Repository navigation
tools: notarize bin/node in the darwin tarballs - #67143
Open
UlisesGascon wants to merge 2 commits into
Open
UlisesGascon wants to merge 2 commits into
UlisesGascon wants to merge 2 commits into
Conversation
The binary tarball target only codesigns bin/node. Notarization runs only for the pkg, and tools/osx-notarize.sh only knows how to submit a pkg, so every darwin tarball binary ships signed but without a ticket. Gatekeeper then applies a full trust evaluation to each process spawned through it, which slows down every CLI shim on macOS. Make tools/osx-notarize.sh take a path instead of a version id. A .pkg keeps the existing flow. Any other file is treated as a Mach-O binary: it is zipped with ditto, submitted with notarytool, and the ticket is verified with `codesign --verify -R=notarized` using the existing retry helper. spctl cannot be used for that check, it rejects command line tools as "not an app". The binary itself is not modified, so published checksums do not change. A bare version id is still accepted and resolved to node-<version>.pkg for the release branches. Call the script from the binary target after codesign. It is a no-op unless the NOTARIZATION_* variables are exported, so the tarball jobs keep behaving as today until the release job injects them. Refs: nodejs#67140 Refs: nodejs/build#3538 Refs: nodejs/build#4545 Refs: nodejs#66855 Assisted-by: Claude Assisted-by: Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
nodejs-github-bot
added
build
3 of 11 tasks
UlisesGascon
marked this pull request as ready for review
October 30, 2026 15:25
UlisesGascon
added a commit
to nodejs/build
that referenced
this pull request
Oct 30, 2026
Add tools/macos-tarball-notarization.sh. Given release versions, or --all-supported for the lines currently in their support window, it downloads the darwin tarballs, verifies the bin/node signature and asks Apple for a notarization ticket with `codesign --verify -R=notarized`. With --submit it zips and submits the binaries that lack one through the NODE_RELEASE_PROFILE keychain profile and waits for the ticket. --latest N limits the run to the N most recent releases per line, since every check downloads a tarball. Notarizing a published binary does not modify it, so checksums stay valid; this is how already shipped tarballs get backfilled. Document in release-overview.md how macOS signing and notarization are wired, that the NOTARIZATION_* variables in iojs+release must be exported on the tarball axes too, and how to check and backfill a release. Describe in jenkins-jobs.md the scheduled ci-release job that runs the script nightly, which both backfills and detects a tarball axis that stopped notarizing. Note in the orka README that pkg and tarball nodes share the release image. Refs: nodejs/node#67140 Refs: nodejs/node#67143 Refs: #3538 Refs: #4545 Assisted-by: Claude Assisted-by: Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
UlisesGascon
added a commit
to nodejs/build
that referenced
this pull request
Oct 30, 2026
Add tools/macos-tarball-notarization.sh. Given release versions, or --all-supported for the lines currently in their support window, it downloads the darwin tarballs, verifies the bin/node signature and asks Apple's Gatekeeper ticket service, by code directory hash, whether a notarization ticket exists. That is the lookup macOS itself performs; `codesign --verify -R=notarized` only reads the local ticket cache and reports a notarized binary as unticketed on a machine that never fetched its ticket. A failed lookup is reported as such, never as a missing ticket. With --submit it zips and submits the binaries that lack one through the NODE_RELEASE_PROFILE keychain profile, requires Apple's Accepted verdict, and waits for the ticket. --latest N limits the run to the N most recent releases per line, since every check downloads a tarball. Notarizing a published binary does not modify it, so checksums stay valid; this is how already shipped tarballs get backfilled. Document in release-overview.md how macOS signing and notarization are wired, that tarball binaries usually receive a ticket only days after a release when third parties notarize apps that bundle them, that the NOTARIZATION_* variables in iojs+release must be exported on the tarball axes too, and how to check and backfill a release. Describe in jenkins-jobs.md the scheduled ci-release job that runs the script nightly, which both backfills and detects a tarball axis that stopped notarizing. Note in the orka README that pkg and tarball nodes share the release image. Refs: nodejs/node#67140 Refs: nodejs/node#67143 Refs: #3538 Refs: #4545 Assisted-by: Claude Assisted-by: Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #67143 +/- ##
========================================
Coverage 90.66% 90.67%
========================================
Files 797 797
Lines 278791 279382 +591
Branches 53620 53735 +115
========================================
+ Hits 252768 253327 +559
+ Misses 16376 16356 -20
- Partials 9647 9699 +52 🚀 New features to boost your workflow:
|
aduh95
approved these changes
Nov 2, 2026
aduh95
added
author ready
github-actions
Bot
removed
the
request-ci
Collaborator
Member
|
The AIX test here is an issue while will not occur on a re-run, so once the existing PR run is complete a re-run should allow it to pass |
Collaborator
ryanaslett
suggested changes
Nov 4, 2026
ryanaslett
left a comment
ryanaslett
left a comment
Contributor
There was a problem hiding this comment.
Other than the awkward way the functions are inline defined, everything else LGTM.
Move helpers to the top of the script, make the cleanup trap script-wide and split the pkg and binary flows into functions. Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
sxa
approved these changes
Nov 6, 2026
sxa
left a comment
sxa
left a comment
Member
There was a problem hiding this comment.
Approving after discussion with Ryan in the build meeting who was happy with these changes.
UlisesGascon
added
the
commit-queue
nodejs-github-bot
added
commit-queue-failed
Collaborator
Commit Queue failedThe pull request was removed from the Commit Queue and labeled
commit-queue-failed
Full Commit Queue output |
aduh95
added
the
request-ci
github-actions
Bot
removed
the
request-ci
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: #67140