Repository navigation
verify-assets reads codesign's output before searching it - #99
Merged
Merged
Conversation
v10.6.1.5's publish job refused scp as "not signed as org.forkcloser.scp" right after apple-verify-signed had read its Developer ID signature: verify-assets piped `codesign -d -v` into `grep -q`, which closes the pipe at its match, and codesign, still writing the longer Developer ID output, died of SIGPIPE, which pipefail reports as the pipeline's failure. The sign job had passed the same check through a file (test-binary.sh) on the same binaries. The output is captured first and searched after, as the shared verdict does. On this machine the pipe form has codesign exit 141, SIGPIPE, in a hundred runs of a hundred on /bin/ls; the captured form cannot. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: closer-claudio <claudio@farcloser.world>
closer-claudio
added
the
internal
closer-claudio
enabled auto-merge
November 10, 2026 06:54
Contributor
Author
|
Reviewed at 5a479c7 |
apostasie
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Why
v10.6.1.5's release run (https://github.com/forkcloser/openssh/actions/runs/42769279380) signed every binary with the Developer ID identity, hardened runtime and timestamp, passed the smoke test and packaged; its publish job then refusedscpas "not signed as org.forkcloser.scp" one line afterapple-verify-signedhad read its Developer ID signature.verify-assetspipedcodesign -d -vintogrep -q, which closes the pipe at its match;codesigndies of SIGPIPE on its next write andpipefailmakes the pipeline fail. Nothing was published: goreleaser stopped in its before hook.🛠️ What
.justfile,verify-assets:codesign's output is captured first and searched after, the shapeapple-verify-signedand the smoke test use; a failingcodesignkeeps its message.🧪 How
V: on this machine the pipe form has
codesignexit 141 in 100 runs of 100 on/bin/ls; the captured form cannot be killed by the reader. V: a fabricated archive of ad hocorg.forkcloser.*binaries with an SPDX document passesjust verify-assets;just lintgreen. The next tag runs the lane again.