From d239b0d71ce8847e7983ce633995d0fbaeb82d8e Mon Sep 17 00:00:00 2001 From: Dr Alexander Mikhalev Date: Tue, 15 Sep 2026 19:35:47 +0100 Subject: [PATCH] fix(release): verify portable macOS signatures --- .github/workflows/finalize-prebuilt-release.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/finalize-prebuilt-release.yml b/.github/workflows/finalize-prebuilt-release.yml index 26ce3ec..98a3f42 100644 --- a/.github/workflows/finalize-prebuilt-release.yml +++ b/.github/workflows/finalize-prebuilt-release.yml @@ -190,6 +190,12 @@ jobs: "$APPLE_APP_PASSWORD" "$CERT_BASE64" "$CERT_PASSWORD" done done + # Re-verify after every temporary signing keychain has been deleted. + # This proves the embedded signatures are portable, rather than + # accidentally depending on credentials left in the runner keychain. + for binary in inputs/*-apple-darwin; do + codesign --verify --deep --strict --verbose=2 "$binary" + done - name: Package and archive-sign release assets shell: bash @@ -235,6 +241,9 @@ jobs: done cargo install zipsign --version 0.2.1 --locked scripts/sign-release-archives.sh release-assets + for binary in release-assets/*-apple-darwin; do + codesign --verify --deep --strict --verbose=2 "$binary" + done - name: Generate manifests and final checksums shell: bash @@ -273,6 +282,11 @@ jobs: } cmp "$local_asset" "$remote_asset" done + # GitHub is the distribution boundary. Verify downloaded Mach-O + # signatures, not only local bytes, before allowing publication. + for binary in remote-assets/*-apple-darwin; do + codesign --verify --deep --strict --verbose=2 "$binary" + done expected_draft="$(mktemp)" actual_draft="$(mktemp)" trap 'rm -f "$expected_draft" "$actual_draft"' EXIT