Installers silently ad-hoc sign when TACET_SIGN_IDENTITY is unset

[drycode]

Both install-server.sh and install-client.sh build through swift/Packaging/build-app.sh, which falls back to an ad-hoc signature when TACET_SIGN_IDENTITY is empty:

if [[ -n "${SIGN_IDENTITY}" ]]; then
    codesign --force --deep --sign "${SIGN_IDENTITY}" ...
else
    echo "   using ad-hoc signature (-)"
    codesign --force --deep --sign - ...
fi

The echo is the only signal, and it scrolls past inside a long install. The install then reports success and --doctor passes, because codesign --verify --strict is satisfied by an ad-hoc signature.

What it cost

On 2026-08-04 a Developer ID signed bundle was installed at 14:12. An install-client.sh run at 14:17, in a shell without the variable set, rebuilt over it ad-hoc. Nothing indicated a downgrade had happened. The first notarization submission was then rejected:

The binary is not signed with a valid Developer ID certificate.
The signature does not include a secure timestamp.

Diagnosing that meant a round trip to Apple plus a log fetch, for a state the installer already knew about at build time.

Why it matters beyond the one incident

TCC grants key on the designated requirement. An ad-hoc DR is a bare cdhash, so every rebuild invalidates Accessibility and Microphone. That is exactly what #2 and the signing work exist to eliminate, and an unset environment variable silently puts you back on the old footing — currently true of the Studio install.

Suggested fix

Any of these, in rough order of preference:

1. Resolve an identity automatically when the variable is unset — security find-identity -v -p codesigning returning exactly one Developer ID Application is an unambiguous default.
2. Make the ad-hoc path opt-in (TACET_ALLOW_ADHOC=1) and fail otherwise, so the downgrade cannot happen by omission.
3. At minimum, have --doctor report the signature type, not just that verification passed. codesign -dvvv exposes it as flags=0x10002(adhoc,runtime) vs flags=0x10000(runtime).

Related: the missing --timestamp in the same script, fixed in f14077e.

[drycode]

Fixed on main in 8618156 and 59121e3.

build-app.sh now resolves a Developer ID from the keychain when TACET_SIGN_IDENTITY is unset and exits rather than downgrading; ad-hoc requires TACET_ALLOW_ADHOC=1, which CI sets explicitly. Resolution dedupes on the certificate SHA-1 rather than the output line, because security find-identity lists an identity once per keychain holding it — the same certificate appears four times on the author's machine, which a line count would call ambiguous.

Both --doctor implementations now check signature type. They had been reporting "signature is valid (adhoc)" as a PASS, since codesign --verify --strict is satisfied by an ad-hoc signature — suggestion 3 in this issue, and the reason the problem was invisible.

Worth recording, because the first version of that check did not work: codesign -dvvv … | grep -q '^Signature=adhoc' inverts under set -o pipefail. grep exits at the first match, codesign takes SIGPIPE, and the pipeline reports failure precisely when the pattern matched — so all three new checks passed every ad-hoc bundle. Capture the output first, then match. There is now a source-level test forbidding the piped form across all three scripts.

Follow-on, since it undid the benefit: the client installer was resetting TCC grants on any cdhash change, which is only correct for ad-hoc signing. A Developer ID requirement is identifier + Team ID and survives a rebuild. Fixed in 2eaeabf and verified live — a rebuilt, re-signed bundle kept its Accessibility grant with no re-prompt.