From 212fa457d61e2d7027cb9f844f7fff8df95b2ca4 Mon Sep 17 00:00:00 2001 From: Filip Leonarski Date: Wed, 14 Oct 2026 18:35:05 +0200 Subject: [PATCH] CI macOS: hardened-runtime checks read codesign's output from a file The viewer-bundle and rugnux-tarball checks piped `codesign -d` into `grep -q`. grep exits at the first match, codesign then dies of SIGPIPE (141), and under `set -o pipefail` that is the pipeline's status, so a correctly signed bundle was reported as "no hardened runtime". Both checks now write to a file and grep it, as the other checks in this workflow do, and print the signature when they fail. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/build_and_test.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build_and_test.yml b/.gitea/workflows/build_and_test.yml index 01b7ed1b3..b69ad25e5 100644 --- a/.gitea/workflows/build_and_test.yml +++ b/.gitea/workflows/build_and_test.yml @@ -294,7 +294,9 @@ jobs: # rugnux is in an archive of its own, not in the app find "$app" -name rugnux > /tmp/jfjv.extra if [ -s /tmp/jfjv.extra ]; then cat /tmp/jfjv.extra; echo "the bundle carries another program"; exit 1; fi - codesign -d --verbose=2 "$app" 2>&1 | grep -q "flags=.*runtime" || { echo "no hardened runtime"; exit 1; } + # to a file, not piped into `grep -q` (see "Verify rugnux is self-contained" above) + codesign -d --verbose=2 "$app" > /tmp/jfjv.sig 2>&1 + if ! grep -q "flags=.*runtime" /tmp/jfjv.sig; then cat /tmp/jfjv.sig; echo "no hardened runtime"; exit 1; fi echo "self-contained and validly signed" - name: Verify rugnux is self-contained shell: bash @@ -311,7 +313,8 @@ jobs: if ! grep -qi "usage" /tmp/rgxm.out; then cat /tmp/rgxm.out; echo "rugnux did not start"; exit 1; fi # and carries the Developer ID signature with the hardened runtime that notarization demands codesign --verify --strict "$bin" - codesign -d --verbose=2 "$bin" 2>&1 | grep -q "flags=.*runtime" || { echo "no hardened runtime"; exit 1; } + codesign -d --verbose=2 "$bin" > /tmp/rgxm.sig 2>&1 + if ! grep -q "flags=.*runtime" /tmp/rgxm.sig; then cat /tmp/rgxm.sig; echo "no hardened runtime"; exit 1; fi echo "self-contained, runs and is validly signed" # Every push, not only a release: a rejection by Apple (a library macdeployqt left unsigned, an # entitlement the hardened runtime needs) should show up when the change is made, not when the