On Apple Silicon (arm64) macOS, all executable code must possess a valid code signature. At an absolute minimum, an ad-hoc signature (codesign -s -) is required. If an unsigned Mach-O binary is executed, the macOS kernel will immediately terminate it with SIGKILL (Killed: 9).
While Tauri automatically signs the main application bundle (ICCery.app), sidecar binaries and resources bundled via tauri.conf.json ("resources": ["argyll/**/*"]) may not be deeply signed by default, especially if they are downloaded dynamically and placed in the Resources directory instead of MacOS or Frameworks.
Since the argyllcms binaries downloaded by fetch-argyll.mjs are unsigned (as they are built natively via Jam without codesign steps in the upstream repository), they will fail to execute on Apple Silicon Macs unless explicitly signed.
Upstream Fix Implemented:
Upstream fix has been completed and released in gronod/argyllcms#32 via tag v3.5.0-ICCery.1.5.
All macOS binaries (x86_64, arm64, and universal) are now automatically ad-hoc signed in makepackagebin.sh and verified with codesign -dvv in the CI build pipeline.
fetch-argyll.mjs will automatically stage the signed binaries.
On Apple Silicon (arm64) macOS, all executable code must possess a valid code signature. At an absolute minimum, an ad-hoc signature (`codesign -s -`) is required. If an unsigned Mach-O binary is executed, the macOS kernel will immediately terminate it with `SIGKILL` (Killed: 9).
While Tauri automatically signs the main application bundle (`ICCery.app`), sidecar binaries and resources bundled via `tauri.conf.json` (`"resources": ["argyll/**/*"]`) may not be deeply signed by default, especially if they are downloaded dynamically and placed in the `Resources` directory instead of `MacOS` or `Frameworks`.
Since the `argyllcms` binaries downloaded by `fetch-argyll.mjs` are unsigned (as they are built natively via Jam without codesign steps in the upstream repository), they will fail to execute on Apple Silicon Macs unless explicitly signed.
**Upstream Fix Implemented:**
- Upstream fix has been completed and released in [gronod/argyllcms#32](https://git.i3omb.com/gronod/argyllcms/issues/32) via tag `v3.5.0-ICCery.1.5`.
- All macOS binaries (`x86_64`, `arm64`, and `universal`) are now automatically ad-hoc signed in `makepackagebin.sh` and verified with `codesign -dvv` in the CI build pipeline.
- `fetch-argyll.mjs` will automatically stage the signed binaries.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
On Apple Silicon (arm64) macOS, all executable code must possess a valid code signature. At an absolute minimum, an ad-hoc signature (
codesign -s -) is required. If an unsigned Mach-O binary is executed, the macOS kernel will immediately terminate it withSIGKILL(Killed: 9).While Tauri automatically signs the main application bundle (
ICCery.app), sidecar binaries and resources bundled viatauri.conf.json("resources": ["argyll/**/*"]) may not be deeply signed by default, especially if they are downloaded dynamically and placed in theResourcesdirectory instead ofMacOSorFrameworks.Since the
argyllcmsbinaries downloaded byfetch-argyll.mjsare unsigned (as they are built natively via Jam without codesign steps in the upstream repository), they will fail to execute on Apple Silicon Macs unless explicitly signed.Upstream Fix Implemented:
v3.5.0-ICCery.1.5.x86_64,arm64, anduniversal) are now automatically ad-hoc signed inmakepackagebin.shand verified withcodesign -dvvin the CI build pipeline.fetch-argyll.mjswill automatically stage the signed binaries.