From 306cb83ab92091137470dd2c00a09ed47c6eaa65 Mon Sep 17 00:00:00 2001 From: Robin Scher Date: Wed, 24 Jun 2026 22:19:14 -0700 Subject: [PATCH] ci: zip darwin binaries before notarizing (apple rejects bare mach-o) --- .github/workflows/release.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d591867d..579c5d8c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -195,7 +195,11 @@ jobs: MACOS_CERT_PASSWORD_FILE: ${{ steps.macsign_check.outputs.enabled == 'true' && format('{0}/cert.pass', runner.temp) || '' }} # Notarize the signed darwin binaries. goreleaser leaves each built binary - # under dist/_darwin_*/; submit each so Gatekeeper accepts them. + # under dist/_darwin_*/. Apple's notary service only accepts + # containers (.zip/.dmg/.pkg/.app), not bare Mach-O executables, so each + # signed binary is zipped before submission. Stapling is not possible for a + # bare binary/zip; the submission still registers the code-signature hash + # with Apple so Gatekeeper accepts the extracted binary via its online check. - name: Notarize macOS binaries if: ${{ steps.macsign_check.outputs.enabled == 'true' }} run: | @@ -203,10 +207,13 @@ jobs: shopt -s nullglob for bin in dist/sqi-*_darwin_*/sqi-server dist/sqi-*_darwin_*/sqi-worker; do echo "Notarizing $bin" + zippath="$RUNNER_TEMP/$(echo "$bin" | tr '/' '_').zip" + zip -j "$zippath" "$bin" >/dev/null rcodesign notary-submit \ --api-key-file "$RUNNER_TEMP/notary-key.json" \ --wait \ - "$bin" + "$zippath" + rm -f "$zippath" done # ── Python client (sqi-sdk) distributions ──────────────────────────────