From 5a479c7143d8f2e4f543b75d4af28adaa91f8137 Mon Sep 17 00:00:00 2001 From: closer-claudio Date: Mon, 9 Nov 2026 22:46:41 -0800 Subject: [PATCH] verify-assets reads codesign's output before searching it v10.6.1.5's publish job refused scp as "not signed as org.forkcloser.scp" right after apple-verify-signed had read its Developer ID signature: verify-assets piped `codesign -d -v` into `grep -q`, which closes the pipe at its match, and codesign, still writing the longer Developer ID output, died of SIGPIPE, which pipefail reports as the pipeline's failure. The sign job had passed the same check through a file (test-binary.sh) on the same binaries. The output is captured first and searched after, as the shared verdict does. On this machine the pipe form has codesign exit 141, SIGPIPE, in a hundred runs of a hundred on /bin/ls; the captured form cannot. Co-Authored-By: Claude Fable 5.1 Signed-off-by: closer-claudio --- .justfile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.justfile b/.justfile index 8f57ada..221b490 100644 --- a/.justfile +++ b/.justfile @@ -67,7 +67,11 @@ verify-assets version: case "$(file -b "$bin")" in *Mach-O*) just do apple-verify-signed "$bin" - codesign -d -v "$bin" 2>&1 | grep -qx "Identifier=org.forkcloser.${bin##*/}" || fail "${bin##*/} is not signed as org.forkcloser.${bin##*/}" + # Captured, then searched: piped straight into grep -q, which + # closes the pipe at its match, codesign is killed by SIGPIPE + # often enough under pipefail to fail a release (v10.6.1.5). + details=$(codesign -d -v "$bin" 2>&1) || fail "codesign -d on ${bin##*/}: $details" + printf '%s\n' "$details" | grep -qx "Identifier=org.forkcloser.${bin##*/}" || fail "${bin##*/} is not signed as org.forkcloser.${bin##*/}" signed=$((signed + 1)) ;; *) ;;