From 7aa2fbe3ffc4537b968f2e38fa491433115e53c5 Mon Sep 17 00:00:00 2001 From: mattsigal Date: Sat, 25 Jul 2026 02:25:11 -0700 Subject: [PATCH 1/2] =?UTF-8?q?=EF=BB=BFfix(ci):=20remove=20CODE=5FSIGNING?= =?UTF-8?q?=5FREQUIRED=3DNO=20from=20unsigned=20macOS=20builds?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On GitHub Actions PR builds from forks/branches, secrets are not present, triggering an unsigned build. Passing CODE_SIGNING_REQUIRED=NO to xcodebuild causes CocoaPods framework scripts to skip ad-hoc signing bundled pod frameworks (e.g., Avfilter.framework). Xcode's subsequent CodeSign phase fails with exit code 65 due to unsigned subcomponents. Removing this flag ensures CocoaPods ad-hoc signs all embedded pod frameworks before app signing. --- build-macos.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-macos.sh b/build-macos.sh index 0528f46f1..f17886600 100755 --- a/build-macos.sh +++ b/build-macos.sh @@ -130,7 +130,7 @@ ARCHIVE_CMD=( archive ) if [ "$UNSIGNED" = "1" ]; then - ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" CODE_SIGNING_REQUIRED=NO ) + ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" ) else ARCHIVE_CMD+=( CODE_SIGN_STYLE=Automatic ) if [ -n "$TEAM_ID" ]; then From 4b2b79a4da114d208cc3c431e41c1d7ba5ed66fb Mon Sep 17 00:00:00 2001 From: RadicalMuffinMan <103554043+RadicalMuffinMan@users.noreply.github.com> Date: Sat, 25 Jul 2026 23:37:00 -0400 Subject: [PATCH 2/2] updated macOS build scripts comments --- .github/workflows/build.yml | 8 ++++---- build-macos.sh | 7 ++++++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f2cb82235..830896c4a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -168,11 +168,11 @@ jobs: MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }} MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} run: | - # On PRs from forks the certificate secret is not available. Skip the - # signing setup; build-macos.sh produces an unsigned build when no - # identity is present. + # On PRs from forks the certificate secret isn't available, so skip + # the signing setup. build-macos.sh falls back to an ad-hoc signature + # when no identity is present. if [ -z "$MACOS_CERTIFICATE_BASE64" ]; then - echo "No macOS certificate secret; skipping signing setup (unsigned build)." + echo "No macOS certificate secret, skipping signing setup (ad-hoc signed build)." exit 0 fi diff --git a/build-macos.sh b/build-macos.sh index f17886600..1a5379199 100755 --- a/build-macos.sh +++ b/build-macos.sh @@ -97,7 +97,7 @@ fi UNSIGNED=0 if [ -z "$APP_SIGN_ID" ] && [ -z "$TEAM_ID" ]; then UNSIGNED=1 - echo "No signing identity available, building unsigned so PR builds still run." + echo "No signing identity available, ad-hoc signing so PR builds still run." PBXPROJ="$REPO_ROOT/macos/Runner.xcodeproj/project.pbxproj" cp "$PBXPROJ" "$PBXPROJ.signing.bak" trap 'mv -f "$PBXPROJ.signing.bak" "$PBXPROJ" 2>/dev/null || true' EXIT @@ -130,6 +130,11 @@ ARCHIVE_CMD=( archive ) if [ "$UNSIGNED" = "1" ]; then + # Ad-hoc sign rather than skipping signing. Don't add CODE_SIGNING_REQUIRED=NO + # here, because the CocoaPods framework script and the embedded emulator cores + # both check it and leave their bundles unsigned, which then fails the final + # CodeSign of the app. Arm64 binaries also need at least an ad-hoc signature + # to launch at all. ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" ) else ARCHIVE_CMD+=( CODE_SIGN_STYLE=Automatic )