From 00a656c300d951c52c5f82836012664121ea530a Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Mon, 30 Mar 2026 18:51:16 -0700 Subject: [PATCH] refactor(release): streamline macOS app re-signing process - Consolidated the re-signing of the entire .app bundle into a single command with the `--deep` option, improving efficiency and reliability. - Removed redundant sidecar re-signing loops, simplifying the signing workflow. - Enhanced diagnostic output to list contents of the app bundle, aiding in troubleshooting. - Updated comments for clarity on the signing process and its requirements. --- .github/workflows/release.yml | 54 +++++++---------------------------- scripts/build-macos-signed.sh | 48 ++++++------------------------- 2 files changed, 20 insertions(+), 82 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8b6cc8269..189d6c9dc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -525,51 +525,19 @@ jobs: rm -f "$CERT_FILE" echo "Signing identity imported into $KEYCHAIN" - echo "=== Re-signing binaries inside $APP_PATH with hardened runtime ===" + echo "=== Re-signing entire .app with hardened runtime (deep) ===" - # Determine main executable name from Info.plist - MAIN_EXE="$(defaults read "$APP_PATH/Contents/Info.plist" CFBundleExecutable 2>/dev/null || echo "OpenHuman")" + # List what's inside for diagnostics + echo "Contents/MacOS:" + ls -la "$APP_PATH/Contents/MacOS/" + echo "Contents/Resources (openhuman):" + ls -la "$APP_PATH/Contents/Resources/"openhuman-* 2>/dev/null || echo " (none)" + echo "Contents/Frameworks:" + ls -la "$APP_PATH/Contents/Frameworks/" 2>/dev/null || echo " (none)" - # Re-sign every executable in Contents/MacOS except the main binary - for bin in "$APP_PATH/Contents/MacOS/"*; do - [ -f "$bin" ] && [ -x "$bin" ] || continue - BASENAME="$(basename "$bin")" - if [ "$BASENAME" = "$MAIN_EXE" ]; then - continue - fi - echo " Re-signing sidecar: $BASENAME" - codesign --force --options runtime \ - --entitlements "$ENTITLEMENTS" \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$bin" - codesign --verify --strict --verbose=1 "$bin" - done - - # Also re-sign sidecars that land in Contents/Resources (Tauri may place them here) - for bin in "$APP_PATH/Contents/Resources/"openhuman-*; do - [ -f "$bin" ] || continue - echo " Re-signing resource sidecar: $(basename "$bin")" - codesign --force --options runtime \ - --entitlements "$ENTITLEMENTS" \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$bin" - done - - # Re-sign frameworks/dylibs - for lib in "$APP_PATH/Contents/Frameworks/"*.dylib "$APP_PATH/Contents/Frameworks/"*.framework; do - [ -e "$lib" ] || continue - echo " Re-signing framework: $(basename "$lib")" - codesign --force --options runtime \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$lib" - done - - # Re-sign the entire .app so the seal covers updated signatures - echo " Re-signing .app bundle..." - codesign --force --options runtime \ + # Single --deep --force pass re-signs everything atomically: + # the main binary, all sidecars, frameworks, and the outer seal. + codesign --deep --force --options runtime \ --entitlements "$ENTITLEMENTS" \ --sign "$APPLE_SIGNING_IDENTITY" \ --timestamp \ diff --git a/scripts/build-macos-signed.sh b/scripts/build-macos-signed.sh index 27e3102c3..371571cce 100755 --- a/scripts/build-macos-signed.sh +++ b/scripts/build-macos-signed.sh @@ -155,44 +155,21 @@ fi echo echo "App bundle: $APP_PATH" -# ── Re-sign sidecar binaries inside the .app with hardened runtime ─── +# ── Re-sign entire .app with hardened runtime (deep) ───────────────── # Tauri signs sidecars during bundling but may not apply --options runtime # or entitlements, which Apple notarization requires on ALL executables. +# A single --deep --force pass re-signs everything atomically: the main +# binary, all sidecars, frameworks, and the outer seal. ENTITLEMENTS="app/src-tauri/entitlements.sidecar.plist" echo -echo "Re-signing binaries inside the .app with hardened runtime..." -# Sign all executables in Contents/MacOS except the main app binary -MAIN_EXECUTABLE="$(defaults read "$APP_PATH/Contents/Info.plist" CFBundleExecutable 2>/dev/null || echo "OpenHuman")" +echo "Contents of .app bundle:" +ls -la "$APP_PATH/Contents/MacOS/" +ls -la "$APP_PATH/Contents/Frameworks/" 2>/dev/null || true -for bin in "$APP_PATH/Contents/MacOS/"*; do - [[ -f "$bin" && -x "$bin" ]] || continue - BASENAME="$(basename "$bin")" - if [[ "$BASENAME" == "$MAIN_EXECUTABLE" ]]; then - continue # main binary — will be re-signed with the whole .app - fi - echo " Re-signing sidecar: $BASENAME" - codesign --force --options runtime \ - --entitlements "$ENTITLEMENTS" \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$bin" - codesign --verify --strict --verbose=1 "$bin" -done - -# Also sign any frameworks/dylibs inside the bundle -for lib in "$APP_PATH/Contents/Frameworks/"*.dylib "$APP_PATH/Contents/Frameworks/"*.framework; do - [[ -e "$lib" ]] || continue - echo " Re-signing framework: $(basename "$lib")" - codesign --force --options runtime \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$lib" -done - -# Re-sign the entire .app so the seal covers the updated sidecar signatures -echo " Re-signing .app bundle..." -codesign --force --options runtime \ +echo +echo "Re-signing .app with --deep --force --options runtime..." +codesign --deep --force --options runtime \ --entitlements "$ENTITLEMENTS" \ --sign "$APPLE_SIGNING_IDENTITY" \ --timestamp \ @@ -203,13 +180,6 @@ echo "Verifying code signature..." codesign --verify --deep --strict --verbose=2 "$APP_PATH" echo "Signature OK." -# Verify sidecar specifically -SIDECAR="$(find "$APP_PATH/Contents/MacOS" -name 'openhuman*' ! -name "$MAIN_EXECUTABLE" 2>/dev/null | head -1)" -if [[ -n "$SIDECAR" ]]; then - echo "Verifying sidecar hardened runtime..." - codesign -d --verbose=4 "$SIDECAR" 2>&1 | grep -E 'flags|runtime' || true -fi - # ── Notarize ────────────────────────────────────────────────────────── if $SKIP_NOTARIZE; then echo