MacOS Sonoma kills binaries that have ".app" extension

We’re not Apple, so this is the wrong audience for any “why?” questions.

You’re seemingly not building app bundles here, so using the app extension would not be my first choice.

Apple silicon requires all apps to be notarized, as well. Either ad-hoc by the linker, or explicitly.

Potentially related: Apps distributed internally to our… | Apple Developer Forums

Code-signing info:

… Creating Distribution-Signed Code … | Apple Developer Forums

… Packaging Mac Software for Distrib… | Apple Developer Forums

… https://forum.latenightsw.com/t/sd-notary-2-release-notes/4373

… TN3147: Migrating to the latest notarization tool | Apple Developer Documentation

jeronimo77 wrote:

For example, in the case of Go binaries using a different extension or no extension at all works without signature.

If whatever you are building here is not an app bundle, and if this build product does not have the expected app bundle structure, then naming the build product as an app bundle is unsupported, and is precarious at best.

Bundle Structures

If this isn’t an app bundle, then don’t name it as an app bundle.

jeronimo77 wrote:

It's just a bit odd that the constraint is triggered just for ".app" extensions.

It isn't.

For example, in the case of Go binaries using a different extension or no extension at all works without signature.

You'll have to ask the people working on the Go compiler what they are doing.

I can build executables using clang on the command line, which automatically adds an ad-hoc signature, and any extension works fine. Therefore, the problem is whatever Go is doing. The Github issue you posted shows it pretty clearly. Your executable is located deep inside /private/var/folders. In theory, there's nothing wrong with that. But you have to question why they are choosing to create this kind of Rube Goldberg toolchain.

This is a "community of practice" issue. There is little to no overlap between Apple and Go. That means that Apple people have no idea about Go and Go people have no idea about Apple. Each might be able to handle the basics, but you should expect failures on edge cases of all kinds.

This has nothing to do with ".app" extensions. Your "go" compiler isn't properly signing executables. On Apple Silicon, all executables must be signed, even if it is just an ad-hoc signature. It's quite annoying sometimes. But that's the life of an Apple developer.

There's a global propaganda campaign targeting Apple devices, trying to make people think they are insecure. It's quite effective. But Apple has been cleverly leveraging this to enhance its control over the platform and sell more devices. In short, there's no end in sight. If your "go", "rust", "node", etc. compilers can't keep up, then you'll just have to switch to a different platform. They won't be missed. 😄