[release/v7.4.16] Add macOS binary code signing and package notarization#27431
Merged
adityapatwardhan merged 2 commits intoMay 15, 2026
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Backport to release/v7.4.16 enabling macOS hardened runtime entitlements to be applied during the macOS build, in support of downstream macOS signing/notarization in the release packaging pipeline.
Changes:
- Add a macOS entitlements plist (
assets/macos-entitlements.plist) for hardened runtime signing. - Update the macOS build template to apply the entitlements via
codesignto the builtpwshbinary before publishing artifacts.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
assets/macos-entitlements.plist |
Introduces the entitlements used for macOS hardened runtime signing. |
.pipelines/templates/mac.yml |
Applies the entitlements to pwsh during the macOS build step via codesign. |
Comment on lines
+72
to
+78
| $entitlements = "$(PowerShellRoot)/assets/macos-entitlements.plist" | ||
| $pwshBin = "$(OB_OUTPUTDIRECTORY)/pwsh" | ||
| Write-Verbose -Verbose "Applying entitlements to $pwshBin" | ||
| codesign --sign - --force --options runtime --entitlements $entitlements $pwshBin | ||
| if ($LASTEXITCODE -ne 0) { | ||
| throw "codesign failed with exit code $LASTEXITCODE" | ||
| } |
Comment on lines
+4
to
+10
| <dict> | ||
| <key>com.apple.security.cs.allow-jit</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.allow-unsigned-executable-memory</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.allow-dyld-environment-variables</key> | ||
| <true/> |
We still need to apply the template signing so that Guardian tasks pass and so that script files are signed. After doing what's essentially Windows signing, we sign and harden the binaries for macOS. Then we do the same for the PKG installer, and finally notarize it. The ESRP signing service requires a zip of files for Apple signing at all stages. Now that we can use it via the OneBranch signing task we no longer need the service connection or variable group that was trying to set it up. Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Uses codesign in the macOS build step to apply entitlements from a plist. This is required for the hardened runtime (which is required for notarization). See: https://learn.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues#default-entitlements Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
420dad8 to
8827d8e
Compare
andyleejordan
approved these changes
May 14, 2026
b8fbd0d
into
PowerShell:release/v7.4.16
38 checks passed
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27347 to release/v7.4.16
Triggered by @adityapatwardhan on behalf of @andyleejordan
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Backports build and packaging pipeline updates required to support macOS binary signing and notarization in the release branch pipeline.
Customer Impact
Ensures release packaging/signing workflow works correctly for macOS artifacts and avoids pipeline regressions during release engineering.
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Cherry-pick applied cleanly in D:\PSGit\PowerShell-backport with no conflicts. Validation will run via CI on the backport PR for release/v7.4.16 pipeline paths.
Risk
REQUIRED: Check exactly one box.
Changes are in build/pipeline packaging and signing flow; they are scoped to release engineering but can affect release pipeline behavior if incorrect.