snxraven/peardock
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Codesign peardock-server for macOS in CI
Release rolling / release (push) Successful in 8m29s
Details

Browse Source 
Gatekeeper reported the Bare server binary as damaged because it only
had a linker ad-hoc stamp after embed. Seal darwin server binaries with
the same sign-macos path used for Electron apps (codesign / rcodesign).
This commit is contained in:
Raven Scott
2026-07-16 06:30:43 -04:00
parent 658bc1ee59
commit cb93897d5d
10 changed files with 184 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RELEASE.md
+7 -5
View File
@@ -8,8 +8,8 @@ No 32-bit (`ia32` / `armv7`) builds.
|------|---------------|-------------------|
| `linux-x64` | yes (cross) | yes (cross via electron-forge) |
| `linux-arm64` | yes | yes |
| `darwin-x64` | yes | yes (unsigned / ad-hoc from Linux CI) |
| `darwin-arm64` | yes | yes (unsigned / ad-hoc from Linux CI) |
| `darwin-x64` | yes (codesigned in CI) | yes (codesigned in CI) |
| `darwin-arm64` | yes (codesigned in CI) | yes (codesigned in CI) |
| `win32-x64` | yes | yes |
| `win32-arm64` | yes | yes |
@@ -96,9 +96,11 @@ Published assets are consumed by:
### Notes
- **macOS clients** are **ad-hoc codesigned** after package (`scripts/sign-macos-app.cjs`) so Gatekeeper does not show “damaged / move to Trash”. CI installs `rcodesign` to ad-hoc sign darwin `.app`s built on Linux. For Developer ID + notarization, set `MAC_CODESIGN_IDENTITY` / `CSC_NAME` on a Mac (or import certs in CI).
- Re-sign a local/downloaded build: `npm run sign:macos -- out/peardock-darwin-arm64/peardock.app`
- If the app is still blocked: `xattr -cr ~/Applications/peardock.app` or right-click → Open.
- **macOS clients** (`.app`) and **peardock-server** binaries are **codesigned** after build (`scripts/sign-macos-app.cjs`) so Gatekeeper does not show “damaged / move to Trash”. Server signing runs inside `bare-standalone.cjs` for every `darwin-*` host; client signing runs in Electron Forge `postPackage`. CI installs vendored `rcodesign` to seal darwin artifacts built on Linux. For Developer ID + notarization, set `MAC_CODESIGN_IDENTITY` / `CSC_NAME` on a Mac (or import certs in CI).
- Re-sign a local/downloaded build:
- Client: `npm run sign:macos -- out/peardock-darwin-arm64/peardock.app`
- Server: `npm run sign:macos -- out/peardock-server-darwin-arm64/peardock-server`
- If still blocked: `xattr -cr <path>` or right-click → Open. Skip signing with `PEARDOCK_SKIP_MACOS_SIGN=1` (not recommended for release).
- **Native modules** must ship prebuilds for each target (Holepunch stack does). Rebuild-from-source is disabled for cross packages (`npm_config_build_from_source=false`).
- **Server** cross-compile uses bare-runtime platform prebuilds (no Docker-in-Docker required to *build*; runtime still needs a Docker socket).