From 03b23d2616c0aa7ce30b24dcf8a054eaf53023d9 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <rstockbower@gmail.com>
Date: Tue, 11 Aug 2026 15:31:10 -0400
Subject: [PATCH] fix: verify self-signed macOS releases after signing

Closes #19
---
 .github/workflows/release.yml |  4 ----
 scripts/check-release.mjs     | 13 ++++++++++---
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9aa27e4..d938f43 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -150,10 +150,6 @@ jobs:
             echo "::error::MACOS_CERT_LEAF_SHA is not the expected stable certificate leaf"
             exit 1
           fi
-          if ! security find-identity -v -p codesigning | grep -i -F "$expected_leaf" >/dev/null; then
-            echo "::error::imported macOS signing identity does not match the expected certificate leaf"
-            exit 1
-          fi
 
       - name: Stable-sign macOS app
         if: matrix.os == 'macos-15'
diff --git a/scripts/check-release.mjs b/scripts/check-release.mjs
index b395d22..bd51264 100644
--- a/scripts/check-release.mjs
+++ b/scripts/check-release.mjs
@@ -58,9 +58,16 @@ for (const secret of [
 ]) required(workflow, secret)
 required(workflow, 'stable macOS signing credentials are required')
 required(workflow, '42e1afd02aae8666c09c15f171e1639550f301c2')
-required(workflow, 'identifier "com.rianjs.retune"')
-required(workflow, 'certificate leaf')
-required(workflow, 'codesign --verify --deep --strict')
+const verifyStepName = '- name: Verify macOS app signature'
+const verifyStep = workflow.match(/- name: Verify macOS app signature\n[\s\S]*?(?=\n      - name:)/)?.[0] ?? ''
+required(verifyStep, verifyStepName)
+required(verifyStep, 'codesign --verify --deep --strict "$app"')
+required(verifyStep, 'for target in "$executable" "$app"; do')
+required(verifyStep, 'codesign --verify --strict "$target"')
+required(verifyStep, 'requirement="$(codesign -d -r- "$target" 2>&1 | sed -n \'s/^designated => //p\')"')
+required(verifyStep, '*\'identifier "com.rianjs.retune"\'*\'certificate leaf = H"42e1afd02aae8666c09c15f171e1639550f301c2"\'*) ;;')
+required(verifyStep, '*cdhash*) echo "::error::macOS designated requirement contains cdhash for $target"; exit 1 ;;')
+assert.doesNotMatch(workflow, /security\s+find-identity/)
 assert.doesNotMatch(workflow, /--timestamp(?:=|\s)/)
 assert.doesNotMatch(workflow, /--options\s+runtime/)
 assert.doesNotMatch(workflow, /notarytool/i)