fix(quoteforge[dist]): sign darwin binaries on macos-latest runners

Author: lordvins226

.github/workflows/release.yml

@@ -19,10 +19,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: macos-latest
             bun-target: bun-darwin-arm64
             triple: aarch64-apple-darwin
-          - os: ubuntu-latest
+          - os: macos-latest
             bun-target: bun-darwin-x64
             triple: x86_64-apple-darwin
           - os: ubuntu-latest
@@ -49,18 +49,6 @@ jobs:
       - name: Install deps
         run: bun install --frozen-lockfile
 
-      - name: Install rcodesign (for ad-hoc darwin signing)
-        if: startsWith(matrix.bun-target, 'bun-darwin-') && runner.os != 'macOS'
-        shell: bash
-        env:
-          RCODESIGN_VERSION: "0.29.0"
-        run: |
-          set -e
-          url="https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F${RCODESIGN_VERSION}/apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl.tar.gz"
-          curl -fsSL "$url" | tar -xz
-          sudo mv "apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl/rcodesign" /usr/local/bin/rcodesign
-          rcodesign --version
-
       - name: Build binary
         shell: bash
         env:

scripts/build-binaries.ts

@@ -35,18 +35,10 @@ async function sha256(file: string): Promise<string> {
 }
 
 async function adhocSignDarwin(binPath: string): Promise<void> {
-  if (process.platform === "darwin") {
-    await $`codesign --sign - --force ${binPath}`.quiet();
-    return;
-  }
-  try {
-    await $`rcodesign sign ${binPath}`.quiet();
-  } catch {
-    throw new Error(
-      "rcodesign is required to ad-hoc sign darwin binaries from non-macOS hosts. " +
-        "Install: https://github.com/indygreg/apple-platform-rs/releases (look for apple-codesign).",
-    );
+  if (process.platform !== "darwin") {
+    throw new Error("Darwin binaries must be ad-hoc signed on macOS with codesign.");
   }
+  await $`codesign --sign - --force ${binPath}`;
 }
 
 async function tarGz(binPath: string, archivePath: string, binName: string): Promise<void> {