From 3ed27421a8107045a8c68511d1ebbc395ccf2c8b Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Mon, 30 Mar 2026 21:11:51 -0700 Subject: [PATCH] refactor(release): simplify macOS app signing process - Updated the signing workflow to focus solely on signing the entire .app bundle with hardened runtime, eliminating unnecessary sidecar signing steps. - Enhanced diagnostic output to list the contents of the app bundle before signing, improving visibility during the process. - Improved comments for clarity on the new streamlined signing approach and its compliance with Apple notarization requirements. --- .github/workflows/release.yml | 42 +++--------------------------- scripts/build-macos-signed.sh | 48 ++++++----------------------------- 2 files changed, 12 insertions(+), 78 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 27071b267..f78adaced 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -524,39 +524,12 @@ jobs: echo "=== Re-signing binaries inside the .app with hardened runtime ===" - # Sign all executables in Contents/MacOS except the main app binary - MAIN_EXE="$(defaults read "$APP_PATH/Contents/Info.plist" CFBundleExecutable 2>/dev/null || echo "OpenHuman")" - echo "Main executable: $MAIN_EXE" - echo "Contents/MacOS:" + # The .app contains only the main Tauri binary (openhuman) — no + # separate sidecar. Just sign the whole bundle with hardened runtime. + echo "Bundle contents:" ls -la "$APP_PATH/Contents/MacOS/" - for bin in "$APP_PATH/Contents/MacOS/"*; do - [ -f "$bin" ] && [ -x "$bin" ] || continue - BASENAME="$(basename "$bin")" - if [ "$BASENAME" = "$MAIN_EXE" ]; then - continue # main binary — will be re-signed with the whole .app - fi - echo " Re-signing sidecar: $BASENAME" - codesign --force --options runtime \ - --entitlements "$ENTITLEMENTS" \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$bin" - codesign --verify --strict --verbose=1 "$bin" - done - - # Also sign any frameworks/dylibs inside the bundle - for lib in "$APP_PATH/Contents/Frameworks/"*.dylib "$APP_PATH/Contents/Frameworks/"*.framework; do - [ -e "$lib" ] || continue - echo " Re-signing framework: $(basename "$lib")" - codesign --force --options runtime \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$lib" - done - - # Re-sign the entire .app so the seal covers the updated sidecar signatures - echo " Re-signing .app bundle..." + echo "Signing .app bundle with hardened runtime..." codesign --force --options runtime \ --entitlements "$ENTITLEMENTS" \ --sign "$APPLE_SIGNING_IDENTITY" \ @@ -566,13 +539,6 @@ jobs: echo "=== Verifying signatures ===" codesign --verify --deep --strict --verbose=2 "$APP_PATH" - # Verify sidecar specifically - SIDECAR="$(find "$APP_PATH/Contents/MacOS" -name 'openhuman*' ! -name "$MAIN_EXE" 2>/dev/null | head -1)" - if [ -n "$SIDECAR" ]; then - echo "Verifying sidecar hardened runtime..." - codesign -d --verbose=4 "$SIDECAR" 2>&1 | grep -E 'flags|runtime' || true - fi - echo "=== Notarizing ===" NOTARIZE_ZIP="$(mktemp /tmp/OpenHuman-notarize-XXXXXX.zip)" ditto -c -k --keepParent "$APP_PATH" "$NOTARIZE_ZIP" diff --git a/scripts/build-macos-signed.sh b/scripts/build-macos-signed.sh index 27e3102c3..5f8b3834c 100755 --- a/scripts/build-macos-signed.sh +++ b/scripts/build-macos-signed.sh @@ -155,43 +155,18 @@ fi echo echo "App bundle: $APP_PATH" -# ── Re-sign sidecar binaries inside the .app with hardened runtime ─── -# Tauri signs sidecars during bundling but may not apply --options runtime -# or entitlements, which Apple notarization requires on ALL executables. +# ── Sign the .app bundle with hardened runtime ─────────────────────── +# The .app contains only the main Tauri binary (openhuman) — no separate +# sidecar binary. We just need to sign the whole bundle with hardened +# runtime + entitlements for notarization. ENTITLEMENTS="app/src-tauri/entitlements.sidecar.plist" echo -echo "Re-signing binaries inside the .app with hardened runtime..." -# Sign all executables in Contents/MacOS except the main app binary -MAIN_EXECUTABLE="$(defaults read "$APP_PATH/Contents/Info.plist" CFBundleExecutable 2>/dev/null || echo "OpenHuman")" +echo "Bundle contents:" +ls -la "$APP_PATH/Contents/MacOS/" -for bin in "$APP_PATH/Contents/MacOS/"*; do - [[ -f "$bin" && -x "$bin" ]] || continue - BASENAME="$(basename "$bin")" - if [[ "$BASENAME" == "$MAIN_EXECUTABLE" ]]; then - continue # main binary — will be re-signed with the whole .app - fi - echo " Re-signing sidecar: $BASENAME" - codesign --force --options runtime \ - --entitlements "$ENTITLEMENTS" \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$bin" - codesign --verify --strict --verbose=1 "$bin" -done - -# Also sign any frameworks/dylibs inside the bundle -for lib in "$APP_PATH/Contents/Frameworks/"*.dylib "$APP_PATH/Contents/Frameworks/"*.framework; do - [[ -e "$lib" ]] || continue - echo " Re-signing framework: $(basename "$lib")" - codesign --force --options runtime \ - --sign "$APPLE_SIGNING_IDENTITY" \ - --timestamp \ - "$lib" -done - -# Re-sign the entire .app so the seal covers the updated sidecar signatures -echo " Re-signing .app bundle..." +echo +echo "Signing .app bundle with hardened runtime..." codesign --force --options runtime \ --entitlements "$ENTITLEMENTS" \ --sign "$APPLE_SIGNING_IDENTITY" \ @@ -203,13 +178,6 @@ echo "Verifying code signature..." codesign --verify --deep --strict --verbose=2 "$APP_PATH" echo "Signature OK." -# Verify sidecar specifically -SIDECAR="$(find "$APP_PATH/Contents/MacOS" -name 'openhuman*' ! -name "$MAIN_EXECUTABLE" 2>/dev/null | head -1)" -if [[ -n "$SIDECAR" ]]; then - echo "Verifying sidecar hardened runtime..." - codesign -d --verbose=4 "$SIDECAR" 2>&1 | grep -E 'flags|runtime' || true -fi - # ── Notarize ────────────────────────────────────────────────────────── if $SKIP_NOTARIZE; then echo