From ebf26f54564376e9ea29f529eeb386327a43524a Mon Sep 17 00:00:00 2001
From: piekstra <piekstra@users.noreply.github.com>
Date: Tue, 11 Aug 2026 08:44:21 -0400
Subject: [PATCH 1/2] make: sign the installed and dev binaries with the stable
 identity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lofty-cli had no code-signing at all, unlike the rest of the family. That
matters because it stores its API credential in the macOS keychain
(pk-cli-secrets): `cargo install` ad-hoc signs, giving ~/.cargo/bin/lofty
a new code identity each time, and macOS scopes keychain "Always Allow"
grants to the identity — so every reinstall silently revoked the grant and
the next run re-prompted.

Adds the SIGN-macro pattern shared by rpm-fl-cli, wabhoa, fpl, and tojfl:
`install` and a new `dev` target both re-sign with pk-cli-codesign,
`install` honours CARGO_INSTALL_ROOT, and `dev` joins `.PHONY`.

Verified: both `make install` and `make dev` produce a binary with
Authority=pk-cli-codesign. macOS-only; a no-op with a note elsewhere.
self-update already re-signs via pk-cli-selfupdate.
---
 Makefile | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 19ebac1..987408d 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,7 @@
 BIN := lofty
 CARGO := cargo
 
-.PHONY: all build release test lint fmt fmt-check clean install deps smoke verify
+.PHONY: all build release test lint fmt fmt-check clean install deps smoke verify dev
 
 all: verify
 
@@ -30,8 +30,15 @@ fmt-check:
 clean:
 	$(CARGO) clean
 
+# `cargo install` ad-hoc signs, which gives the binary a *new* code identity
+# every time. macOS scopes keychain "Always Allow" grants to that identity, so
+# an unsigned reinstall silently revokes them and the next run prompts again.
+# Re-signing with the stable shared identity keeps one grant valid across every
+# future install.
+install: SIGN_TARGET = $${CARGO_INSTALL_ROOT:-$$HOME/.cargo}/bin/$(BIN)
 install:
 	$(CARGO) install --path . --force
+	@$(SIGN)
 
 deps:
 	$(CARGO) fetch
@@ -43,3 +50,18 @@ smoke: release
 	./target/release/$(BIN) info > /dev/null
 
 verify: fmt-check lint test smoke
+
+# Debug build re-signed with the same stable pk-cli-codesign identity, so the
+# dev loop doesn't re-prompt either (see cli-common/scripts).
+dev: SIGN_TARGET = target/debug/$(BIN)
+dev:
+	cargo build
+	@$(SIGN)
+
+# Shared re-signing step. No-ops with a note when the helper or identity is
+# absent (CI, Linux, a fresh machine that hasn't run setup-dev-signing.sh).
+define SIGN
+if [ -x "$$HOME/Dev/cli-common/scripts/dev-sign.sh" ]; then \
+	"$$HOME/Dev/cli-common/scripts/dev-sign.sh" $(SIGN_TARGET); \
+else echo "cli-common/scripts/dev-sign.sh not found — $(SIGN_TARGET) left ad-hoc signed"; fi
+endef

From 6ddfcb9ae451d9f3a8778ba33d01d2e4455dd1be Mon Sep 17 00:00:00 2001
From: piekstra <piekstra@users.noreply.github.com>
Date: Tue, 11 Aug 2026 08:52:32 -0400
Subject: [PATCH 2/2] make: quote $(SIGN_TARGET) in the re-sign step

Pre-empting the review finding on the sibling fpl PR: passing
$(SIGN_TARGET) unquoted word-splits when CARGO_INSTALL_ROOT contains a
space. Quoted in the dev-sign call.
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 987408d..94c59ea 100644
--- a/Makefile
+++ b/Makefile
@@ -62,6 +62,6 @@ dev:
 # absent (CI, Linux, a fresh machine that hasn't run setup-dev-signing.sh).
 define SIGN
 if [ -x "$$HOME/Dev/cli-common/scripts/dev-sign.sh" ]; then \
-	"$$HOME/Dev/cli-common/scripts/dev-sign.sh" $(SIGN_TARGET); \
+	"$$HOME/Dev/cli-common/scripts/dev-sign.sh" "$(SIGN_TARGET)"; \
 else echo "cli-common/scripts/dev-sign.sh not found — $(SIGN_TARGET) left ad-hoc signed"; fi
 endef