Skip to content

[release/v7.4.16] Add macOS binary code signing and package notarization#27431

Merged
adityapatwardhan merged 2 commits into
PowerShell:release/v7.4.16from
adityapatwardhan:backport/release/v7.4.16/27347-b9bd8cbc5
May 15, 2026
Merged

[release/v7.4.16] Add macOS binary code signing and package notarization#27431
adityapatwardhan merged 2 commits into
PowerShell:release/v7.4.16from
adityapatwardhan:backport/release/v7.4.16/27347-b9bd8cbc5

Conversation

@adityapatwardhan
Copy link
Copy Markdown
Member

Backport of #27347 to release/v7.4.16

Triggered by @adityapatwardhan on behalf of @andyleejordan

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

  • Required tooling change
  • Optional tooling change (include reasoning)

Backports build and packaging pipeline updates required to support macOS binary signing and notarization in the release branch pipeline.

Customer Impact

  • Customer reported
  • Found internally

Ensures release packaging/signing workflow works correctly for macOS artifacts and avoids pipeline regressions during release engineering.

Regression

REQUIRED: Check exactly one box.

  • Yes
  • No

This is not a regression.

Testing

Cherry-pick applied cleanly in D:\PSGit\PowerShell-backport with no conflicts. Validation will run via CI on the backport PR for release/v7.4.16 pipeline paths.

Risk

REQUIRED: Check exactly one box.

  • High
  • Medium
  • Low

Changes are in build/pipeline packaging and signing flow; they are scoped to release engineering but can affect release pipeline behavior if incorrect.

@adityapatwardhan adityapatwardhan requested a review from a team as a code owner May 13, 2026 20:18
Copilot AI review requested due to automatic review settings May 13, 2026 20:18
@adityapatwardhan adityapatwardhan added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label May 13, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Backport to release/v7.4.16 enabling macOS hardened runtime entitlements to be applied during the macOS build, in support of downstream macOS signing/notarization in the release packaging pipeline.

Changes:

  • Add a macOS entitlements plist (assets/macos-entitlements.plist) for hardened runtime signing.
  • Update the macOS build template to apply the entitlements via codesign to the built pwsh binary before publishing artifacts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
assets/macos-entitlements.plist Introduces the entitlements used for macOS hardened runtime signing.
.pipelines/templates/mac.yml Applies the entitlements to pwsh during the macOS build step via codesign.

Comment on lines +72 to +78
$entitlements = "$(PowerShellRoot)/assets/macos-entitlements.plist"
$pwshBin = "$(OB_OUTPUTDIRECTORY)/pwsh"
Write-Verbose -Verbose "Applying entitlements to $pwshBin"
codesign --sign - --force --options runtime --entitlements $entitlements $pwshBin
if ($LASTEXITCODE -ne 0) {
throw "codesign failed with exit code $LASTEXITCODE"
}
Comment on lines +4 to +10
<dict>
<key>com.apple.security.cs.allow-jit</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
<true/>
andyleejordan and others added 2 commits May 13, 2026 16:31
We still need to apply the template signing so that Guardian tasks pass
and so that script files are signed. After doing what's essentially
Windows signing, we sign and harden the binaries for macOS. Then we do
the same for the PKG installer, and finally notarize it. The ESRP
signing service requires a zip of files for Apple signing at all stages.
Now that we can use it via the OneBranch signing task we no longer need
the service connection or variable group that was trying to set it up.
Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Uses codesign in the macOS build step to apply entitlements from a plist.
This is required for the hardened runtime (which is required for notarization).

See: https://learn.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues#default-entitlements

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@adityapatwardhan adityapatwardhan force-pushed the backport/release/v7.4.16/27347-b9bd8cbc5 branch from 420dad8 to 8827d8e Compare May 13, 2026 23:32
@adityapatwardhan adityapatwardhan merged commit b8fbd0d into PowerShell:release/v7.4.16 May 15, 2026
38 checks passed
@adityapatwardhan adityapatwardhan deleted the backport/release/v7.4.16/27347-b9bd8cbc5 branch May 15, 2026 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants