Skip to content

emrg: pkg 内嵌 runtime codesign — .so/dylib/python 二进制 Developer ID 签名（第 10 次构建公证 Invalid 根因） #475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
argszero merged 2 commits into from
Aug 6, 2026
Merged

emrg: pkg 内嵌 runtime codesign — .so/dylib/python 二进制 Developer ID 签名（第 10 次构建公证 Invalid 根因） #475

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9b4335a
emrg: pkg 内嵌 runtime codesign — .so/dylib/python 二进制 Developer ID 签名（…
Aug 6, 2026
c39183f
emrg: runtime codesign 补 hardened runtime — --options runtime（第 10 次构…
Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions packaging/make-installer.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,29 @@ case "$PLATFORM" in
mkdir -p "$PKG_ROOT/payload/emrg-gui"
cp -R "$RUNTIME/." "$PKG_ROOT/payload/"
cp -R "$GUI_APP" "$PKG_ROOT/payload/emrg-gui/EMRG.app"
# macOS 公证要求 pkg 内所有 Mach-O 二进制都有 Developer ID 签名 + 时间戳 +
# hardened runtime（第 10 次构建教训：Python runtime 的 .so/dylib 未签名 →
# notarytool Invalid statusCode 4000，12 个文件报三类错：
# "not signed with a valid Developer ID certificate"
# "does not include a secure timestamp"
# "does not have the hardened runtime enabled"）。
# 对 payload 内除 EMRG.app（electron-builder 已签）外的所有 Mach-O 签名。
# --options runtime = hardened runtime（缺它会触发第三类错误）；实测 OK。
if [ "$(uname -s)" = "Darwin" ] && command -v codesign >/dev/null; then
SIGN_ID="$(security find-identity -v -p codesigning 2>/dev/null | grep 'Developer ID Application' | head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
if [ -n "$SIGN_ID" ]; then
echo "==> codesign runtime binaries（公证要求：Developer ID + timestamp + hardened runtime）"
# 收集 payload 内所有 Mach-O（.so / 无扩展名可执行 / Python 解释器）
# 排除 EMRG.app（electron-builder 已签）与"卸载 EMRG.app"（纯 bash 脚本无 Mach-O）
find "$PKG_ROOT/payload" -path '*EMRG.app' -prune -o -path '*卸载 EMRG.app' -prune -o \
-type f \( -name '*.so' -o -name '*.dylib' -o -name 'python*' -o -name 'emrgd' -o -name 'emrg' -o -name 'emrg-uninstall' \) \
-exec file {} + 2>/dev/null | grep 'Mach-O' | grep -v 'for architecture' | cut -d: -f1 | sort -u | while read -r BIN; do
codesign --force --timestamp --options runtime --sign "$SIGN_ID" "$BIN" 2>/dev/null && echo " ✓ $(basename "$BIN")" || echo " ✗ 跳过 $(basename "$BIN")"
done
else
echo "!! 未找到 Developer ID Application 身份，跳过 runtime codesign（公证可能失败）" >&2
fi
fi
# 生成"卸载 EMRG.app"（R30/R31/R102：bash 包装调 emrg-uninstall + 删主 GUI + 提示拖废纸篓）
UNINSTALL_APP="$PKG_ROOT/payload/emrg-gui/卸载 EMRG.app"
mkdir -p "$UNINSTALL_APP/Contents/MacOS"
Expand Down
Loading