[Bug] new git site broke macOS update and signing

[gh0sti]

Prerequisites

• I am confident that my issue has not been reported already in open OR closed issues.
• I am able to reliably reproduce the issue on the latest stable or canary version.
• I am not using an unofficial build (Flatpak, Emudeck, etc.).
• I am a silly goose and didn't read these boxes.
• I am a silly goose and DID read these boxes.

Description of the issue

Trying to update from 1.3.266 to 1.3.269 failed to download from the check for updates. I had to manually download the newest canary from the new gitlink and when trying to run the new update macOS gatekeeper needed to be bypassed, so the transfer to the new git host broke updates and macOS signing

Reproduction steps

have ryubing canary 1.3.266 or lower
try checking for updates
update shows but fails to fully download
manually downloading the app from the new git page
when trying to run on macOS 26.x fails until you bypass gatekeeper.

Log file

no logs

OS

macOS 26

Ryujinx version

1.3.266 and 1.3.269

Game version

No response

CPU

No response

GPU

No response

RAM

No response

List of applied mods

No response

Additional context?

I just think the signing broke when switching to the new git host and probably the sgining requires something with the domain change is my first guess. So macOS updates can't install from within the app updater and signing is broken.

[GreemDev]

there was no domain change; and this unfortunately will not be fixed unless a macos user can help. no contributors or maintainers are in possession of a mac, and we aren't switching back to broken infrastructure

if i had to guess the issue arises from the fact that the binaries are created in a docker container instead of whatever the hell github actions runs its ubuntu-latest runners on, which i think is a whole VM

which is not something we can fix because that's...not our CI infrastructure

is there a way we can remove codesigning altogether and just have some mac exclusive install instructions? I assume this would probably also require removing the updater

[Awesomeangotti]

Lemme cook rq.

[Awesomeangotti]

I have failed to cook at this time.

[gh0sti]

there was no domain change; and this unfortunately will not be fixed unless a macos user can help. no contributors or maintainers are in possession of a mac, and we aren't switching back to broken infrastructure

if i had to guess the issue arises from the fact that the binaries are created in a docker container instead of whatever the hell github actions runs its ubuntu-latest runners on, which i think is a whole VM

which is not something we can fix because that's...not our CI infrastructure

is there a way we can remove codesigning altogether and just have some mac exclusive install instructions? I assume this would probably also require removing the updater

I'm up for assisting any way I can with my Mac mini and my Mac book air.

[sh0inx]

I'm up for assisting any way I can with my Mac mini and my Mac book air.

you can start with providing any logs you think might be helpful; im sure that apple logs when an app fails due to signing and why. otherwise, stay on the line in-case we end up with a test build for you to try

[gh0sti]

I'm up for assisting any way I can with my Mac mini and my Mac book air.

you can start with providing any logs you think might be helpful; im sure that apple logs when an app fails due to signing and why. otherwise, stay on the line in-case we end up with a test build for you to try

I went to grab some older builds to test on my MBA and even the older builds are saying that they can't be verified so migrating to the new host has to be a part of the signing process.

[gh0sti]

After bypassing gatekeeper error popped up when trying to update from 1.3.266 to 1.3.269

clicking the download manually brings me back to the parent domain of the stable build https://ryujinx.app/download

[GreemDev]

I'm up for assisting any way I can with my Mac mini and my Mac book air.

you can start with providing any logs you think might be helpful; im sure that apple logs when an app fails due to signing and why. otherwise, stay on the line in-case we end up with a test build for you to try

I went to grab some older builds to test on my MBA and even the older builds are saying that they can't be verified so migrating to the new host has to be a part of the signing process.

It is not. We are not registered with apple. We use rcodesign to adhoc sign all binaries. The domain does not come into the equation ever

[gh0sti]

there was no domain change; and this unfortunately will not be fixed unless a macos user can help. no contributors or maintainers are in possession of a mac, and we aren't switching back to broken infrastructure

if i had to guess the issue arises from the fact that the binaries are created in a docker container instead of whatever the hell github actions runs its ubuntu-latest runners on, which i think is a whole VM

which is not something we can fix because that's...not our CI infrastructure

is there a way we can remove codesigning altogether and just have some mac exclusive install instructions? I assume this would probably also require removing the updater

I mean you can remove codesigning if you want its your app, however you will leave this friction for the end user having to deal with macOS gatekeeper and having to bypass that for end users to use your app. If anything removing the signing and built in updater would be a step back from what you have been able to do for the end users by making the process of running ryujinx easier.

[gh0sti]

and here is the error during update process from .266 to .269

00:00:00.136 |N| Application PrintSystemInfo: Launch Mode: UserProfile
00:00:03.130 |I| Application QueryLatestAsync: Checking for updates from: https://update.ryujinx.app/latest/query?os=mac&arch=arm64&rc=canary
00:00:05.109 |I| Application BeginUpdateAsync: Version found: Canary 1.3.266 -> Canary 1.3.269
00:00:35.822 |E| .NET TP Worker xattr: /var/folders/jf/zc95fy254g3ghzbk62zsq0x40000gn/T/Ryujinx/update/update.bin: No such xattr: com.apple.quarantine

Ryujinx_Canary_1.3.266_2026-04-15_21-18-05.log

[sh0inx]

I went to grab some older builds to test on my MBA and even the older builds are saying that they can't be verified so migrating to the new host has to be a part of the signing process.

so i dont think you actually realize what the migration was? we still have the same host. same server, same machine, same users, same IP. what changed is our source provider, which used to be gitlab and is now forgejo. i encourage you to read more about it here.

having said that, it may be related to our recent implementation of anubis, as it catches all traffic that hits our domain and makes a determination to either allow or deny the connection. greem's already said that the domain doesn't come into the equation, and i don't know the first thing about macOS development, so im going to leave my conjecture at that.