Skip to content

Commit d27ef5d

Browse files
committed
build(portable): Allow unsigned AXe Homebrew assets
Portable packaging currently assumes AXe binaries are signed, which breaks\nwhen consuming AXe's Homebrew-specific unsigned archive. Keep strict\nverification for signed artifacts and fall back to runtime execution\nvalidation for unsigned artifacts.\n\nCo-Authored-By: Claude <noreply@anthropic.com>
1 parent bdb0e07 commit d27ef5d

1 file changed

Lines changed: 29 additions & 11 deletions

File tree

scripts/package-macos-portable.sh

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ verify_axe_assets() {
8888
fi
8989

9090
if [[ "$(uname -s)" == "Darwin" ]]; then
91-
codesign --verify --deep --strict "$axe_bin"
9291
while IFS= read -r framework_path; do
9392
framework_name="$(basename "$framework_path" .framework)"
9493
framework_binary="$framework_path/Versions/A/$framework_name"
@@ -99,19 +98,38 @@ verify_axe_assets() {
9998
echo "Missing framework binary at $framework_binary"
10099
exit 1
101100
fi
102-
codesign --verify --deep --strict "$framework_binary"
103101
done < <(find "$frameworks_dir" -name "*.framework" -type d)
104-
spctl_log="$(mktemp)"
105-
if ! spctl --assess --type execute "$axe_bin" 2>"$spctl_log"; then
106-
if grep -q "does not seem to be an app" "$spctl_log"; then
107-
echo "Gatekeeper execute assessment is inconclusive for CLI binaries; continuing"
108-
else
109-
cat "$spctl_log"
110-
rm "$spctl_log"
111-
exit 1
102+
103+
if codesign -dv "$axe_bin" >/dev/null 2>&1; then
104+
codesign --verify --deep --strict "$axe_bin"
105+
while IFS= read -r framework_path; do
106+
framework_name="$(basename "$framework_path" .framework)"
107+
framework_binary="$framework_path/Versions/A/$framework_name"
108+
if [[ ! -f "$framework_binary" ]]; then
109+
framework_binary="$framework_path/Versions/Current/$framework_name"
110+
fi
111+
codesign --verify --deep --strict "$framework_binary"
112+
done < <(find "$frameworks_dir" -name "*.framework" -type d)
113+
114+
spctl_log="$(mktemp)"
115+
if ! spctl --assess --type execute "$axe_bin" 2>"$spctl_log"; then
116+
if grep -q "does not seem to be an app" "$spctl_log"; then
117+
echo "Gatekeeper execute assessment is inconclusive for CLI binaries; continuing"
118+
else
119+
cat "$spctl_log"
120+
rm "$spctl_log"
121+
exit 1
122+
fi
112123
fi
124+
rm "$spctl_log"
125+
else
126+
echo "AXe binary is unsigned; skipping codesign and Gatekeeper verification"
127+
fi
128+
129+
if ! DYLD_FRAMEWORK_PATH="$frameworks_dir" "$axe_bin" --version >/dev/null 2>&1; then
130+
echo "Bundled AXe runtime execution check failed"
131+
exit 1
113132
fi
114-
rm "$spctl_log"
115133
fi
116134
}
117135

0 commit comments

Comments
 (0)