From 2b5aa6a9fe541e83f1b315620a0c4c5b33876b80 Mon Sep 17 00:00:00 2001 From: Philipp Wagner Date: Sat, 22 Aug 2026 16:28:37 +0200 Subject: [PATCH] Sign bundle contents serially Signing the app image's Mach-O files with "xargs -P 8" passed locally but failed on a runner: codesign reported "replacing existing signature" and then "No such file or directory" for that same path. The two libjli.dylib copies are separate inodes, so this is not hard links being signed twice -- concurrent codesign runs over one bundle are simply not reliable. Serially costs about a minute, since each call waits on Apple's timestamp server. Also stop the matrix from cancelling the other architecture on a failure; that throws away half the diagnostic information from a failed run. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WYcmHra3YndA1ahkHeNdJ2 --- .github/workflows/nightly-artifacts.yml | 1 + .github/workflows/tagged-release.yml | 1 + packaging/macos/build-signed-dmg.sh | 9 ++++++--- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nightly-artifacts.yml b/.github/workflows/nightly-artifacts.yml index 4e813f3..0f93c5c 100644 --- a/.github/workflows/nightly-artifacts.yml +++ b/.github/workflows/nightly-artifacts.yml @@ -609,6 +609,7 @@ jobs: name: Build macOS DMG (${{ matrix.os }}) runs-on: ${{ matrix.os }} strategy: + fail-fast: false matrix: os: [macos-latest, macos-15-intel] diff --git a/.github/workflows/tagged-release.yml b/.github/workflows/tagged-release.yml index 716f2b5..d913355 100644 --- a/.github/workflows/tagged-release.yml +++ b/.github/workflows/tagged-release.yml @@ -506,6 +506,7 @@ jobs: name: Build macOS DMG (${{ matrix.os }}) runs-on: ${{ matrix.os }} strategy: + fail-fast: false matrix: os: [macos-latest, macos-15-intel] diff --git a/packaging/macos/build-signed-dmg.sh b/packaging/macos/build-signed-dmg.sh index bbcaa92..e3691e6 100755 --- a/packaging/macos/build-signed-dmg.sh +++ b/packaging/macos/build-signed-dmg.sh @@ -142,9 +142,12 @@ done > "$MACHO_LIST" COUNT="$(wc -l < "$MACHO_LIST" | tr -d ' ')" echo " $COUNT Mach-O files to sign" -# codesign contacts Apple's timestamp server on every call, so run a handful in -# parallel or this takes far longer than it needs to. -xargs -P 8 -I {} codesign --force --timestamp --options runtime \ +# Serially, deliberately. Running codesign concurrently over several files of +# the same bundle fails intermittently -- a CI run died with "replacing existing +# signature" immediately followed by "No such file or directory" for that same +# path, while the identical script passed locally. Each call contacts Apple's +# timestamp server, so this costs about a minute for a runtime this size. +xargs -I {} codesign --force --timestamp --options runtime \ --sign "$FULL_IDENTITY" {} < "$MACHO_LIST" rm -f "$MACHO_LIST"