Repository navigation
Conversation
CLIs ship bare Mach-O binaries, so `beeper/cli` and the Day One CLI each hand-roll this verification because the action only accepted `.app` and `.dmg`. Raised in beeper/cli#56 (comment). --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
`spctl --type execute` rejects every bare binary, notarized or not, with `the code is valid but does not seem to be an app`. The stubbed specs could not catch this; running against a real binary did. Checked on a notarized `beeper` binary from Buildkite: `--type open --context context:primary-signature` reports `Notarized Developer ID`, and rejects a Developer ID re-signed copy as `Unnotarized Developer ID`. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
Collaborator
Generated by 🚫 Danger |
--- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
mokagio
commented
Nov 6, 2026
Comment on lines
+23
to
+24
| when '' | ||
| verify_binary(path: path, expected_authority: params[:expected_authority], verify_notarization: params[:verify_notarization]) |
Contributor
Author
There was a problem hiding this comment.
I suppose this could backfire if someone generates a package without an extension, but that seems like a perverse case. And the spctl check may (haven't checked) fail because of the mismatch. Seems like an edge case not yet worth covering at this stage.
The method doc comment now covers only what affects the caller. Why `spctl` runs with `--type open` is an implementation detail, so it sits inline. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
A caller that verifies before notarizing passes `verify_notarization: false`, so nothing asserted the hardened runtime that notarization will later demand. beeper/cli#64 kept its own check for exactly this. The option defaults to `false` so existing callers are unaffected. Disk images are skipped with a warning rather than failed, because a list mixing an app with its `.dmg` is a normal call. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
--- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
mokagio
added a commit
to beeper/cli
that referenced
this pull request
Nov 6, 2026
The `macos_verify_code_signing` action gained a `verify_hardened_runtime` option in wordpress-mobile/release-toolkit#782, so the lane no longer needs its own `codesign --display` check. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
mokagio
commented
Nov 6, 2026
A correctly configured call that lists an app with its `.dmg` should not print a warning. The docs now state outright that notarization implies the hardened runtime, which is why the option is for verifying before submission. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does it do?
Lets
macos_verify_code_signingverify bare binaries, identified by having no file extension, so CLIs can stop hand-rolling this check.@iangmaia asked why
beeper/clihad its own lane instead of using the action; the answer was that the action only took.appand.dmg.It also adds a
verify_hardened_runtimeoption, off by default, for app bundles and bare binaries.Notarization requires the hardened runtime, so
verify_notarizationalready covers it implicitly, but a caller verifying before submission has to turn that off.beeper/cli#64 still keeps its own check for this; once this lands it can drop it.
Gotchas
--type open --context context:primary-signature, not the--type executeused for app bundles.--type executerejects every bare binary, notarized or not, withthe code is valid but does not seem to be an app.staplercheck and the Gatekeeper result relies on an online lookup that can lag a fresh submission.Pass
verify_notarization: falsewhen verifying right after signing.verify_hardened_runtimeskips disk images instead of failing, so a list mixing an app with its.dmgstill works.How to test
The specs stub the shell commands, so I also ran the action on a notarized
beeperarm64 binary from Buildkite:Notarized Developer ID)verify_hardened_runtime, run directly against ad-hoc signed copies of/usr/bin/true, passes with--options runtime(flags=0x10002(adhoc,runtime)) and fails without it.Re-signing with Developer ID without notarizing makes
spctlitself reportrejected,source=Unnotarized Developer ID.I ran that command directly, not through the action.
Checklist before requesting a review
bundle exec rubocopto test for code style violations and recommendations.specs/*_spec.rb) if applicable.bundle exec rspecto run the whole test suite and ensure all your tests pass. Only this action's spec ran locally; the full suite is left to CI.CHANGELOG.mdfile to describe your changes under the appropriate existing###subsection of the existing## Trunksection.