[glhaynes]

It's not clear whether this "adware installer" is signed by a developer cert. I'm gonna guess it isn't, which means under the default settings, if a user double-clicks it to execute it, they'll be presented with a message saying that the app can't be run because it's "from an unknown developer" and the current settings disallow it. The user can get around that by right-clicking it and choosing "Open" (or switching Gatekeeper to be more relaxed), but the error message doesn't allude to this.

Edit: And if it is signed: yes, I believe Apple could and presumably would push out a malware update that would invalidate the cert.

[noondip]

One could easily make an "app" which just runs a shell script with this exploit - no code signing needed.

[glhaynes]

And users attempting to run it would encounter the things I mentioned above, so I'm not sure what you're getting at.

[noondip]

I'm getting at the fact a shell script with this exploit can be made to look like an "app" and be "double-clickable", and doesn't require any code signing.

[jakobegger]

Gatekeeper also watches over shell scripts, so when you double click the shell script it will tell you that you can't open it because it is from an unidentified developer.

[noondip]

You're thinking of quarantine. You'll get a warning saying the script was downloaded from the Internet, asking if you're sure you want to open it. Again, nothing to do with code signing.

[jakobegger]

I think you are misunderstanding something. Shell scripts and unsigned code are treated exactly the same by Gatekeeper.

When you double click a shell script downloaded from the internet, the warning will not ask you if you want to open the file. The warning will tell you that you can't open it because it is from an unidentified developer.

Let me try to clarify this: "Quarantine" is a flag set on files downloaded from the internet. When you open a file with the quarantine flag, Gatekeeper checks the code signature. If it is valid, it asks you if you want to open this file that you downloaded from the web. If the code signature is not valid, or if the file has no code signature, you wont be able to open it.

There are several ways to execute shell scripts downloaded from the internet: 1) Check "Allow all Applications" in System Preferences 2) Right click, select open. Then the warning will have a second option to open it despite being unsigned 3) Execute it from the command line

All of these presumably require the user to know what they are doing...

[glhaynes]

I haven't gotten to try it to confirm but I'm having trouble imagining why an unsigned .app bundle containing a binary executable would get the code-signing error but one containing a script wouldn't. Is that in fact the case?

[__david__]

Anything with a .app wrapper needs to be signed. It doesn't matter if the main exe is a binary or a script.