Skip to content

Commit b672468

Browse files
committed
fix(axe): Ad-hoc sign bundled AXe artifacts
Apply ad-hoc signatures to AXe and bundled framework binaries when source artifacts are unsigned so runtime execution works after Homebrew installation.
1 parent 2801a43 commit b672468

1 file changed

Lines changed: 24 additions & 1 deletion

File tree

scripts/bundle-axe.sh

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,11 +166,34 @@ echo "📦 Copied $FRAMEWORK_COUNT frameworks"
166166
echo "🔍 Bundled frameworks:"
167167
ls -la "$BUNDLED_DIR/Frameworks/"
168168

169+
ad_hoc_sign_bundled_axe_assets() {
170+
echo "🔏 Applying ad-hoc signatures to bundled AXe assets..."
171+
172+
while IFS= read -r framework_path; do
173+
framework_name="$(basename "$framework_path" .framework)"
174+
framework_binary="$framework_path/Versions/A/$framework_name"
175+
if [ ! -f "$framework_binary" ]; then
176+
framework_binary="$framework_path/Versions/Current/$framework_name"
177+
fi
178+
if [ ! -f "$framework_binary" ]; then
179+
echo "❌ Framework binary not found: $framework_binary"
180+
exit 1
181+
fi
182+
codesign --force --deep --sign - "$framework_binary"
183+
done < <(find "$BUNDLED_DIR/Frameworks" -name "*.framework" -type d)
184+
185+
codesign --force --deep --sign - "$BUNDLED_DIR/axe"
186+
}
187+
169188
# Verify binary can run with bundled frameworks (macOS only)
170189
OS_NAME="$(uname -s)"
171190
if [ "$OS_NAME" = "Darwin" ]; then
191+
if ! codesign -dv "$BUNDLED_DIR/axe" >/dev/null 2>&1; then
192+
ad_hoc_sign_bundled_axe_assets
193+
fi
194+
172195
if [ "$AXE_ARCHIVE_FLAVOR" = "homebrew-unsigned" ]; then
173-
echo "ℹ️ Skipping strict codesign verification for unsigned AXe Homebrew archive"
196+
echo "ℹ️ Homebrew AXe archive detected; using ad-hoc signatures for local runtime compatibility"
174197
else
175198
echo "🔏 Verifying AXe signatures..."
176199
if ! codesign --verify --deep --strict "$BUNDLED_DIR/axe"; then

0 commit comments

Comments
 (0)