From f79882bece53e2cf02ec4edabed24b194cf97dee Mon Sep 17 00:00:00 2001 From: Caleb Piekstra Date: Tue, 11 Aug 2026 16:14:25 -0400 Subject: [PATCH] make: sign every built binary, not just install and dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to the install-signing change, which was incomplete. That change signed `install` and `dev`. It missed the binary actually run during development — `./target/release/`, produced by `release` and by `verify` through `smoke`. Left ad-hoc signed, it mints a new code identity every rebuild, so macOS keeps asking for "Always Allow": the prompts do not stop, they move to whichever binary was missed. Observed in `rpm-fl-cli` immediately after adopting the first fix: ```console $ codesign -dv ~/.cargo/bin/rpmfl # Identifier=rpmfl ← signed $ codesign -dv ./target/release/rpmfl # Identifier=rpmfl-92efb87… Signature=adhoc ``` Now every target that produces a binary signs it. Verified with `make -n`: `SIGN_TARGET` resolves to the real output path for this Makefile's layout. Still a no-op with a note on CI/Linux. Guidance corrected in cli-common#7. --- Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Makefile b/Makefile index 94c59ea..31b00eb 100644 --- a/Makefile +++ b/Makefile @@ -9,11 +9,15 @@ CARGO := cargo all: verify +build: SIGN_TARGET = target/debug/$(BIN) build: $(CARGO) build + @$(SIGN) +release: SIGN_TARGET = target/release/$(BIN) release: $(CARGO) build --release + @$(SIGN) test: $(CARGO) test --all