sign macOS release binaries

Author: boxlegsCreated Aug 21, 2026Updated Aug 23, 2026
LabelsType: Feature RequestPriority: Normal

Describe the feature you'd like The cloudflared binaries available for macOS via Homebrew / GitHub Releases are currently distributed without code signing.

bash
codesign -dvv /opt/homebrew/bin/cloudflared

Executable=/opt/homebrew/Cellar/cloudflared/2026.7.3/bin/cloudflared
Identifier=a.out
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=296926 flags=0x20002(adhoc,linker-signed) hashes=9276+0 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements=none

Wondering if this has been explored as an option for making cloudflared a trusted binary on macOS?

Additional context To reduce risks posed by the execution of untrusted binaries, enterprises environments are beginning to enforce aggressive binary authorisation policies that restrict the execution of unsigned code. Having cloudflared signed with a Developer ID certificate would allow folks to maintain these policies without disrupting engineers' workflows.