Talon/voice-cat
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Fix ad-hoc macOS publishing
Build and test / test (macos-latest) (push) Canceled after 0s
Details
Build and test / test (ubuntu-24.04) (push) Canceled after 0s
Details
Build and test / test (windows-latest) (push) Canceled after 0s
Details
Build and test / apple-client (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Talon
2026-09-21 02:14:24 +02:00
parent 6de95ddaa1
commit 239e8e9013
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
clients/apple/README.md
+4 -3
View File
@@ -13,9 +13,10 @@ dotnet restore clients/apple/VoiceCat.Apple.slnx
dotnet build clients/apple/VoiceCat.Apple.slnx -c Debug --no-restore dotnet build clients/apple/VoiceCat.Apple.slnx -c Debug --no-restore
``` ```
Use `publish-macos.sh --dry-run` to validate an ad-hoc macOS bundle. For distribution, set Use `publish-macos.sh --dry-run` to validate a local ad-hoc macOS bundle. The dry-run build does
`VOICECAT_CODESIGN_IDENTITY`; optional notarization uses `APPLE_ID`, `APPLE_TEAM_ID`, and not enable hardened runtime because ad-hoc signatures have no Team ID and cannot satisfy macOS
`APPLE_APP_PASSWORD`. library validation. Distribution builds remain hardened and require `VOICECAT_CODESIGN_IDENTITY`;
optional notarization uses `APPLE_ID`, `APPLE_TEAM_ID`, and `APPLE_APP_PASSWORD`.
For a physical iOS device, use `build-ios-device.sh` and `deploy-ios-device.sh`. The host and For a physical iOS device, use `build-ios-device.sh` and `deploy-ios-device.sh`. The host and
ReplayKit extension require signing profiles with App Group `group.me.iamtalon.voicecat`. ReplayKit extension require signing profiles with App Group `group.me.iamtalon.voicecat`.
clients/apple/publish-macos.sh
Regular → Executable
+11 -3
View File
@@ -19,7 +19,16 @@ if [[ ${1:-} == "--dry-run" ]]; then
dry_run=1 dry_run=1
fi fi
"$dotnet_host" publish "$project" -c "$configuration" --no-restore -p:ArchiveOnBuild=false publish_properties=(-p:ArchiveOnBuild=false)
if (( dry_run )); then
# Hardened-runtime library validation requires the executable and every bundled dylib to
# have the same real Team ID. Ad-hoc signatures have no Team ID, so a hardened ad-hoc app
# passes codesign verification but is rejected by dyld at launch. Keep local validation
# ad-hoc and reserve the hardened runtime for the Developer ID distribution path below.
publish_properties+=(-p:UseHardenedRuntime=false)
fi
"$dotnet_host" publish "$project" -c "$configuration" --no-restore "${publish_properties[@]}"
built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app" built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app"
if [[ ! -d "$built_app" ]]; then if [[ ! -d "$built_app" ]]; then
print -u2 "VoiceCat.app was not produced at $built_app" print -u2 "VoiceCat.app was not produced at $built_app"
@@ -37,8 +46,7 @@ mkdir -p "$distribution"
ditto "$built_app" "$app" ditto "$built_app" "$app"
if (( dry_run )); then if (( dry_run )); then
# The workload may preserve mixed ad-hoc signatures on nested runtime dylibs. Re-sign the # Normalize the workload's mixed nested signatures after bundling.
# complete local bundle as one ad-hoc unit so hardened-runtime Team-ID checks are meaningful.
codesign --force --deep --sign - "$app" codesign --force --deep --sign - "$app"
codesign --verify --deep --strict "$app" codesign --verify --deep --strict "$app"
spctl --assess --type execute "$app" 2>/dev/null || true spctl --assess --type execute "$app" 2>/dev/null || true