From 92c53f0135338c97a64ae6ff46ed0cb99c500769 Mon Sep 17 00:00:00 2001 From: tsteven4 <13596209+tsteven4@users.noreply.github.com> Date: Sat, 8 Nov 2025 07:34:45 -0800 Subject: [PATCH] make sure the app binary is signed after any other binaries in the root binaries path. This avoids a codesign verification error that may appear as "nested code is modified or invalid". --- src/tools/macdeployqt/shared/shared.cpp | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/tools/macdeployqt/shared/shared.cpp b/src/tools/macdeployqt/shared/shared.cpp index bd7f4fba8543..266fdef7f50a 100644 --- a/src/tools/macdeployqt/shared/shared.cpp +++ b/src/tools/macdeployqt/shared/shared.cpp @@ -1447,6 +1447,17 @@ QSet codesignBundle(const QString &identity, QString appBundleAbsolutePath = QFileInfo(appBundlePath).absoluteFilePath(); QString rootBinariesPath = appBundleAbsolutePath + "/Contents/MacOS/"; QStringList foundRootBinaries = QDir(rootBinariesPath).entryList(QStringList() << "*", QDir::Files); + + // The app binary must be signed last. + QString appBinary = findAppBinary(appBundleAbsolutePath); + QString appBinaryName = QFileInfo(appBinary).fileName(); + if (int appBinaryIdx = foundRootBinaries.indexOf(appBinaryName); appBinaryIdx > 0) { + foundRootBinaries.swapItemsAt(0, appBinaryIdx); + LogDebug() << "swapped appBinary to start of list"; + } + LogDebug() << "app binary is" << appBinaryName; + LogDebug() << "binaries in" << rootBinariesPath << "are" << foundRootBinaries; + for (const QString &binary : foundRootBinaries) { QString binaryPath = rootBinariesPath + binary; pendingBinaries.push(binaryPath);