From f30d16816f8b28b102d046452c3a65183d84aa60 Mon Sep 17 00:00:00 2001
From: gronod <1+gronod@noreply@i3omb.com>
Date: Tue, 1 Sep 2026 10:18:10 +0100
Subject: [PATCH 1/3] fix(package): apply ad-hoc code signatures to macOS
 Mach-O binaries in makepackagebin.sh

---
 makepackagebin.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/makepackagebin.sh b/makepackagebin.sh
index 0a75e65..faf160b 100755
--- a/makepackagebin.sh
+++ b/makepackagebin.sh
@@ -7,7 +7,7 @@ echo "Script to invoke Jam and then package the binary release."
 PRODUCT=Argyll
 
 # Set the environment string VERSION from the #define, ie 1.0.0
-VERSION=`grep ARGYLL_VERSION_STR h/aconfig.h | head -1 | sed 's/# define ARGYLL_VERSION_STR //' | sed 's/"//g'`
+VERSION=`grep ARGYLL_VERSION_STR h/aconfig.h | head -1 | sed 's/# define ARGYLL_VERSION_STR //' | sed 's/\"//g'`
 
 #   Typical environment variables:
 #   (NOTE some systems don't export these ENV vars. by default !!!)
@@ -173,6 +173,17 @@ if [ X$NO_BUILD = "X" ] ; then
 	fi 
 fi 
 
+# Apply ad-hoc code signatures to macOS Mach-O binaries before staging
+if [ "${OSTYPE#*darwin*}" != "$OSTYPE" ] ; then
+	echo "=== Applying ad-hoc code signatures to macOS Mach-O binaries ==="
+	for f in bin/* ; do
+		if [ -f "$f" ] && file "$f" | grep -q "Mach-O" ; then
+			echo "Signing $f..."
+			codesign -f -s - "$f" || true
+		fi
+	done
+fi
+
 rm -rf $TOPDIR
 mkdir $TOPDIR
 
-- 
2.39.5


From 86e692ecda71c326b127d4a7e58481f2353b30c7 Mon Sep 17 00:00:00 2001
From: gronod <1+gronod@noreply@i3omb.com>
Date: Tue, 1 Sep 2026 10:18:18 +0100
Subject: [PATCH 2/3] ci(macos): add ad-hoc codesigning and signature
 verification to macOS workflow

---
 .github/workflows/build-macos.yml | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index 4a46d28..94f5d31 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -43,6 +43,16 @@ jobs:
           export CCOPTFLAG="-O0"
           jam -q -d2 -fJambase -j1 -sBUILTIN_TIFF=true -sBUILTIN_JPEG=true -sBUILTIN_PNG=true -sBUILTIN_Z=true -sBUILTIN_SSL=true install
           
+      - name: Ad-hoc Sign & Verify Binaries
+        run: |
+          for f in bin/*; do
+            if [ -f "$f" ] && file "$f" | grep -q "Mach-O"; then
+              echo "Ad-hoc signing $f"
+              codesign -f -s - "$f"
+              codesign -dvv "$f"
+            fi
+          done
+
       - name: Smoke Tests
         env:
           ARGYLL_NOT_INTERACTIVE: "1"
@@ -116,6 +126,7 @@ jobs:
                 echo "Creating universal binary with lipo: $bin_name"
                 lipo -create "raw-bin-x86_64/$bin_name" "raw-bin-arm64/$bin_name" -output "bin/$bin_name"
                 chmod +x "bin/$bin_name"
+                codesign -f -s - "bin/$bin_name"
               else
                 echo "Non Mach-O file, copying directly: $bin_name"
                 cp "$file" "bin/$bin_name"
@@ -123,6 +134,9 @@ jobs:
             else
               echo "Warning: $bin_name not found in raw-bin-x86_64, copying arm64 version"
               cp "$file" "bin/$bin_name"
+              if file "bin/$bin_name" | grep -q "Mach-O"; then
+                codesign -f -s - "bin/$bin_name"
+              fi
             fi
           done
           for file in raw-bin-x86_64/*; do
@@ -130,18 +144,22 @@ jobs:
             if [ ! -f "bin/$bin_name" ]; then
               echo "Warning: $bin_name only found in raw-bin-x86_64, copying x86_64 version"
               cp "$file" "bin/$bin_name"
+              if file "bin/$bin_name" | grep -q "Mach-O"; then
+                codesign -f -s - "bin/$bin_name"
+              fi
             fi
           done
 
-      - name: Verify Architecture & Smoke Tests
+      - name: Verify Architecture & Code Signatures
         env:
           ARGYLL_NOT_INTERACTIVE: "1"
           ARGYLL_EXCLUDE_SERIAL_SCAN: "1"
         run: |
-          echo "=== Binary Architecture Verification ==="
+          echo "=== Binary Architecture & Signature Verification ==="
           for file in bin/*; do
-            if [ -f "$file" ]; then
+            if [ -f "$file" ] && file "$file" | grep -q "Mach-O"; then
               file "$file"
+              codesign -dvv "$file"
             fi
           done
           echo "=== Smoke Tests ==="
-- 
2.39.5


From 9c3982354d86e15b3807d3ebaad697aad0de0688 Mon Sep 17 00:00:00 2001
From: gronod <gordon@i3omb.com>
Date: Tue, 1 Sep 2026 11:20:43 +0100
Subject: [PATCH 3/3] Update .github/workflows/build-macos.yml

Update action runner for MacOS to macos-latest
---
 .github/workflows/build-macos.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index 94f5d31..0513ca9 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -11,11 +11,11 @@ jobs:
     strategy:
       matrix:
         include:
-          - os: macos-15-intel
+          - os: macos-latest
             arch: x86_64
             machtype: x86_64-apple-darwin
             artifact: macOS_x86_64_bin
-          - os: macos-15
+          - os: macos-latest
             arch: arm64
             machtype: arm64-apple-darwin
             artifact: macOS_arm64_bin
-- 
2.39.5