Notarize macOS artifacts for macOS Catalina readiness

[jasontedor]

macOS Catalina is the next major release of macOS, expected in September/October 2019. Catalina will require applications distributed outside of the Mac App Store to be signed and notarized. For Elasticsearch specifically, this requires that:

• the bundled JDK be signed/notarized
• we handle that JNA extracts a native library at runtime
• the ML binaries be signed/notarized

The bundled JDKs produced by Oracle are signed but not notarized, we are exploring our options here including using a bundled JDK from a different source. JNA is not signed and notarized, our best option here is probably that the bundled JDK have the unsigned library entitlement. For the ML artifacts, we are currently working on integrating signing and notarization into our release pipeline.

[elasticmachine]

Pinging @elastic/es-core-infra

[oeed]

Glad this is being worked on! Is there a rough ETA?

[jasontedor]

@oeed As a matter of policy, we don't give ETAs, even approximate, sorry.

I will say this though: we are aware that macOS Catalina was released earlier in the week, a lot of us are excited to try it out too and we want to meet our users there, so we understand the importance of wrapping up our work on this.

[oeed]

Quite understandable! Was rather silly of me to jump the gun and update.

[JRBeckstrom]

Any news on this? Wasn't aware that this was an issue for Elasticsearch and has upgraded to Catalina...

[jasontedor]

We are blocked by the fact that there is not an upstream distribution of the JDK that is correctly signed and notarized. We are working through these issues via other channels.