DUNS & signing open source application?

Question

In order to be able to sign an application on macOS an organisation needs a DUNS number. At the same time not all open source projects are done by a single lead developer and not all open source projects are registered organisations.

One open source project, that I am helping out, is facing the requirement to have a DUNS number, since the core developer team can vary, so tying signing authority to a single user can be an issue. The open source project is not part of a registered organisation.

Are there any entities that an open source project can register with to be able to sign on their behalf or any other suggested approaches to this issue?

I understand the need to protect users from rogue developers, but at the same time it would be good to find a solution that avoids legitimate open source projects from being penalised.

Answer 1

The only work around we could think of this point, without registering as a legal entity is to have one developer on the team sign the code and be considered as the release manager. This developer would need to be part of the core developers and a trusted member. If the release manager leaves then another developer from the core developers would be selected, and they would sign the binary with their certificate. At each point ensuring the release manager is a trusted member of the team is crucial.

With this approach, we figured only public releases would be signed and any time a release is made a public record would be made, indicating which certificate was use to sign that release. This would act as an audit log if anyone wanted to ensure the release they have was using the right certificate, much like some sites publish SHA1 checksums for binary downloads.

We don't know whether this would pass muster with Apple, but we really haven't found any other options.