Skip to content

fix(macos): codesign KDF with hardened runtime and timestamp #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
CharlVS wants to merge 3 commits into
base: dev
Choose a base branch
from
Draft

fix(macos): codesign KDF with hardened runtime and timestamp #6

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d13f6d9
fix(macos): codesign KDF binary in all configs; keep Release re-sign …
CharlVS Oct 15, 2025
0d6ba9a
fix(macos): timestamped codesigning with hardened runtime for KDF bin…
CharlVS Oct 15, 2025
ffa7663
fix(macos): refactor codesign helper, fix error newlines, avoid Relea…
CharlVS Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 20 additions & 6 deletions packages/komodo_defi_framework/macos/komodo_defi_framework.podspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,15 @@ A new Flutter FFI plugin project.
echo "Warning: libkdflib.dylib not found in lib/libkdflib.dylib"
fi

# Helper to codesign with hardened runtime + timestamp (best-effort)
kdf_codesign() {
# args: path-to-binary
local bin_path="$1"
[ -n "$EXPANDED_CODE_SIGN_IDENTITY" ] || return 0
[ -f "$bin_path" ] || return 0
codesign --force --options runtime --timestamp=auto --sign "$EXPANDED_CODE_SIGN_IDENTITY" "$bin_path" 2>/dev/null || true
}

# Prune binary slices to match $ARCHS (preserve universals) in Release builds only
if [ "$CONFIGURATION" = "Release" ]; then
TARGET_ARCHS="${ARCHS:-$(arch)}"
Expand Down Expand Up @@ -102,16 +111,21 @@ A new Flutter FFI plugin project.
thin_binary_to_archs "$FRAMEWORKS_DIR/libkdflib.dylib" "$TARGET_ARCHS"
if [ -f "$FRAMEWORKS_DIR/libkdflib.dylib" ]; then install_name_tool -id "@rpath/libkdflib.dylib" "$FRAMEWORKS_DIR/libkdflib.dylib"; fi

# Re-sign after modifications (best-effort)
if [ -n "$EXPANDED_CODE_SIGN_IDENTITY" ]; then
codesign --force --sign "$EXPANDED_CODE_SIGN_IDENTITY" "$APP_SUPPORT_DIR/kdf" 2>/dev/null || true
codesign --force --sign "$EXPANDED_CODE_SIGN_IDENTITY" "$FRAMEWORKS_DIR/libkdflib.dylib" 2>/dev/null || true
fi
# Re-sign after modifications (best-effort) with hardened runtime and timestamp
kdf_codesign "$APP_SUPPORT_DIR/kdf"
kdf_codesign "$FRAMEWORKS_DIR/libkdflib.dylib"
fi

# Sign kdf and dylib in non-Release configurations only to avoid double-signing
if [ "$CONFIGURATION" != "Release" ]; then
kdf_codesign "$APP_SUPPORT_DIR/kdf"
kdf_codesign "$FRAMEWORKS_DIR/libkdflib.dylib"
fi

# Fail if neither file was found
if [ $FOUND_REQUIRED_FILE -eq 0 ]; then
echo "Error: Neither kdf executable nor libkdflib.dylib was found. At least one is required."
printf "\n\nError: Neither kdf executable nor libkdflib.dylib was found. At least one is required.\n"
printf "Please try run flutter clean && flutter build bundle and try again.\n\n"
exit 1
fi
SCRIPT
Expand Down