From b8ea748973e3ed3f1778d55106e9822ac1614cbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20F=C3=B6rtsch?= <mail@felixfoertsch.de>
Date: Sun, 24 May 2026 19:52:13 +0200
Subject: [PATCH] order codesign signing arguments

---
 .gitea/workflows/custom-release.yml                 |  2 +-
 scripts/tests/test-custom-release-macos-runner.bats | 13 ++++++++-----
 scripts/update-custom-release.sh                    |  4 ++--
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/custom-release.yml b/.gitea/workflows/custom-release.yml
index 6b77c86c0..4c0fd3c3b 100644
--- a/.gitea/workflows/custom-release.yml
+++ b/.gitea/workflows/custom-release.yml
@@ -82,7 +82,7 @@ jobs:
 
           probe_binary="$RUNNER_TEMP/codesign-probe"
           cp /usr/bin/true "$probe_binary"
-          codesign --force --dryrun --keychain "$keychain_path" --sign "$codesign_identity" --options runtime --timestamp "$probe_binary"
+          codesign --force --dryrun --sign "$codesign_identity" --keychain "$keychain_path" --options runtime --timestamp "$probe_binary"
 
           echo "CUSTOM_RELEASE_CODESIGN_IDENTITY=$codesign_identity" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_CODESIGN_IDENTITY_SHA1=$codesign_identity_sha1" >> "$GITHUB_ENV"
diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats
index 6fa49c6be..31e3390ac 100644
--- a/scripts/tests/test-custom-release-macos-runner.bats
+++ b/scripts/tests/test-custom-release-macos-runner.bats
@@ -62,7 +62,7 @@ setup() {
 	run rg -n 'CUSTOM_RELEASE_KEYCHAIN_PASSWORD=\$keychain_password' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'codesign --force --dryrun --keychain "\$keychain_path" --sign "\$codesign_identity" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW"
+	run rg -n 'codesign --force --dryrun --sign "\$codesign_identity" --keychain "\$keychain_path" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
 	run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application' "$WORKFLOW"
@@ -90,12 +90,15 @@ setup() {
 }
 
 @test "custom release signs darwin assets with hardened runtime and timestamp" {
-	run rg -n 'codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)' "$RELEASE_SCRIPT"
+	run rg -n 'codesign_args=\(--force --sign "\$codesign_identity"\)' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
 	run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
+	run rg -n 'codesign_args\+=\(--options runtime --timestamp\)' "$RELEASE_SCRIPT"
+	[ "$status" -eq 0 ]
+
 	run rg -n 'security unlock-keychain -p "\$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
@@ -103,10 +106,10 @@ setup() {
 	[ "$status" -eq 0 ]
 
 	run awk '
-		/codesign_args=\(--force\)/ { base = NR }
+		/codesign_args=\(--force --sign "\$codesign_identity"\)/ { sign = NR }
 		/codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR }
-		/codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)/ { sign = NR }
-		END { exit !(base && keychain && sign && base < keychain && keychain < sign) }
+		/codesign_args\+=\(--options runtime --timestamp\)/ { options = NR }
+		END { exit !(sign && keychain && options && sign < keychain && keychain < options) }
 	' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
diff --git a/scripts/update-custom-release.sh b/scripts/update-custom-release.sh
index 37bf87008..60d12488c 100755
--- a/scripts/update-custom-release.sh
+++ b/scripts/update-custom-release.sh
@@ -302,7 +302,7 @@ sign_and_validate_darwin_binary() {
 
 	[[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds"
 
-	codesign_args=(--force)
+	codesign_args=(--force --sign "$codesign_identity")
 	if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then
 		if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PASSWORD:-}" ]]; then
 			security unlock-keychain -p "$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "$CUSTOM_RELEASE_KEYCHAIN_PATH"
@@ -310,7 +310,7 @@ sign_and_validate_darwin_binary() {
 		security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH"
 		codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
 	fi
-	codesign_args+=(--sign "$codesign_identity" --options runtime --timestamp)
+	codesign_args+=(--options runtime --timestamp)
 	codesign "${codesign_args[@]}" "$binary"
 
 	version_output="$("$binary" --version)"