_codesign_bundle! in src/privatize_macos.jl resolves the signing tool with a PATH lookup and then performs deep ad-hoc signing:
cs = Sys.which("codesign")
...
run_with_suppressed_output(`$cs -f -s - --deep --timestamp=none $p`; quiet) ||
error("codesign failed for $p")On machines with conda-forge or Nix cross-compilation toolchains installed, a non-Apple codesign shim (e.g. sigtool's) commonly sits earlier on PATH than /usr/bin/codesign. Those shims implement only a small flag subset, so bundling fails:
The following arguments were not expected: --timestamp=none --deep
Run with --help for more information.
- PackageCompiler: bundling libraries
ERROR: codesign failed for .../bundle/bin/iopoll_runtime_trim_safe
Stacktrace:
[2] _codesign_bundle!(recipe::BundleRecipe)
@ JuliaC ~/.julia/packages/JuliaC/bMl7u/src/privatize_macos.jl:97
(The "arguments were not expected" wording is a CLI11-style parser error that Apple's codesign never emits, which is how the shadowing was identified.)
Real-world report: JuliaServices/Reseau.jl#144 — Reseau's trim-compile test suite shells out to JuliaC (v0.3.8) and hit exactly this on an Intel Mac running Julia 1.12.6.
Suggestion: prefer the system tool and fall back to the PATH lookup only when it's absent, e.g.
cs = isfile("/usr/bin/codesign") ? "/usr/bin/codesign" : Sys.which("codesign")(or resolve via xcrun --find codesign). The same consideration may apply to the xattr lookup a few lines above — a non-Apple xattr (commonly Python's, from a conda environment) can shadow /usr/bin/xattr the same way.
[suggestions by claude; reviewed by quinnj]
_codesign_bundle!insrc/privatize_macos.jlresolves the signing tool with a PATH lookup and then performs deep ad-hoc signing:On machines with conda-forge or Nix cross-compilation toolchains installed, a non-Apple
codesignshim (e.g. sigtool's) commonly sits earlier on PATH than/usr/bin/codesign. Those shims implement only a small flag subset, so bundling fails:(The "arguments were not expected" wording is a CLI11-style parser error that Apple's codesign never emits, which is how the shadowing was identified.)
Real-world report: JuliaServices/Reseau.jl#144 — Reseau's trim-compile test suite shells out to JuliaC (v0.3.8) and hit exactly this on an Intel Mac running Julia 1.12.6.
Suggestion: prefer the system tool and fall back to the PATH lookup only when it's absent, e.g.
(or resolve via
xcrun --find codesign). The same consideration may apply to thexattrlookup a few lines above — a non-Applexattr(commonly Python's, from a conda environment) can shadow/usr/bin/xattrthe same way.[suggestions by claude; reviewed by quinnj]