The installer package (.pkg) is signed by Developer ID Installer: Splunk, Inc (CKEJB3F324). However, neither the DMG image file nor the installed executables are code signed. Since Splunk clearly already has a developer ID and knows how to use codesign(1), it would be very easy to sign both the DMG and the installed Mach-O executables too.
It seems very unprofessional to ship unsigned Mach-O binaries as part of an enterprise grade solution in 2018. Also, it makes it more difficult to lock down systems to only allow signed code using Gatekeeper or Google Santa, or to monitor for unsigned code using security monitoring solutions.
Is there any specific reason Splunk does not properly sign code for macOS yet?
