From 0f6892c123fc9b3e46d456be86a462ec610041e6 Mon Sep 17 00:00:00 2001 From: jwinterm Date: Sat, 29 Aug 2026 14:17:26 -0400 Subject: [PATCH] =?UTF-8?q?ci(macos):=20ad-hoc=20sign=20tor=20before=20emb?= =?UTF-8?q?edding=20=E2=80=94=20arm64=20macOS=20SIGKILLs=20unsigned=20bina?= =?UTF-8?q?ries,=20including=20the=20runtime-unpacked=20copy=20on=20user?= =?UTF-8?q?=20machines?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitea/workflows/build-macos.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitea/workflows/build-macos.yml b/.gitea/workflows/build-macos.yml index 1ce4d173..71a93e9a 100644 --- a/.gitea/workflows/build-macos.yml +++ b/.gitea/workflows/build-macos.yml @@ -68,6 +68,10 @@ jobs: curl -L -o /tmp/teb.tgz "https://archive.torproject.org/tor-package-archive/torbrowser/15.0/$TORTAR" tar xzf /tmp/teb.tgz -C /tmp/teb cp /tmp/teb/tor/tor /tmp/teb/tor/libevent-*.dylib /tmp/tor-embed/ + # tor ships UNSIGNED; arm64 macOS SIGKILLs unsigned binaries. Ad-hoc sign + # BEFORE embedding — the signature travels inside the file, so the copy + # the app unpacks at runtime on user machines is runnable too. + codesign -s - -f /tmp/tor-embed/tor /tmp/tor-embed/libevent-*.dylib chmod +x /tmp/tor-embed/tor # expert-bundle RELEASE number (15.0) is NOT the tor version — derive it TORVER=$(/tmp/tor-embed/tor --version | grep -oE '[0-9]+(\.[0-9]+){3}' | head -1)