fix(quoteforge[dist]): use rcodesign for darwin binaries on all hosts

Author: lordvins226

.github/workflows/release.yml

@@ -49,6 +49,24 @@ jobs:
       - name: Install deps
         run: bun install --frozen-lockfile
 
+      - name: Install rcodesign (darwin signing)
+        if: startsWith(matrix.bun-target, 'bun-darwin-')
+        shell: bash
+        env:
+          RCODESIGN_VERSION: "0.29.0"
+        run: |
+          set -e
+          case "$(uname -sm)" in
+            "Darwin arm64") asset="aarch64-apple-darwin" ;;
+            "Darwin x86_64") asset="x86_64-apple-darwin" ;;
+            "Linux x86_64") asset="x86_64-unknown-linux-musl" ;;
+            *) echo "unsupported host for rcodesign"; exit 1 ;;
+          esac
+          url="https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/${RCODESIGN_VERSION}/apple-codesign-${RCODESIGN_VERSION}-${asset}.tar.gz"
+          curl -fsSL "$url" | tar -xz
+          sudo mv "apple-codesign-${RCODESIGN_VERSION}-${asset}/rcodesign" /usr/local/bin/rcodesign
+          rcodesign --version
+
       - name: Build binary
         shell: bash
         env:

scripts/build-binaries.ts

@@ -35,10 +35,7 @@ async function sha256(file: string): Promise<string> {
 }
 
 async function adhocSignDarwin(binPath: string): Promise<void> {
-  if (process.platform !== "darwin") {
-    throw new Error("Darwin binaries must be ad-hoc signed on macOS with codesign.");
-  }
-  await $`codesign --sign - --force ${binPath}`;
+  await $`rcodesign sign ${binPath}`;
 }
 
 async function tarGz(binPath: string, archivePath: string, binName: string): Promise<void> {