From 88d10259d4e29320b3f370a3874908dca8e9464c Mon Sep 17 00:00:00 2001 From: Philipp Wagner Date: Fri, 16 Oct 2026 11:19:26 +0200 Subject: [PATCH] Retry stapler when Apple's ticket service drops the connection (#131) Three nightly macOS DMG builds on the Intel runner failed in a row after a successful notarization: `xcrun stapler validate` lost its connection to api.apple-cloudkit.com ("The network connection was lost.", exit 68). The ticket was fine; the runner's connection to Apple was not. staple and validate now get up to five attempts with growing pauses (20, 40, 80, 160 s) before the build fails. Co-authored-by: Claude Opus 5.5 --- packaging/macos/build-signed-dmg.sh | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/packaging/macos/build-signed-dmg.sh b/packaging/macos/build-signed-dmg.sh index 6cb136dc..526dc014 100755 --- a/packaging/macos/build-signed-dmg.sh +++ b/packaging/macos/build-signed-dmg.sh @@ -292,12 +292,29 @@ echo "==> Built $DMG" echo "==> Step 4/4: verification" +# stapler talks to Apple's CloudKit ticket service. On the hosted Intel runners +# that connection drops now and then ("The network connection was lost.", +# exit 68) although the ticket is fine, so a lost connection is retried. +with_retries() { + local attempt=1 max_attempts=5 delay=20 + until "$@"; do + if [ "$attempt" -ge "$max_attempts" ]; then + echo " giving up after $attempt attempts: $*" >&2 + return 1 + fi + echo " attempt $attempt failed, retrying in ${delay}s: $*" >&2 + sleep "$delay" + attempt=$((attempt + 1)) + delay=$((delay * 2)) + done +} + if [ ${#NOTARY_ARGS[@]} -gt 0 ]; then echo " submitting for notarization (waits for Apple's verdict)" # Without a timeout a stalled submission would hang a CI job forever. xcrun notarytool submit "$DMG" "${NOTARY_ARGS[@]}" --wait --timeout 30m echo " stapling ticket" - xcrun stapler staple "$DMG" + with_retries xcrun stapler staple "$DMG" else echo " no notarization credentials set, skipping notarization" fi @@ -333,7 +350,7 @@ spctl --assess --type execute --verbose=4 "$SHIPPED_APP" || true if [ ${#NOTARY_ARGS[@]} -gt 0 ]; then echo "--- stapler validate ---" - xcrun stapler validate "$DMG" + with_retries xcrun stapler validate "$DMG" fi echo