Skip to content

Fix bundled CLI release signing - #4

Merged
higherbros merged 1 commit into
mainfrom
matt/fix-cli-release-signature
Aug 10, 2026
Merged

Fix bundled CLI release signing#4
higherbros merged 1 commit into
mainfrom
matt/fix-cli-release-signature

Conversation

@higherbros

Copy link
Copy Markdown
Owner

Summary

  • explicitly re-sign the bundled CLI after the archive is exported
  • re-seal the containing app after updating Contents/SharedSupport/relay
  • verify the app executable and bundled CLI independently before notarization

codesign --deep does not discover nested code in Contents/SharedSupport, so the previous release could pass the outer app verification while the bundled CLI signature was invalid.

Verification

  • bash -n scripts/build-release.sh
  • unsigned v0.2.0 release packaging
  • swift test --package-path Core (63 tests)
  • macOS app tests via xcodebuild (26 tests)
  • ad-hoc signing probe reproducing and validating the CLI-first, app-second signing order

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying relay with  Cloudflare Pages  Cloudflare Pages

Latest commit: 112c7c1
Status: ✅  Deploy successful!
Preview URL: https://e5fc0c4f.relay-cz1.pages.dev
Branch Preview URL: https://matt-fix-cli-release-signatu.relay-cz1.pages.dev

View logs

@higherbros
higherbros marked this pull request as ready for review August 10, 2026 13:53
@higherbros
higherbros merged commit 083a1b5 into main Aug 10, 2026
4 checks passed
@higherbros
higherbros deleted the matt/fix-cli-release-signature branch August 10, 2026 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant