From 4f2829ed482719464456dfa13e0172b4b046b434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20F=C3=B6rtsch?= <mail@felixfoertsch.de>
Date: Sun, 24 May 2026 19:35:46 +0200
Subject: [PATCH] place codesign keychain before signing options

---
 scripts/tests/test-custom-release-macos-runner.bats | 10 +++++++++-
 scripts/update-custom-release.sh                    |  3 ++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats
index e22bff42c..490941fe2 100644
--- a/scripts/tests/test-custom-release-macos-runner.bats
+++ b/scripts/tests/test-custom-release-macos-runner.bats
@@ -75,7 +75,7 @@ setup() {
 }
 
 @test "custom release signs darwin assets with hardened runtime and timestamp" {
-	run rg -n 'codesign_args=.*--options runtime --timestamp' "$RELEASE_SCRIPT"
+	run rg -n 'codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
 	run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
@@ -87,6 +87,14 @@ setup() {
 	run rg -n 'security find-identity -v -p codesigning "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
+	run awk '
+		/codesign_args=\(--force\)/ { base = NR }
+		/codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR }
+		/codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)/ { sign = NR }
+		END { exit !(base && keychain && sign && base < keychain && keychain < sign) }
+	' "$RELEASE_SCRIPT"
+	[ "$status" -eq 0 ]
+
 	run rg -n 'Developer ID Application' "$WORKFLOW" "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
diff --git a/scripts/update-custom-release.sh b/scripts/update-custom-release.sh
index 1f8f04ccf..37bf87008 100755
--- a/scripts/update-custom-release.sh
+++ b/scripts/update-custom-release.sh
@@ -302,7 +302,7 @@ sign_and_validate_darwin_binary() {
 
 	[[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds"
 
-	codesign_args=(--force --sign "$codesign_identity" --options runtime --timestamp)
+	codesign_args=(--force)
 	if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then
 		if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PASSWORD:-}" ]]; then
 			security unlock-keychain -p "$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "$CUSTOM_RELEASE_KEYCHAIN_PATH"
@@ -310,6 +310,7 @@ sign_and_validate_darwin_binary() {
 		security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH"
 		codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
 	fi
+	codesign_args+=(--sign "$codesign_identity" --options runtime --timestamp)
 	codesign "${codesign_args[@]}" "$binary"
 
 	version_output="$("$binary" --version)"