From e18300f5b9a92868d14855cb6c875f3d6f9abd6c Mon Sep 17 00:00:00 2001 From: Evan Sosenko Date: Wed, 5 Aug 2026 14:53:29 -0700 Subject: [PATCH 1/3] Delete .github/workflows/build.yml --- .github/workflows/build.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 .github/workflows/build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index e530b969..00000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -name: Build - -run-name: Build ${{ github.ref_name }} - -on: - workflow_dispatch: {} - -jobs: - build: - name: Build - uses: ./.github/workflows/_build.yml - secrets: inherit From fee7dc3f71d88e2148ea7216286d00f0464ab87a Mon Sep 17 00:00:00 2001 From: Evan Sosenko Date: Wed, 5 Aug 2026 14:55:26 -0700 Subject: [PATCH 2/3] Rename macOS binaries job to macOS --- .github/workflows/_build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml index f0a9984e..9d59895e 100644 --- a/.github/workflows/_build.yml +++ b/.github/workflows/_build.yml @@ -105,7 +105,7 @@ jobs: release/* macos: - name: macOS binaries + name: macOS runs-on: macos-latest timeout-minutes: 60 steps: From 9838eb050aa7dba20ecce8a42ccaca770af41236 Mon Sep 17 00:00:00 2001 From: Evan Sosenko Date: Wed, 5 Aug 2026 15:00:27 -0700 Subject: [PATCH 3/3] Enhance code signing checks in build workflow Updated code signing verification process to check notarization status. --- .github/workflows/_build.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml index 9d59895e..a535acb4 100644 --- a/.github/workflows/_build.yml +++ b/.github/workflows/_build.yml @@ -282,11 +282,13 @@ jobs: codesign --display --verbose=2 --entitlements - "$signed" done - # How Gatekeeper sees the binary. Reported rather than enforced: the - # notary service already accepted it, and the ticket is fetched over - # the network, so a rejection here is not conclusive. - spctl --assess --type exec --verbose=4 "$binary" || - echo "::warning title=Gatekeeper assessment failed::spctl rejected ${binary}." + # Whether the notary service published a ticket for this code. + # Reported rather than enforced: notarytool already accepted the + # submission, and the ticket is fetched over the network, so a + # failure here is not conclusive. Gatekeeper itself cannot be + # asked, since spctl only assesses an app bundle. + codesign --test-requirement="=notarized" --verify --verbose "$binary" || + echo "::warning title=Gatekeeper assessment failed::codesign rejected ${binary}." else echo '::warning title=Unsigned macOS binaries::Built with sign: false. These binaries are not signed by Seam and must not be released.' fi