Problem
An unsigned, distributed GenHub quarantines every file it writes. Gatekeeper then blocks the game binary, so the native client cannot launch at all on a machine that obtained GenHub through normal distribution.
This is a hard blocker for any public macOS build — the native launch work is unusable outside a developer machine without it.
Scope
- Playwright exclusion — Playwright artifacts must be excluded from the signed bundle; they break signing and are not needed at runtime.
- Inside-out signing — sign nested code first, then the enclosing bundle.
- Notarization of the resulting artifact.
Critical constraint
Never use codesign --deep. It is documented as unsuitable for this purpose and silently produces bundles that fail notarization or break at runtime. Sign inside-out explicitly.
Acceptance criteria
- Distributed GenHub does not quarantine files it writes.
- The game binary launches on a machine where GenHub arrived via normal distribution.
- Notarization passes and is reproducible in CI.
- No use of
codesign --deep anywhere in the pipeline.
Problem
An unsigned, distributed GenHub quarantines every file it writes. Gatekeeper then blocks the game binary, so the native client cannot launch at all on a machine that obtained GenHub through normal distribution.
This is a hard blocker for any public macOS build — the native launch work is unusable outside a developer machine without it.
Scope
Critical constraint
Never use
codesign --deep. It is documented as unsuitable for this purpose and silently produces bundles that fail notarization or break at runtime. Sign inside-out explicitly.Acceptance criteria
codesign --deepanywhere in the pipeline.