Skip to content

fix(release): verify portable macOS signatures #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexMikhalev merged 1 commit into from
Sep 15, 2026
Merged

fix(release): verify portable macOS signatures #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/finalize-prebuilt-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,12 @@ jobs:
"$APPLE_APP_PASSWORD" "$CERT_BASE64" "$CERT_PASSWORD"
done
done
# Re-verify after every temporary signing keychain has been deleted.
# This proves the embedded signatures are portable, rather than
# accidentally depending on credentials left in the runner keychain.
for binary in inputs/*-apple-darwin; do
codesign --verify --deep --strict --verbose=2 "$binary"
done

- name: Package and archive-sign release assets
shell: bash
Expand Down Expand Up @@ -235,6 +241,9 @@ jobs:
done
cargo install zipsign --version 0.2.1 --locked
scripts/sign-release-archives.sh release-assets
for binary in release-assets/*-apple-darwin; do
codesign --verify --deep --strict --verbose=2 "$binary"
done

- name: Generate manifests and final checksums
shell: bash
Expand Down Expand Up @@ -273,6 +282,11 @@ jobs:
}
cmp "$local_asset" "$remote_asset"
done
# GitHub is the distribution boundary. Verify downloaded Mach-O
# signatures, not only local bytes, before allowing publication.
for binary in remote-assets/*-apple-darwin; do
codesign --verify --deep --strict --verbose=2 "$binary"
done
expected_draft="$(mktemp)"
actual_draft="$(mktemp)"
trap 'rm -f "$expected_draft" "$actual_draft"' EXIT
Expand Down
Loading