fix: add macOS code signing to release build pipeline

[KylinDC]

Problem

macOS release binaries (aws-vault-darwin-amd64 and aws-vault-darwin-arm64) are only adhoc/linker-signed, resulting in:

$ codesign -dv --verbose=4 $(which aws-vault)
Signature=adhoc
TeamIdentifier=not set
Identifier=a.out

This causes macOS to treat every binary update (e.g., via brew upgrade) as a completely new, untrusted application — forcing users to re-authorize keychain access after every upgrade.

Combined with KeychainNotTrustApplication: true in the keyring code, users get redundant authorization prompts.

Changes

Makefile

• Added codesign --options runtime --timestamp to the aws-vault-darwin-amd64 and aws-vault-darwin-arm64 targets
• Gated on CERT_ID being set, matching the existing local aws-vault target behavior

CI release workflow (.github/workflows/release.yaml)

• Added Apple Developer certificate import to build-macos job (imports .p12, creates temporary keychain)
• CERT_ID is auto-extracted from the imported certificate via security find-identity — no separate secret needed, and it can never mismatch
• CERT_ID is only written to the environment after a successful import, so the Makefile's ifdef CERT_ID naturally skips signing when the cert wasn't imported — no separate CI guard needed
• Also added an optional DMG + notarization step via the existing bin/create-dmg script (gated on KEYCHAIN_PROFILE secret)
• All signing steps are gated on secrets — forks without secrets configured skip signing gracefully

Required GitHub Secrets (optional, for signing to activate)

Secret	Description
CERTIFICATE_OSX_P12	Base64-encoded Apple Developer ID Application certificate
CERTIFICATE_PASSWORD	Password for the .p12 certificate
KEYCHAIN_PASSWORD	Password for the temporary build keychain
KEYCHAIN_PROFILE	(optional) notarytool keychain profile for DMG notarization

How to verify the signature

After a signed release, verify with:

# Check signing details
codesign -dv --verbose=4 $(which aws-vault)

# Expected output — TeamIdentifier should be set, Authority should show the cert:
#   Authority=Developer ID Application: ByteNess (R)
#   TeamIdentifier=<your-team-id>

Or a one-liner check:

# Verify the signature is valid (not just adhoc)
codesign -dv $(which aws-vault) 2>&1 | grep -q "Authority=" && echo "✓ Properly signed" || echo "✗ Adhoc only"

Questions for maintainer

1. CERT_ID mismatch — there are two different values in the repo for local builds:

File	Value
Makefile line 3	Developer ID Application: ByteNess (R)
bin/create-dmg line 19	Developer ID Application: ByteNess Inc (R)

Which is the correct certificate name? I'll align both once confirmed. (CI auto-detects it, so this only affects local make dmgs.)

2. DMG or CLI binary only? — The CI currently uploads raw binaries to GitHub Releases (which Homebrew consumes). I added an optional DMG step via bin/create-dmg, but for a CLI tool the DMG might be unnecessary overhead. Do you want to:

   • Keep the DMG for manual downloaders who want a notarized package?
   • Drop it and only sign the raw CLI binary?

   If you prefer CLI-only, I'll remove the DMG/notarization step from the workflow.