fix: sign bundled DB tools with Developer ID for notarization #15

2026-09-04T02:02:49Z

adrianbonpin commented

2026-09-04 02:02:49 +00:00

Apple's notary service rejects ad-hoc-signed nested executables. The bundled pg_dump/pg_restore/psql + libpq and mariadb/mariadb-dump + OpenSSL dylibs must be signed with the Developer ID Application certificate, with hardened runtime (--options runtime) and a secure timestamp (--timestamp).

Moves signing-identity detection before the tool builds and signs the tools with $SIGNING_IDENTITY instead of ad-hoc. This is what made the v0.7.13 macOS notarization pass.

Apple's notary service rejects ad-hoc-signed nested executables. The bundled pg_dump/pg_restore/psql + libpq and mariadb/mariadb-dump + OpenSSL dylibs must be signed with the Developer ID Application certificate, with hardened runtime (--options runtime) and a secure timestamp (--timestamp). Moves signing-identity detection before the tool builds and signs the tools with $SIGNING_IDENTITY instead of ad-hoc. This is what made the v0.7.13 macOS notarization pass.

adrianbonpin added 1 commit 2026-09-04 02:02:50 +00:00

fix: sign bundled DB tools with Developer ID for notarization 8e643711d1

Apple's notary service rejects ad-hoc-signed nested executables. The
bundled pg_dump/pg_restore/psql + libpq and mariadb/mariadb-dump +
OpenSSL dylibs must be signed with the Developer ID Application
certificate, with hardened runtime (--options runtime) and a secure
timestamp (--timestamp).

Move the signing-identity detection before the tool builds and sign the
tools with $SIGNING_IDENTITY instead of ad-hoc.

adrianbonpin merged commit 867df98958 into prod

2026-09-04 02:02:55 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adrianbonpin/gridline#15