macOS pre-built binaries

[QuentinBtd]

Hello!

I noticed that prebuilt macOS binaries aren't currently available.
Would it be possible to add them (back)?
Not all users utilize Homebrew, and some organizations maintain internal software repositories that would benefit from direct binary downloads.

Q.

[chrnorm]

We’ll work on getting this set up. Unfortunately we need a new Apple codesigning key with the move to fwd:cloudsec before we can implement this.

[QuentinBtd]

Has there been any progress? 🙏

[pdemagny]

We definitely need this too !
As @QuentinBtd said, not everyone uses Brew 😅
Having binaries would allow a significant portion of your users (including us) to include granted in their current setup using tools like asdf and mise !

[QuentinBtd]

Any news on this, @chrnorm?

[gps035]

Just noticed this after updating to 0.39 in our mise setup, and finding out that some team members could not install tools. While we could each install granted ourselves through whatever means, it's ideal to have it installed through mise/asdf to simplify setup and have assurance it's a compatible version for some custom tasks. It would be good to see macos binaries going forward.

[br0ziliy]

We're also using asdf in our org to manage the development tooling, would be nice to have Mac binary builds back please.

[nat45928]

Any updates here? The lack of support for mise is a dealbreaker for me.

[chinkung]

Thanks for the work on this. A suggestion that might unblock most of the people in this thread without waiting for the Apple key: publish unsigned darwin tarballs for now, and add Developer ID signing and notarization later.

Why unsigned works for the tools people are asking about:

• Gatekeeper only checks files that carry the com.apple.quarantine attribute. Browsers set it. curl, git, and the HTTP downloads done by mise, asdf, aqua and ubi don't.
• Apple Silicon only requires an ad-hoc signature. Go's linker adds one automatically on darwin/arm64, so no extra step is needed.
• Integrity is already covered by checksums.txt and checksums.txt.sig, which the release ships today.

The case that does need signing and notarization is someone downloading the tarball in a browser. They'd get the "Apple cannot check it" prompt and have to clear the attribute by hand. That could be documented as a known caveat until the key is sorted.

What's needed on the build side is small. make ci-cli-all-platforms already cross-compiles darwin/amd64 on a Linux runner, so no macOS runner is needed:

• Build darwin/amd64 and darwin/arm64 with the same ldflags the Homebrew formula uses: -s -w -X github.com/fwdcloudsec/granted/internal/build.Version=<ver> -X github.com/fwdcloudsec/granted/internal/build.ConfigFolderName=.granted
• Keep the v0.38.0 naming, granted_<ver>_darwin_arm64.tar.gz and granted_<ver>_darwin_x86_64.tar.gz, so existing tooling that detects those names keeps working.
• Ship the same files as the v0.38.0 tarballs: granted, assume, assume.fish, assume.bat and assume.ps1. Please also add assume.tcsh and the assumego symlink, which the Homebrew formula installs but the old tarballs lacked.

In the meantime, here's a workaround that works today for mise users. Tested with mise 2026.10.4 on macOS arm64. It builds from source, so it needs Go (mise can provide it):

[tools]
go = "latest"

[tools."go:github.com/fwdcloudsec/granted/cmd/granted"]
version = "latest"
postinstall = '''
pkg=github.com/fwdcloudsec/granted
bin="$MISE_TOOL_INSTALL_PATH/bin"
GOBIN="$bin" go install -trimpath -ldflags "-s -w -X $pkg/internal/build.Version=$MISE_TOOL_VERSION -X $pkg/internal/build.ConfigFolderName=.granted" "$pkg/cmd/granted@v$MISE_TOOL_VERSION"
ln -sf granted "$bin/assumego"
'''

Notes:

• The go: backend does its own go install first, so the binary is compiled twice. The postinstall rebuild is needed to set the version and the .granted config folder. Without it, granted --version and the config path come out wrong.
• This installs the granted binary and the assumego symlink only. The assume shell scripts from scripts/ in the repo still have to be sourced separately, as described in the Homebrew formula's caveats.