Hello,
I'm trying to independently confirm the expected code-signing identity
for the official Podman v6.0.2 macOS installer before using it, and I
couldn't find this documented anywhere outside the package itself.
The asset in question is:
podman-installer-macos-arm64.pkg, from the official v6.0.2 GitHub release, at:
https://github.com/podman-container-tools/podman/releases/download/v6.0.2...
- Byte size: 74802386
- SHA-256: 5a1d97f98f626cdb82dbd9932cf43102d1e9b6621627085fec2dcadf59743930
I downloaded this exact asset and it passed byte-size verification,
SHA-256 verification, Apple code-signature validation, and
notarization assessment. The observed signer is:
Developer ID Installer: Red Hat, Inc. (HYSCB8KRL2)
I'd like to ask:
1. Is this exact Developer ID Installer identity and Team ID
(HYSCB8KRL2) the expected signer for official Podman macOS installers?
2. Is there a maintained, authoritative project or publisher page that
documents this expected signing identity, that I could reference going
forward?
3. Should the same signer identity be expected for future official
Podman macOS installer releases, or does this rotate?
Thanks for any pointer you can give me.