ci: check macos bundle structure and codesigning
What the developer wrote
Authored by fanquake
ci: check macos bundle structure and codesigning
What changed, and why it matters
This commit adds a new automated CI (Continuous Integration) test step for macOS releases. After building the macOS app bundle, the script now unzips the produced file and runs Apple's `codesign --verify` to confirm the application is properly code-signed. It does not change any wallet, networking, or consensus code, and it does not fix a security bug in the software itself. It is purely a build/verification improvement.
No security action required. Treat as a normal CI/QA improvement. Reviewers may want to confirm the CI job has access to the expected zip artifact and that `codesign --verify` is run with appropriate entitlements/deep flags if full signature validation is desired.
Security signals we found
Adds code-signature verification for macOS release bundle in CI
No change to runtime, consensus, networking, or wallet logic
No bug fix, vulnerability patch, or cryptographic change present
Evidence from the diff
The change is confined to ci/test/03_test_script.sh. A new conditional block runs only when CI_OS_NAME is macos and the build goal includes install deploy. It extracts bitcoin-macos-app.zip into a deploy directory and invokes codesign --verify on Bitcoin-Qt.app, failing the CI job if verification fails. This is a defensive check to catch packaging or code-signing regressions before release artifacts are published.
Changed components
ci/test/03_test_script.shInspect captured patch +8 / −0
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index eb03c2dd..8af2ceec 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -137,6 +137,14 @@ if [ "$RUN_CHECK_DEPS" = "true" ]; then
"${BASE_ROOT_DIR}/contrib/devtools/check-deps.sh" "${BASE_BUILD_DIR}"
fi
+if [[ "$CI_OS_NAME" == "macos" && "${GOAL}" = "install deploy" ]]; then
+ unzip "${BASE_BUILD_DIR}/bitcoin-macos-app.zip" -d "${BASE_BUILD_DIR}/deploy"
+ if ! ( codesign --verify "${BASE_BUILD_DIR}/deploy/Bitcoin-Qt.app" ); then
+ echo "Codesigning failed."
+ false
+ fi
+fi
+
if [ "$RUN_UNIT_TESTS" = "true" ]; then
DIR_UNIT_TEST_DATA="${DIR_UNIT_TEST_DATA}" \
LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.