Skip to content

v2.4.2

Choose a tag to compare

View all tags
@inureyes inureyes released this 14 Aug 10:07
· 30 commits to main since this release
v2.4.2
cf8744a

Republishes the macOS binaries with a working code signature. No source changed between 2.4.1 and 2.4.2, so the Linux binaries behave identically and only macOS users need this release.

macOS users on 2.4.1 or earlier should upgrade. Those builds no longer run: macOS terminates them on launch and deletes the file. Reinstall with brew update && brew upgrade bssh.

New Features

None

Improvements

None

Bug Fixes

  • Sign the macOS binaries with a Developer ID Application certificate and notarize them (#264). Every macOS release through 2.4.1 was signed with an Apple Distribution certificate, an App Store submission identity whose leaf carries the App Store extension (1.2.840.113635.100.6.1.7) but not the Developer ID extension (1.2.840.113635.100.6.1.13) that Gatekeeper requires outside the App Store, and none was ever submitted to notarytool. codesign --sign "Distribution" matches identity names by substring, so it picked that certificate out of the keychain. Downloads were refused with a security warning for eight months; when the certificate was revoked on 2026-08-12, the failure escalated from a warning to CSSMERR_TP_CERT_REVOKED, and macOS began killing installed binaries on launch and deleting them as malware, which broke every Homebrew installation. All three released binaries (bssh, bssh-server, bssh-keygen) are now signed with a Developer ID Application certificate under the hardened runtime and notarized.

CI/CD Improvements

  • Fail the release when the signing certificate is the wrong type (#264). Nothing in the release workflow inspected the resulting signature, which is why the wrong certificate shipped unnoticed for eight months. Signing now runs through two composite actions under .github/actions/: the setup action rejects a p12 that holds no Developer ID Application certificate before anything is signed, and the signing action asserts the Developer ID Application authority, the hardened runtime flag, and the pinned code signature identifier after signing, then gates on notarization reaching status: Accepted.
  • Replace Apple's codesign with rcodesign for release signing (#264). rcodesign reads the signing certificate from a PEM directly, so the identity comes from the supplied certificate rather than from a substring match against whatever happens to be in the runner keychain, and no keychain or GUI session is needed.

Technical Details

  • A bare Mach-O executable cannot be stapled, so stapler staple is not attempted. The notarization ticket stays on Apple's servers and Gatekeeper resolves it online on first launch.
  • Each of the three binaries is signed under its own pinned code signature identifier: com.lablup.bssh, com.lablup.bssh-server, and com.lablup.bssh-keygen. Pinning the identifier keeps it stable regardless of the file name the binary is installed under.
  • The zip layout is unchanged (the binary plus its man page at the top level), so the Homebrew formula needed no changes.
  • The member crate bssh-russh-sftp stays on its own version line at 2.3.0 and was not bumped.

Dependencies

None. No Cargo.toml requirement changed, and no crate entered or left the graph. Cargo.lock records only the bssh version bump itself.

Breaking Changes

None

Known Issues

  • A revoked certificate cannot be un-revoked, so the 2.4.1 and earlier macOS assets remain unusable and are not being re-signed in place. Upgrade rather than re-downloading an older tag.
  • Gatekeeper resolves the notarization ticket online for bare executables, so the first launch on a machine with no network access may be slower or fall back to a prompt.
Assets 50
Loading