From fb2ff19119260f90d7cc1cb808759fc06b274c2c Mon Sep 17 00:00:00 2001
From: Daniel Ehrhardt <daniel.ehrhardt@codext.de>
Date: Wed, 28 Oct 2026 21:05:26 +0100
Subject: [PATCH] Read the signing certificate from relative paths in
 macos-verify.sh

The certificate was extracted after a cd into a temp folder, so relative
paths (as the release workflow passes them) were not found and the check
exited without a message. Extract with a path prefix instead.
---
 scripts/macos-verify.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/macos-verify.sh b/scripts/macos-verify.sh
index 6c5078a9..c7f0b323 100755
--- a/scripts/macos-verify.sh
+++ b/scripts/macos-verify.sh
@@ -39,8 +39,8 @@ signer() {
 certificate() {
   local dir="$WORK/certs-$RANDOM"
   mkdir -p "$dir"
-  (cd "$dir" && codesign -d --extract-certificates "$1" 2>/dev/null)
-  local leaf="$dir/codesign0"
+  codesign -d --extract-certificates="$dir/cert" "$1" 2>/dev/null || true
+  local leaf="$dir/cert0"
   [ -f "$leaf" ] || fail "could not read the signing certificate of $1"
   local until
   until="$(openssl x509 -inform DER -in "$leaf" -noout -enddate | cut -d= -f2)"