fix(release): restore macOS 27 binary compatibility

.bun-version

@@ -1 +1 @@
-1.4.0
+1.4.2

cli/package.json

@@ -51,7 +51,7 @@
     "yaml": "2.9.0"
   },
   "devDependencies": {
-    "@types/bun": "1.4.0",
+    "@types/bun": "1.4.2",
     "eslint-plugin-no-relative-import-paths": "1.6.1",
     "knip": "6.32.2",
     "openapi-typescript": "7.13.0",
@@ -63,5 +63,5 @@
   "engines": {
     "bun": ">=1.1.0"
   },
-  "packageManager": "bun@1.4.0"
+  "packageManager": "bun@1.4.2"
 }

cli/scripts/release.test.ts

@@ -13,6 +13,8 @@ import {
   nativeReleaseTarget,
   readToolchainContract,
   RELEASE_MANIFEST_SCHEMA_VERSION,
+  darwinSignatureCommand,
+  signatureVerificationCommand,
   stageCommandReferenceAssets,
   SUPPORTED_BUN_RUNTIME_RANGE,
   writeReleaseMetadata,
@@ -153,6 +155,29 @@ describe("release target manifest", () => {
       "Unsupported native release platform: win32-x64.",
     );
   });
+
+  test("signs and verifies macOS release binaries", () => {
+    const darwinTarget = RELEASE_TARGETS.find(({ platform }) => platform === "darwin-arm64")!;
+    const linuxTarget = RELEASE_TARGETS.find(({ platform }) => platform === "linux-arm64")!;
+    const executable = "/tmp/altertable-test-binary";
+
+    expect(darwinSignatureCommand(darwinTarget, executable)).toEqual([
+      "codesign",
+      "--force",
+      "--sign",
+      "-",
+      "--timestamp=none",
+      executable,
+    ]);
+    expect(signatureVerificationCommand(darwinTarget, executable)).toEqual([
+      "codesign",
+      "--verify",
+      "--strict",
+      executable,
+    ]);
+    expect(darwinSignatureCommand(linuxTarget, executable)).toBeUndefined();
+    expect(signatureVerificationCommand(linuxTarget, executable)).toBeUndefined();
+  });
 });
 
 describe("release toolchain contract", () => {

cli/scripts/release.ts

@@ -144,6 +144,22 @@ export function compileCommand(target: ReleaseTarget, outputPath: string): strin
   ];
 }
 
+export function darwinSignatureCommand(
+  target: ReleaseTarget,
+  executable: string,
+): string[] | undefined {
+  if (target.os !== "darwin") return undefined;
+  return ["codesign", "--force", "--sign", "-", "--timestamp=none", executable];
+}
+
+export function signatureVerificationCommand(
+  target: ReleaseTarget,
+  executable: string,
+): string[] | undefined {
+  if (target.os !== "darwin") return undefined;
+  return ["codesign", "--verify", "--strict", executable];
+}
+
 export function nativeReleaseTarget(
   platform: NodeJS.Platform = process.platform,
   architecture: string = process.arch,
@@ -164,6 +180,8 @@ export async function compileReleaseTarget(
   const outputPath = join(outputDirectory, target.asset);
   await run(compileCommand(target, outputPath));
   await assertNonemptyFile(outputPath);
+  const signingCommand = darwinSignatureCommand(target, outputPath);
+  if (signingCommand) await run(signingCommand);
   return outputPath;
 }
 
@@ -387,6 +405,8 @@ export async function smokeReleaseTarget(
 ): Promise<void> {
   const executable = join(outputDirectory, target.asset);
   await assertNonemptyFile(executable);
+  const verifySignature = signatureVerificationCommand(target, executable);
+  if (verifySignature) await run(verifySignature);
   const version = (await runCapture([executable, "--version"])).trim();
   if (version !== VERSION) {
     throw new Error(`${target.asset} reported version ${version}; expected ${VERSION}.`);