Why is it so complex

[boredcoder411]

couldn't find the appropriate issue template to file this under but here goes:
why is this so complex? isn't there a simpler way to use apple codesigning? I know its fairly tedious and I don't mean to invalidate this project, but is it really necessary to have this many files and packages?

[wagoodman]

If I saw an easier way I would have done that 😄!

As is today we're at ~8,300 LoC and ~100 source files. This project could be made simpler by doing on the bare minimum: sign and notarize without that many options (taking out all commands that deal with debugging like extract, embedded-certificates, submission *, describe). Even if we did that I think the project would only be ~20% smaller, but much of the work went into parsing and patching the binary while minimizing 3rd party dependencies (we do leverage 3rd party dependencies more heavily when it comes to the debugging commands, but not the core functionality for security reasons). To help give a sense on what the core functionality that is implemented see the dev docs.

[boredcoder411]

Well I am working on my own adhoc signing program (in c, not go). It is true it doesn't have the macho parser ready yet, however its planned to take around 2k LoC, so I was curious as to why quill was so huge.

PS: any tips on writing a macho parser?

[kzantow]

There is a go library for parsing macho biarines: https://github.com/anchore/go-macholibre