fix(bundler): notarize and staple the DMG after signing it - #15824
Open
RawNuke wants to merge 1 commit into
Open
fix(bundler): notarize and staple the DMG after signing it#15824RawNuke wants to merge 1 commit into
RawNuke wants to merge 1 commit into
Conversation
The .app bundle was notarized before the DMG was created, but the DMG itself was signed and returned without ever being submitted to Apple or stapled. The build reported success for a file Gatekeeper rejects, so a user downloading the DMG hit the untrusted-download path while the developer believed the distribution was signed and notarized. Mirror the app notarization path exactly: after signing the DMG, submit it for notarization and staple the ticket, honoring the skip_stapling opt-out and keeping the missing-team-id hard error consistent with the app path. Closes tauri-apps#15822
Legend-Master
added
the
ai-slop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #15822
The bug
The
.appbundle is notarized before the DMG is created (app.rs), but the DMG itself is only signed — never submitted to Apple for notarization and never stapled (dmg/mod.rs). The build reports success, so a developer ships a DMG that Gatekeeper rejects on first open while believing the distribution is fully notarized. The issue's reproduction confirms:xcrun stapler validate App.dmgexits 65 while the inner.appvalidates.The fix
After signing the DMG, submit it for notarization and staple the ticket — mirroring the app path in
app.rsexactly:notarize_auth()gates the whole block, same as the app path.settings.macos().skip_staplingis honored:notarize_without_staplingwhen set, fullnotarize(submit + staple) otherwise.skipping dmg notarization, {e}and continues, so builds without notarization credentials keep working with a visible warning.This does not double-notarize the
.app: it notarizes the outer container, which is the artifact users actually download.Verification
cargo checkon tauri-bundler: clean.cargo teston tauri-bundler: 20/20 pass.cargo clippy: no new warnings (the one warning in this file pre-exists on the base branch).cargo fmt --check: clean.app.rsflow.