GHC on OS X & Gatekeeper

[Manuel M T Chakravarty]

Simon Marlow <simonmar at microsoft.com>:
>> On Fri, Jun 22, 2012 at 04:54:43PM +1000, Manuel M T Chakravarty wrote:
>>> 
>>> You may be aware that from OS X 10.8 (Mountain Lion) forward the
>>> default security policy will disallow the installation of unsigned
>>> packages
>> 
>> I wasn't. Thanks for the heads-up.
>> 
>>> So, I was wondering, are you planning to sign the GHC and HP installers?
>> 
>> Actually, I had been meaning to talk to Mark about installers anyway.
>> 
>> Mark, am I right in thinking that for the HP you don't use the OS X GHC
>> installer at all, but just build your own for GHC plus the other HP bits?
>> And do you know whether the same is true for the Windows installer?
>> 
>> We have been considering stopping building the installers. We have scripts
>> that build the installers, but we aren't working on improving them at all,
>> which means that any feature requests don't get any attention. However, we
>> still have to spend time maintaining them (e.g.
>> fixing the above signing issue), and building them for releases.
>> 
>> However, the GHC releases are no longer aimed at the general end user;
>> we'd expect them to install the HP instead. Early adopters would still be
>> able to install GHC using the bindists, which is pretty easy - and in fact
>> it's easier to have multiple versions installed if you do it that way.
> 
> Easiest for us would be to stop making Mac and Windows installers and leave that to the Haskell Platform.  If there are no major objections I suggest we do that.  As Ian says, it's still not difficult to install a GHC release from the bindists - just a ./configure; make install for Mac and Linux, and unzipping a .zip file on Windows.

I have been using the GHC-only installers quite a bit, but I agree that there are better uses of your and Ian's time than building installers. It'd be great if somebody in the community could fill the gap.

> I guess the Haskell Platform should sign the Mac installer.  I have an Apple developer ID and I'd be happy to do whatever is necessary to help Mark sign the installer, if that would help at all.

I also think the Platform should be signed. It is easy (and free) to get an ID. I never did the dance for Mac apps, but to sign iOS apps, you need to get various certificates and put them into your key chain. That would be awkward, at least, for other than your own ID.

Manuel