fix: sign bundled DB tools with Developer ID for notarization #15

Merged

adrianbonpin merged 1 commits from fix/macos-tool-signing into prod

2026-09-04 02:02:55 +00:00

Author	SHA1	Message	Date
adrianbonpin	8e643711d1	fix: sign bundled DB tools with Developer ID for notarization Apple's notary service rejects ad-hoc-signed nested executables. The bundled pg_dump/pg_restore/psql + libpq and mariadb/mariadb-dump + OpenSSL dylibs must be signed with the Developer ID Application certificate, with hardened runtime (--options runtime) and a secure timestamp (--timestamp). Move the signing-identity detection before the tool builds and sign the tools with $SIGNING_IDENTITY instead of ad-hoc.	2026-09-04 09:52:38 +08:00

Author

SHA1

Message

Date

adrianbonpin

8e643711d1

fix: sign bundled DB tools with Developer ID for notarization

Apple's notary service rejects ad-hoc-signed nested executables. The
bundled pg_dump/pg_restore/psql + libpq and mariadb/mariadb-dump +
OpenSSL dylibs must be signed with the Developer ID Application
certificate, with hardened runtime (--options runtime) and a secure
timestamp (--timestamp).

Move the signing-identity detection before the tool builds and sign the
tools with $SIGNING_IDENTITY instead of ad-hoc.

2026-09-04 09:52:38 +08:00