macOS Apple Silicon: Ensure ArgyllCMS sidecar binaries are ad-hoc signed #165

Closed
opened 2026-09-01 09:55:42 +01:00 by gronod · 0 comments
Owner

On Apple Silicon (arm64) macOS, all executable code must possess a valid code signature. At an absolute minimum, an ad-hoc signature (codesign -s -) is required. If an unsigned Mach-O binary is executed, the macOS kernel will immediately terminate it with SIGKILL (Killed: 9).

While Tauri automatically signs the main application bundle (ICCery.app), sidecar binaries and resources bundled via tauri.conf.json ("resources": ["argyll/**/*"]) may not be deeply signed by default, especially if they are downloaded dynamically and placed in the Resources directory instead of MacOS or Frameworks.

Since the argyllcms binaries downloaded by fetch-argyll.mjs are unsigned (as they are built natively via Jam without codesign steps in the upstream repository), they will fail to execute on Apple Silicon Macs unless explicitly signed.

Upstream Fix Implemented:

  • Upstream fix has been completed and released in gronod/argyllcms#32 via tag v3.5.0-ICCery.1.5.
  • All macOS binaries (x86_64, arm64, and universal) are now automatically ad-hoc signed in makepackagebin.sh and verified with codesign -dvv in the CI build pipeline.
  • fetch-argyll.mjs will automatically stage the signed binaries.
On Apple Silicon (arm64) macOS, all executable code must possess a valid code signature. At an absolute minimum, an ad-hoc signature (`codesign -s -`) is required. If an unsigned Mach-O binary is executed, the macOS kernel will immediately terminate it with `SIGKILL` (Killed: 9). While Tauri automatically signs the main application bundle (`ICCery.app`), sidecar binaries and resources bundled via `tauri.conf.json` (`"resources": ["argyll/**/*"]`) may not be deeply signed by default, especially if they are downloaded dynamically and placed in the `Resources` directory instead of `MacOS` or `Frameworks`. Since the `argyllcms` binaries downloaded by `fetch-argyll.mjs` are unsigned (as they are built natively via Jam without codesign steps in the upstream repository), they will fail to execute on Apple Silicon Macs unless explicitly signed. **Upstream Fix Implemented:** - Upstream fix has been completed and released in [gronod/argyllcms#32](https://git.i3omb.com/gronod/argyllcms/issues/32) via tag `v3.5.0-ICCery.1.5`. - All macOS binaries (`x86_64`, `arm64`, and `universal`) are now automatically ad-hoc signed in `makepackagebin.sh` and verified with `codesign -dvv` in the CI build pipeline. - `fetch-argyll.mjs` will automatically stage the signed binaries.
gronod added the Kind/Bug
Status
Blocked
1
Priority
High
2
labels 2026-09-01 10:11:53 +01:00
Sign in to join this conversation.