@@ -221,19 +221,12 @@ bundle_dylibs() {
221221 echo " ⚠️ WARNING: Could not determine deployment target, skipping dylib version check"
222222 fi
223223
224- # Ad-hoc sign everything (required on Apple Silicon)
225- # Sign inner components first (dylibs, frameworks), then the app bundle last.
226- # Signing the bundle seals resources so Sparkle can validate the update.
227- echo " Signing bundled libraries and frameworks..."
224+ # Ad-hoc sign bundled dylibs (required on Apple Silicon)
225+ echo " Signing bundled libraries..."
228226 for fw in " $frameworks_dir " * .dylib; do
229227 [ -f " $fw " || continue
230228 codesign -fs - --force " $fw " 2> /dev/null || true
231229 done
232- for fw in " $frameworks_dir " * .framework; do
233- [ -d " $fw " || continue
234- codesign -fs - --force " $fw " 2> /dev/null || true
235- done
236- codesign -fs - --force " $app_path "
237230
238231 echo " ✅ Bundled $count dynamic libraries into Frameworks/"
239232 ls -lh " $frameworks_dir " * .dylib 2> /dev/null
@@ -347,6 +340,16 @@ build_for_arch() {
347340 # Bundle non-system dynamic libraries (libpq, OpenSSL, etc.)
348341 bundle_dylibs " $BUILD_DIR /$OUTPUT_NAME "
349342
343+ # Ad-hoc sign the entire app bundle (required for Sparkle update validation).
344+ # Sign inner frameworks first, then the app bundle last to seal resources.
345+ echo " 🔏 Signing app bundle..."
346+ FRAMEWORKS_DIR=" $BUILD_DIR /$OUTPUT_NAME /Contents/Frameworks"
347+ for fw in " $FRAMEWORKS_DIR " * .framework; do
348+ [ -d " $fw " || continue
349+ codesign -fs - --force " $fw " 2> /dev/null || true
350+ done
351+ codesign -fs - --force " $BUILD_DIR /$OUTPUT_NAME "
352+
350353 # Verify binary exists inside the copied bundle
351354 BINARY_PATH=" $BUILD_DIR /$OUTPUT_NAME /Contents/MacOS/TablePro"
352355 if [ ! -f " $BINARY_PATH " ; then
0 commit comments