CM-53930: fix onedir signing issues on mac

Author: gotbadger

.github/workflows/build_executable.yml

@@ -132,15 +132,34 @@ jobs:
         env:
           APPLE_CERT_NAME: ${{ secrets.APPLE_CERT_NAME }}
         run: |
-          # Sign all Mach-O binaries in the onedir output (excluding the main executable)
-          # Main executable must be signed last after all its dependencies
-          find dist/cycode-cli -type f ! -name "cycode-cli" | while read -r file; do
+          # 1. Sign framework bundles (preserves Info.plist binding for --strict verification)
+          while IFS= read -r framework; do
+            echo "Signing framework: $framework"
+            codesign --force --sign "$APPLE_CERT_NAME" --timestamp --options runtime "$framework"
+          done < <(find dist/cycode-cli -name "*.framework" -type d -maxdepth 3)
+
+          # 2. Replace standalone Python binary with symlink to the framework version.
+          #    The standalone copy fails codesign --verify --strict because it lacks the
+          #    framework's Info.plist context. The framework version passes.
+          if [ -f dist/cycode-cli/_internal/Python ] && [ -d dist/cycode-cli/_internal/Python.framework ]; then
+            FRAMEWORK_PYTHON=$(find dist/cycode-cli/_internal/Python.framework/Versions -name "Python" -type f | head -1)
+            if [ -n "$FRAMEWORK_PYTHON" ]; then
+              RELATIVE_PATH=${FRAMEWORK_PYTHON#dist/cycode-cli/_internal/}
+              echo "Replacing _internal/Python with symlink to $RELATIVE_PATH"
+              rm dist/cycode-cli/_internal/Python
+              ln -s "$RELATIVE_PATH" dist/cycode-cli/_internal/Python
+            fi
+          fi
+
+          # 3. Sign remaining Mach-O files (dylibs, .so files) outside of framework bundles
+          find dist/cycode-cli -type f ! -name "cycode-cli" ! -path "*.framework/*" | while read -r file; do
             if file -b "$file" | grep -q "Mach-O"; then
+              echo "Signing: $file"
               codesign --force --sign "$APPLE_CERT_NAME" --timestamp --options runtime "$file"
             fi
           done
 
-          # Re-sign the main executable with entitlements (must be last)
+          # 4. Re-sign the main executable with entitlements (must be last)
           codesign --force --sign "$APPLE_CERT_NAME" --timestamp --options runtime --entitlements entitlements.plist dist/cycode-cli/cycode-cli
 
       - name: Notarize macOS executable
@@ -176,15 +195,37 @@ jobs:
 
           # we can't staple the app because it's executable
 
+      - name: Verify macOS code signatures
+        if: runner.os == 'macOS'
+        run: |
+          # verify all Mach-O binaries are properly signed
+          # use -L to follow symlinks (e.g. _internal/Python -> Python.framework/...)
+          FAILED=false
+          while IFS= read -r file; do
+            if file -b "$file" | grep -q "Mach-O"; then
+              if ! codesign --verify --strict "$file" 2>&1; then
+                echo "INVALID: $file"
+                codesign -dv "$file" 2>&1 || true
+                FAILED=true
+              else
+                echo "OK: $file"
+              fi
+            fi
+          done < <(find -L dist/cycode-cli -type f)
+
+          if [ "$FAILED" = true ]; then
+            echo "Found binaries with invalid signatures!"
+            exit 1
+          fi
+
+          codesign -dv --verbose=4 $PATH_TO_CYCODE_CLI_EXECUTABLE
+
       - name: Test macOS signed executable
         if: runner.os == 'macOS'
         run: |
           file -b $PATH_TO_CYCODE_CLI_EXECUTABLE
           time $PATH_TO_CYCODE_CLI_EXECUTABLE version
 
-          # verify signature
-          codesign -dv --verbose=4 $PATH_TO_CYCODE_CLI_EXECUTABLE
-
       - name: Import cert for Windows and setup envs
         if: runner.os == 'Windows'
         env:
@@ -236,6 +277,46 @@ jobs:
           name: ${{ env.ARTIFACT_NAME }}
           path: dist
 
+      - name: Verify macOS artifact end-to-end
+        if: runner.os == 'macOS' && matrix.mode == 'onedir'
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ env.ARTIFACT_NAME }}
+          path: /tmp/artifact-verify
+
+      - name: Verify macOS artifact signatures and run with quarantine
+        if: runner.os == 'macOS' && matrix.mode == 'onedir'
+        run: |
+          # extract the onedir zip exactly as an end user would
+          ARCHIVE=$(find /tmp/artifact-verify -name "*.zip" | head -1)
+          echo "Verifying archive: $ARCHIVE"
+          unzip "$ARCHIVE" -d /tmp/artifact-extracted
+
+          # verify all Mach-O code signatures (strict mode)
+          FAILED=false
+          while IFS= read -r file; do
+            if file -b "$file" | grep -q "Mach-O"; then
+              if ! codesign --verify --strict "$file" 2>&1; then
+                echo "INVALID: $file"
+                codesign -dv "$file" 2>&1 || true
+                FAILED=true
+              else
+                echo "OK: $file"
+              fi
+            fi
+          done < <(find -L /tmp/artifact-extracted -type f)
+
+          if [ "$FAILED" = true ]; then
+            echo "Artifact contains binaries with invalid signatures!"
+            exit 1
+          fi
+
+          # simulate download quarantine and test execution
+          find -L /tmp/artifact-extracted -type f -exec xattr -w com.apple.quarantine "0081;$(printf '%x' $(date +%s));CI;$(uuidgen)" {} \;
+          EXECUTABLE=$(find -L /tmp/artifact-extracted -name "cycode-cli" -type f | head -1)
+          echo "Testing quarantined executable: $EXECUTABLE"
+          time "$EXECUTABLE" version
+
       - name: Upload files to release
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
         uses: svenstaro/upload-release-action@v2

process_executable_file.py

@@ -13,6 +13,7 @@
 import os
 import platform
 import shutil
+import subprocess
 from pathlib import Path
 from string import Template
 from typing import Union
@@ -140,6 +141,18 @@ def get_cli_archive_path(output_path: Path, is_onedir: bool) -> str:
     return os.path.join(output_path, get_cli_archive_filename(is_onedir))
 
 
+def archive_directory(input_path: Path, output_path: str) -> None:
+    if get_os_name() == 'darwin':
+        # use zip -y to preserve symlinks (required for macOS code signature validity)
+        subprocess.run(
+            ['zip', '-y', '-r', os.path.abspath(output_path), '.'],
+            cwd=str(input_path),
+            check=True,
+        )
+    else:
+        shutil.make_archive(output_path.removesuffix(f'.{_ARCHIVE_FORMAT}'), _ARCHIVE_FORMAT, input_path)
+
+
 def process_executable_file(input_path: Path, is_onedir: bool) -> str:
     output_path = input_path.parent
     hash_file_path = get_cli_hash_path(output_path, is_onedir)
@@ -150,7 +163,7 @@ def process_executable_file(input_path: Path, is_onedir: bool) -> str:
         write_hashes_db_to_file(normalized_hashes, hash_file_path)
 
         archived_file_path = get_cli_archive_path(output_path, is_onedir)
-        shutil.make_archive(archived_file_path, _ARCHIVE_FORMAT, input_path)
+        archive_directory(input_path, f'{archived_file_path}.{_ARCHIVE_FORMAT}')
         shutil.rmtree(input_path)
     else:
         file_hash = get_hash_of_file(input_path)