From cc1b1e2051650356db3acc0cf7faee66fc6e4aae Mon Sep 17 00:00:00 2001 From: huanld Date: Sat, 19 Sep 2026 15:25:06 +0700 Subject: [PATCH] ci(release): parse codesign entitlements as xml on newer runners codesign -d --entitlements - on current macOS runner images prefixes the plist with text headers, so the sandbox entitlement assertion died with plistlib InvalidFileException and took the .dmg build down with it. --xml prints the bare plist on both old and new codesign builds. --- .github/workflows/release.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0b033babc..b773bbebd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -492,8 +492,10 @@ jobs: OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex codesign --force --sign - --timestamp=none OpenCADStudio.app codesign --verify --deep --strict --verbose=2 OpenCADStudio.app - codesign -d --entitlements - OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex \ - | python3 -c 'import plistlib, sys; assert plistlib.load(sys.stdin.buffer).get("com.apple.security.app-sandbox") is True' + # --xml keeps newer codesign builds from prefixing text headers, + # which made the entitlements parse fail with InvalidFileException. + codesign -d --entitlements - --xml OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex \ + | python3 -c 'import io, plistlib, sys; ent = plistlib.load(io.BytesIO(sys.stdin.buffer.read())); print("entitlements:", ent); assert ent.get("com.apple.security.app-sandbox") is True' - name: Create .dmg run: |