Repository navigation
tools: notarize bin/node in the darwin tarballs - #67143
Open
UlisesGascon wants to merge 1 commit into
Open
UlisesGascon wants to merge 1 commit into
UlisesGascon wants to merge 1 commit into
Conversation
The binary tarball target only codesigns bin/node. Notarization runs only for the pkg, and tools/osx-notarize.sh only knows how to submit a pkg, so every darwin tarball binary ships signed but without a ticket. Gatekeeper then applies a full trust evaluation to each process spawned through it, which slows down every CLI shim on macOS. Make tools/osx-notarize.sh take a path instead of a version id. A .pkg keeps the existing flow. Any other file is treated as a Mach-O binary: it is zipped with ditto, submitted with notarytool, and the ticket is verified with `codesign --verify -R=notarized` using the existing retry helper. spctl cannot be used for that check, it rejects command line tools as "not an app". The binary itself is not modified, so published checksums do not change. A bare version id is still accepted and resolved to node-<version>.pkg for the release branches. Call the script from the binary target after codesign. It is a no-op unless the NOTARIZATION_* variables are exported, so the tarball jobs keep behaving as today until the release job injects them. Refs: nodejs#67140 Refs: nodejs/build#3538 Refs: nodejs/build#4545 Refs: nodejs#66855 Assisted-by: Claude Assisted-by: Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
nodejs-github-bot
added
build
3 of 11 tasks
UlisesGascon
marked this pull request as ready for review
October 30, 2026 15:25
UlisesGascon
added a commit
to nodejs/build
that referenced
this pull request
Oct 30, 2026
Add tools/macos-tarball-notarization.sh. Given release versions, or --all-supported for the lines currently in their support window, it downloads the darwin tarballs, verifies the bin/node signature and asks Apple for a notarization ticket with `codesign --verify -R=notarized`. With --submit it zips and submits the binaries that lack one through the NODE_RELEASE_PROFILE keychain profile and waits for the ticket. --latest N limits the run to the N most recent releases per line, since every check downloads a tarball. Notarizing a published binary does not modify it, so checksums stay valid; this is how already shipped tarballs get backfilled. Document in release-overview.md how macOS signing and notarization are wired, that the NOTARIZATION_* variables in iojs+release must be exported on the tarball axes too, and how to check and backfill a release. Describe in jenkins-jobs.md the scheduled ci-release job that runs the script nightly, which both backfills and detects a tarball axis that stopped notarizing. Note in the orka README that pkg and tarball nodes share the release image. Refs: nodejs/node#67140 Refs: nodejs/node#67143 Refs: #3538 Refs: #4545 Assisted-by: Claude Assisted-by: Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
UlisesGascon
added a commit
to nodejs/build
that referenced
this pull request
Oct 30, 2026
Add tools/macos-tarball-notarization.sh. Given release versions, or --all-supported for the lines currently in their support window, it downloads the darwin tarballs, verifies the bin/node signature and asks Apple's Gatekeeper ticket service, by code directory hash, whether a notarization ticket exists. That is the lookup macOS itself performs; `codesign --verify -R=notarized` only reads the local ticket cache and reports a notarized binary as unticketed on a machine that never fetched its ticket. A failed lookup is reported as such, never as a missing ticket. With --submit it zips and submits the binaries that lack one through the NODE_RELEASE_PROFILE keychain profile, requires Apple's Accepted verdict, and waits for the ticket. --latest N limits the run to the N most recent releases per line, since every check downloads a tarball. Notarizing a published binary does not modify it, so checksums stay valid; this is how already shipped tarballs get backfilled. Document in release-overview.md how macOS signing and notarization are wired, that tarball binaries usually receive a ticket only days after a release when third parties notarize apps that bundle them, that the NOTARIZATION_* variables in iojs+release must be exported on the tarball axes too, and how to check and backfill a release. Describe in jenkins-jobs.md the scheduled ci-release job that runs the script nightly, which both backfills and detects a tarball axis that stopped notarizing. Note in the orka README that pkg and tarball nodes share the release image. Refs: nodejs/node#67140 Refs: nodejs/node#67143 Refs: #3538 Refs: #4545 Assisted-by: Claude Assisted-by: Codex Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #67143 +/- ##
==========================================
+ Coverage 90.66% 90.68% +0.01%
==========================================
Files 797 797
Lines 278791 278773 -18
Branches 53620 53604 -16
==========================================
+ Hits 252768 252796 +28
+ Misses 16376 16340 -36
+ Partials 9647 9637 -10 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: #67140