refactor(release): simplify macOS app signing process

- Updated the signing workflow to focus solely on signing the entire .app bundle with hardened runtime, eliminating unnecessary sidecar signing steps.
- Enhanced diagnostic output to list the contents of the app bundle before signing, improving visibility during the process.
- Improved comments for clarity on the new streamlined signing approach and its compliance with Apple notarization requirements.

.github/workflows/release.yml

@@ -524,39 +524,12 @@ jobs:
 
           echo "=== Re-signing binaries inside the .app with hardened runtime ==="
 
-          # Sign all executables in Contents/MacOS except the main app binary
-          MAIN_EXE="$(defaults read "$APP_PATH/Contents/Info.plist" CFBundleExecutable 2>/dev/null || echo "OpenHuman")"
-          echo "Main executable: $MAIN_EXE"
-          echo "Contents/MacOS:"
+          # The .app contains only the main Tauri binary (openhuman) — no
+          # separate sidecar. Just sign the whole bundle with hardened runtime.
+          echo "Bundle contents:"
           ls -la "$APP_PATH/Contents/MacOS/"
 
-          for bin in "$APP_PATH/Contents/MacOS/"*; do
-            [ -f "$bin" ] && [ -x "$bin" ] || continue
-            BASENAME="$(basename "$bin")"
-            if [ "$BASENAME" = "$MAIN_EXE" ]; then
-              continue  # main binary — will be re-signed with the whole .app
-            fi
-            echo "  Re-signing sidecar: $BASENAME"
-            codesign --force --options runtime \
-              --entitlements "$ENTITLEMENTS" \
-              --sign "$APPLE_SIGNING_IDENTITY" \
-              --timestamp \
-              "$bin"
-            codesign --verify --strict --verbose=1 "$bin"
-          done
-
-          # Also sign any frameworks/dylibs inside the bundle
-          for lib in "$APP_PATH/Contents/Frameworks/"*.dylib "$APP_PATH/Contents/Frameworks/"*.framework; do
-            [ -e "$lib" ] || continue
-            echo "  Re-signing framework: $(basename "$lib")"
-            codesign --force --options runtime \
-              --sign "$APPLE_SIGNING_IDENTITY" \
-              --timestamp \
-              "$lib"
-          done
-
-          # Re-sign the entire .app so the seal covers the updated sidecar signatures
-          echo "  Re-signing .app bundle..."
+          echo "Signing .app bundle with hardened runtime..."
           codesign --force --options runtime \
             --entitlements "$ENTITLEMENTS" \
             --sign "$APPLE_SIGNING_IDENTITY" \
@@ -566,13 +539,6 @@ jobs:
           echo "=== Verifying signatures ==="
           codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 
-          # Verify sidecar specifically
-          SIDECAR="$(find "$APP_PATH/Contents/MacOS" -name 'openhuman*' ! -name "$MAIN_EXE" 2>/dev/null | head -1)"
-          if [ -n "$SIDECAR" ]; then
-            echo "Verifying sidecar hardened runtime..."
-            codesign -d --verbose=4 "$SIDECAR" 2>&1 | grep -E 'flags|runtime' || true
-          fi
-
           echo "=== Notarizing ==="
           NOTARIZE_ZIP="$(mktemp /tmp/OpenHuman-notarize-XXXXXX.zip)"
           ditto -c -k --keepParent "$APP_PATH" "$NOTARIZE_ZIP"

scripts/build-macos-signed.sh

@@ -155,43 +155,18 @@ fi
 echo
 echo "App bundle: $APP_PATH"
 
-# ── Re-sign sidecar binaries inside the .app with hardened runtime ───
-# Tauri signs sidecars during bundling but may not apply --options runtime
-# or entitlements, which Apple notarization requires on ALL executables.
+# ── Sign the .app bundle with hardened runtime ───────────────────────
+# The .app contains only the main Tauri binary (openhuman) — no separate
+# sidecar binary. We just need to sign the whole bundle with hardened
+# runtime + entitlements for notarization.
 ENTITLEMENTS="app/src-tauri/entitlements.sidecar.plist"
 
 echo
-echo "Re-signing binaries inside the .app with hardened runtime..."
-# Sign all executables in Contents/MacOS except the main app binary
-MAIN_EXECUTABLE="$(defaults read "$APP_PATH/Contents/Info.plist" CFBundleExecutable 2>/dev/null || echo "OpenHuman")"
+echo "Bundle contents:"
+ls -la "$APP_PATH/Contents/MacOS/"
 
-for bin in "$APP_PATH/Contents/MacOS/"*; do
-  [[ -f "$bin" && -x "$bin" ]] || continue
-  BASENAME="$(basename "$bin")"
-  if [[ "$BASENAME" == "$MAIN_EXECUTABLE" ]]; then
-    continue  # main binary — will be re-signed with the whole .app
-  fi
-  echo "  Re-signing sidecar: $BASENAME"
-  codesign --force --options runtime \
-    --entitlements "$ENTITLEMENTS" \
-    --sign "$APPLE_SIGNING_IDENTITY" \
-    --timestamp \
-    "$bin"
-  codesign --verify --strict --verbose=1 "$bin"
-done
-
-# Also sign any frameworks/dylibs inside the bundle
-for lib in "$APP_PATH/Contents/Frameworks/"*.dylib "$APP_PATH/Contents/Frameworks/"*.framework; do
-  [[ -e "$lib" ]] || continue
-  echo "  Re-signing framework: $(basename "$lib")"
-  codesign --force --options runtime \
-    --sign "$APPLE_SIGNING_IDENTITY" \
-    --timestamp \
-    "$lib"
-done
-
-# Re-sign the entire .app so the seal covers the updated sidecar signatures
-echo "  Re-signing .app bundle..."
+echo
+echo "Signing .app bundle with hardened runtime..."
 codesign --force --options runtime \
   --entitlements "$ENTITLEMENTS" \
   --sign "$APPLE_SIGNING_IDENTITY" \
@@ -203,13 +178,6 @@ echo "Verifying code signature..."
 codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 echo "Signature OK."
 
-# Verify sidecar specifically
-SIDECAR="$(find "$APP_PATH/Contents/MacOS" -name 'openhuman*' ! -name "$MAIN_EXECUTABLE" 2>/dev/null | head -1)"
-if [[ -n "$SIDECAR" ]]; then
-  echo "Verifying sidecar hardened runtime..."
-  codesign -d --verbose=4 "$SIDECAR" 2>&1 | grep -E 'flags|runtime' || true
-fi
-
 # ── Notarize ──────────────────────────────────────────────────────────
 if $SKIP_NOTARIZE; then
   echo