Repository navigation
Overview
zerosign 2.0 is the release that makes the binary genuinely portable. Every third-party library is now linked statically, so each release is a single executable that runs on a clean machine with no Homebrew, apt, or MSYS2 packages installed and no companion .dylib, .so, or .dll files beside it. Only the operating system USB service is still expected: usbmuxd on macOS and Linux, Apple Mobile Device Support on Windows.
Getting there meant building the dependency chain ourselves. OpenSSL is compiled from source with no-module, so the legacy provider lives inside libcrypto.a and older .p12 certificates unlock without an external provider file, which also let the Windows provider search-path workaround disappear. On Linux and Windows the entire device stack (libplist, libimobiledevice-glue, libusbmuxd, libimobiledevice) is compiled from source as well, because the packaged archives either link GnuTLS or reference DLL import symbols. macOS keeps the Homebrew archives, which are already built for static linking.
A new end-to-end test suite guards all of it. tests/test_zerosign.py runs 61 checks covering the build and the zero-dependency property (otool -L and ldd), the CLI and help/version workflows, saved certificate management, and bundle-sealing security regressions including tamper detection and zip-slip protection. It runs on CI across macOS, Linux, and Windows.
The three overlapping workflows were consolidated into two: ci.yaml builds and tests every push and pull request with a dependency cache, while release.yaml publishes an official release from a completely clean build.
CHANGELOG.md
Full Changelog: 1.0...2.0