[canarypilot]

Do you know whether this applies to everything which executes? If my build scripts create a build script and run it I guess that will be ok, but if my build scripts build a specialised parser (say, from C source) I need to add a step after linking to code sign the generated parser binary before using it? Is that about right?

[saagarjha]

Signing is only required for native code. If your parser is a native binary, it needs at least an ad-hoc signature on it before it will run.