Title: Verify Apple codesign immediately after ESRP signing by andyleejordan · Pull Request #27486 · PowerShell/PowerShell · GitHub
Open Graph Title: Verify Apple codesign immediately after ESRP signing by andyleejordan · Pull Request #27486 · PowerShell/PowerShell
X Title: Verify Apple codesign immediately after ESRP signing by andyleejordan · Pull Request #27486 · PowerShell/PowerShell
Description: PR Summary Add an equivalent of codesign --verify --deep --strict step in the Sign_macOS_* jobs immediately after expanding the zip returned by ESRP. This is similar to the verification already run downstream in mac-package-build.yml, but running it inside the sign job means we fail fast in the producing pipeline instead of discovering the problem later in packaging. And it uses PowerShell to just look at the files so it can run on Windows. Motivation In a release build, the Sign_macOS_x64 job's ESRP submission returned statusCode: pass with "1 files signed successfully!", but the returned zip contained byte-identical Mach-O entries with no Developer ID Application signature applied. ESRP silently no-op'd. The failure only surfaced in the downstream packaging pipeline's verify step (added in #27347), one stage later, after we had already published the bad drop_macos_sign_x64 artifact. Running the same verify here surfaces this class of silent ESRP no-op in the job that owns the signing, so: The signing job — not packaging — is what goes red, pointing the on-call directly at ESRP. The bad drop_macos_sign_* artifact is never published. Re-running just the failed sign job is sufficient to recover. PR Context Defense-in-depth follow-up to #27347. PR Checklist PR has a meaningful title Summarized changes Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header — N/A (pipeline YAML) This PR is ready to merge and is not work in progress Breaking changes None User-facing changes — None Documentation needed — N/A Tests — verified by next pipeline run [Job-specific change to .pipelines/templates/mac.yml only]
Open Graph Description: PR Summary Add an equivalent of codesign --verify --deep --strict step in the Sign_macOS_* jobs immediately after expanding the zip returned by ESRP. This is similar to the verification already run...
X Description: PR Summary Add an equivalent of codesign --verify --deep --strict step in the Sign_macOS_* jobs immediately after expanding the zip returned by ESRP. This is similar to the verification already run...
Opengraph URL: https://github.com/PowerShell/PowerShell/pull/27486
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:110248ab-5707-29f5-2244-9598ec3c4dac |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | AE4E:2C29DE:1938014:22A8D55:6A57356C |
| html-safe-nonce | 8a8b47e1ae7c32ee3849e173b053d0f21c526b5794ae890d2fe5f45ef405ab14 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBRTRFOjJDMjlERToxOTM4MDE0OjIyQThENTU6NkE1NzM1NkMiLCJ2aXNpdG9yX2lkIjoiNzU3NTM4MTA3NDE0MDE0OTEwMCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | cbba5be8a67b6d3f0f037f9ab6cad3c8fbc4b08ede0e5b18a9f51eb544486603 |
| hovercard-subject-tag | pull_request:3718496935 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/PowerShell/PowerShell/pull/27486/files |
| twitter:image | https://avatars.githubusercontent.com/u/2226434?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/2226434?s=400&v=4 |
| og:image:alt | PR Summary Add an equivalent of codesign --verify --deep --strict step in the Sign_macOS_* jobs immediately after expanding the zip returned by ESRP. This is similar to the verification already run... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 4e7a7296a3830877cf21a6ad2a972c9e618a48915e03966cf0c53eb08e5aad98 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/PowerShell/PowerShell git https://github.com/PowerShell/PowerShell.git |
| octolytics-dimension-user_id | 11524380 |
| octolytics-dimension-user_login | PowerShell |
| octolytics-dimension-repository_id | 49609581 |
| octolytics-dimension-repository_nwo | PowerShell/PowerShell |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 49609581 |
| octolytics-dimension-repository_network_root_nwo | PowerShell/PowerShell |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 2576d1f0198cf1588faf2edf27f1ed120903be10 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width