redshift 807bdc1c4b fix(macos): repair stale code signatures on standalone binaries ...

`bun build --compile` appends its standalone payload after the linker's
ad-hoc signature, so the embedded CodeDirectory no longer describes the
bytes on disk. macOS 15+ validates code pages lazily and SIGKILLs the
process on the first mismatching page (`Killed: 9`, exit 137). The
kernel logs it as:

  CODE SIGNING: rejecting invalid page ... (signed:1 validated:0 tainted:1)

Every standalone artifact we ship has this defect. Whether a given copy
dies at launch is luck: the bad page is the last one, which is cold
padding in some builds and hot startup code in others. The released
v0.4.14 darwin-arm64 binary was killed on every invocation, including
`--help` and `--version`, which also broke install.sh's version check.

Re-signing ad-hoc restores a valid signature without touching the
payload, and leaves already-valid signatures (for example a proper
Developer ID signature) untouched.

- install.sh: add ensure_valid_signature(), run after staging and before
  the version check. Only touches Mach-O files on Darwin, and only when
  codesign --verify fails.
- release.yml: repair the signature on macOS runners after the build and
  before the smoke test, so the packaged artifact is signed.
- standalone-update.ts: run ensureValidSignature() before verifyCandidate,
  which would otherwise hit the same SIGKILL during self-update.
- isMachO() reads only the four magic bytes rather than loading the whole
  binary, which is tens of megabytes.

Verified end to end: a fresh `bun build --compile` artifact reports an
invalid signature, and after repair both `codesign --verify` and the
binary itself succeed. install.sh repairs a broken binary and no-ops on
an already-valid one.

2026-10-25 20:00:43 +05:30

..

workflows

fix(macos): repair stale code signatures on standalone binaries

2026-10-25 20:00:43 +05:30