pass and so that script files are signed. After doing what's essentially Windows signing, we sign and harden the binaries for macOS. Then we do the same for the PKG installer, and finally notarize it. The ESRP signing service requires a zip of files for Apple signing at all stages. Now that we can use it via the OneBranch signing task we no longer need the service connection or variable group that was trying to set it up. Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo.

Uses codesign in the macOS build step to apply entitlements from a plist. This is required for the hardened runtime (which is required for notarization).

See: https://learn.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues#default-entitlements

PR Checklist

PR has a meaningful title
- Use the present tense and imperative mood when describing your changes
Summarized changes
Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
Breaking changes
- None
- OR
- Experimental feature(s) needed
  - Experimental feature name(s):
User-facing changes
- Not Applicable
- OR
- Documentation needed
  - Issue filed:
Testing - New and feature
- N/A or can only be tested interactively
- OR
- Make sure you've added a new test if existing tests do not effectively test the code changed

There is an available package powershell-7.9.99-preview.19-osx-arm64.pkg on the internal pipeline for other Microsoft devs to smoke test. To me it's so far, so good!

Pull request overview

This PR adds macOS hardened-runtime signing and Apple notarization steps to the packaging pipelines, introducing an entitlements plist applied during the macOS build and extending the pipeline signing flow to Apple-sign Mach-O binaries and notarize the PKG installer.

Changes:

Export Get-MacOSPackageIdentifierInfo from the packaging module and use it to compute the Bundle ID for notarization.
Add a macOS entitlements plist and apply it via codesign during the macOS build output generation.
Add OneBranch Apple signing (Mach-O + PKG) and PKG notarization steps, plus a verification step for Apple code signing.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
tools/packaging/packaging.psd1	Exports Get-MacOSPackageIdentifierInfo for use by pipeline scripts.
assets/macos-entitlements.plist	Adds entitlements used to enable hardened runtime signing for macOS binaries.
.pipelines/templates/mac.yml	Applies entitlements to pwsh during build and adds Apple-signing steps for the signed output.
.pipelines/templates/mac-package-build.yml	Verifies Apple signing on binaries, sets BundleId output, signs/notarizes PKG zips, and extracts notarized PKGs.

Before anyone says to remove the key code, that is already public info thanks to us, VS Code, Kiota, Azure Functions, Mono, for some reason Haystack etc.: https://github.com/search?type=code&q=CP-401337-Apple

(But in #27354 I finish the started work to migrate all our CP codes to a variable group for "defense in depth" purposes.)

And yes there really are what amounts to five signing steps for this process:

"signing" binaries for macOS to apply entitlements (no real signature)
signing .NET binaries with Authenticode (only matters for Windows but compliance necessitates it)
signing binaries for macOS with actual signature
signing PKG with those binaries inside it for macOS
notarizing PKG with Apple (another type of signing)

We still need to apply the template signing so that Guardian tasks pass and so that script files are signed. After doing what's essentially Windows signing, we sign and harden the binaries for macOS. Then we do the same for the PKG installer, and finally notarize it. The ESRP signing service requires a zip of files for Apple signing at all stages. Now that we can use it via the OneBranch signing task we no longer need the service connection or variable group that was trying to set it up. Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Uses codesign in the macOS build step to apply entitlements from a plist. This is required for the hardened runtime (which is required for notarization). See: https://learn.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues#default-entitlements Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Andy Jordan (andyleejordan) force-pushed the andyleejordan/apple-notarization branch from cfb3384 to 4a6787b Compare April 23, 2026 20:15

Andy Jordan (andyleejordan) added OS-macOS Compliance Related to compliance requirements CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log labels Apr 23, 2026

microsoft-github-policy-service Bot added Backport-7.4.x-Consider Backport-7.5.x-Consider Backport-7.6.x-Consider labels Apr 23, 2026

Andy Jordan (andyleejordan) marked this pull request as ready for review April 23, 2026 21:33

Andy Jordan (andyleejordan) requested review from a team and Justin Chung (jshigetomi) as code owners April 23, 2026 21:33

Copilot AI review requested due to automatic review settings April 23, 2026 21:33

Copilot started reviewing on behalf of Andy Jordan (andyleejordan) April 23, 2026 21:34 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

Comment thread .pipelines/templates/mac-package-build.yml

Comment thread .pipelines/templates/mac-package-build.yml

Comment thread .pipelines/templates/mac-package-build.yml

Andy Jordan (andyleejordan) force-pushed the andyleejordan/apple-notarization branch from 4a6787b to 3b0972e Compare April 23, 2026 22:05

Andy Jordan (andyleejordan) requested a review from Travis Plunk (TravisEz13) April 23, 2026 22:55

Andy Jordan (andyleejordan) and others added 2 commits April 24, 2026 15:39

Andy Jordan (andyleejordan) force-pushed the andyleejordan/apple-notarization branch from 3b0972e to 12a9df7 Compare April 24, 2026 22:40

Andy Jordan (andyleejordan) mentioned this pull request Apr 28, 2026

Notarize installation packages #19363

Closed

Travis Plunk (TravisEz13) requested a review from Copilot May 1, 2026 20:11

Copilot started reviewing on behalf of Travis Plunk (TravisEz13) May 1, 2026 20:12 View session

Travis Plunk (TravisEz13) assigned Justin Chung (jshigetomi) May 1, 2026

Copilot AI reviewed May 1, 2026

View reviewed changes

Comment thread assets/macos-entitlements.plist

Comment thread .pipelines/templates/mac.yml

Comment thread .pipelines/templates/mac-package-build.yml

Travis Plunk (TravisEz13) approved these changes May 1, 2026

View reviewed changes

Andy Jordan (andyleejordan) force-pushed the andyleejordan/apple-notarization branch from 5a0f767 to 12a9df7 Compare May 1, 2026 20:33

Andy Jordan (andyleejordan) enabled auto-merge (squash) May 1, 2026 20:36

Andy Jordan (andyleejordan) disabled auto-merge May 1, 2026 20:37

Travis Plunk (TravisEz13) approved these changes May 1, 2026

View reviewed changes

Andy Jordan (andyleejordan) enabled auto-merge (squash) May 1, 2026 20:38

Andy Jordan (andyleejordan) disabled auto-merge May 1, 2026 20:40

Andy Jordan (andyleejordan) merged commit b9bd8cb into master May 1, 2026
86 checks passed

Andy Jordan (andyleejordan) deleted the andyleejordan/apple-notarization branch May 1, 2026 20:52

Dongbo Wang (daxian-dbw) added Backport-7.6.x-Approved and removed Backport-7.6.x-Consider labels May 13, 2026

Aditya Patwardhan (adityapatwardhan) mentioned this pull request May 13, 2026

[release/v7.4.16] Add macOS binary code signing and package notarization #27431

Merged

9 tasks

Aditya Patwardhan (adityapatwardhan) added Backport-7.4.x-Migrated and removed Backport-7.4.x-Consider labels May 13, 2026

Dongbo Wang (daxian-dbw) mentioned this pull request May 13, 2026

[release/v7.6.2] Add macOS binary code signing and package notarization #27434

Merged

9 tasks

Dongbo Wang (daxian-dbw) added Backport-7.6.x-Migrated Backport-7.6.x-Done and removed Backport-7.6.x-Approved Backport-7.6.x-Migrated labels May 13, 2026

Dongbo Wang (daxian-dbw) mentioned this pull request May 13, 2026

[release/v7.6.2] Fix *nix permissions and use certificate_logical_to_actual #27439

Merged

9 tasks

Dongbo Wang (daxian-dbw) added Backport-7.5.x-Approved and removed Backport-7.5.x-Consider labels May 15, 2026

Aditya Patwardhan (adityapatwardhan) mentioned this pull request May 17, 2026

[release/v7.5.7] Add macOS binary code signing and package notarization #27467

Merged

9 tasks

Aditya Patwardhan (adityapatwardhan) added Backport-7.5.x-Done and removed Backport-7.5.x-Approved labels May 19, 2026

Andy Jordan (andyleejordan) mentioned this pull request May 20, 2026

Verify Apple codesign immediately after ESRP signing #27486

Merged

8 tasks

Add macOS binary code signing and package notarization by andyleejordan · Pull Request #27347 · PowerShell/PowerShell · GitHub

Uh oh!

Add macOS binary code signing and package notarization - #27347

Add macOS binary code signing and package notarization#27347
Andy Jordan (andyleejordan) merged 2 commits into
masterfrom
andyleejordan/apple-notarization

Andy Jordan (andyleejordan) commented Apr 23, 2026 •
edited
Loading

Uh oh!

Uh oh!

Andy Jordan (andyleejordan) commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Andy Jordan (andyleejordan) commented Apr 24, 2026 •
edited
Loading

Uh oh!

Uh oh!

Andy Jordan (andyleejordan) commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Add macOS binary code signing and package notarization by andyleejordan · Pull Request #27347 · PowerShell/PowerShell · GitHub

Uh oh!

Add macOS binary code signing and package notarization - #27347

Add macOS binary code signing and package notarization#27347Andy Jordan (andyleejordan) merged 2 commits intomasterPowerShell/PowerShell:masterfrom andyleejordan/apple-notarizationPowerShell/PowerShell:andyleejordan/apple-notarizationCopy head branch name to clipboard

Conversation

Andy Jordan (andyleejordan) commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

PR Context

PR Checklist

Uh oh!

Andy Jordan (andyleejordan) commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Andy Jordan (andyleejordan) commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Andy Jordan (andyleejordan) commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Add macOS binary code signing and package notarization#27347
Andy Jordan (andyleejordan) merged 2 commits into
masterfrom
andyleejordan/apple-notarization

Andy Jordan (andyleejordan) commented Apr 23, 2026 •
edited
Loading

Andy Jordan (andyleejordan) commented Apr 24, 2026 •
edited
Loading