fix(quoteforge[dist]): ad-hoc sign darwin binaries for apple silicon

Author: lordvins226

.github/workflows/release.yml

@@ -49,6 +49,18 @@ jobs:
       - name: Install deps
         run: bun install --frozen-lockfile
 
+      - name: Install rcodesign (for ad-hoc darwin signing)
+        if: startsWith(matrix.bun-target, 'bun-darwin-') && runner.os != 'macOS'
+        shell: bash
+        env:
+          RCODESIGN_VERSION: "0.29.0"
+        run: |
+          set -e
+          url="https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F${RCODESIGN_VERSION}/apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl -fsSL "$url" | tar -xz
+          sudo mv "apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl/rcodesign" /usr/local/bin/rcodesign
+          rcodesign --version
+
       - name: Build binary
         shell: bash
         env:

scripts/build-binaries.ts

@@ -34,6 +34,21 @@ async function sha256(file: string): Promise<string> {
   return hash.digest("hex");
 }
 
+async function adhocSignDarwin(binPath: string): Promise<void> {
+  if (process.platform === "darwin") {
+    await $`codesign --sign - --force ${binPath}`.quiet();
+    return;
+  }
+  try {
+    await $`rcodesign sign ${binPath}`.quiet();
+  } catch {
+    throw new Error(
+      "rcodesign is required to ad-hoc sign darwin binaries from non-macOS hosts. " +
+        "Install: https://github.com/indygreg/apple-platform-rs/releases (look for apple-codesign).",
+    );
+  }
+}
+
 async function tarGz(binPath: string, archivePath: string, binName: string): Promise<void> {
   const cwd = resolve(binPath, "..");
   await $`tar -czf ${archivePath} -C ${cwd} ${binName}`;
@@ -57,6 +72,10 @@ async function buildOne(target: Target): Promise<{ archive: string; sha256: stri
   console.log(`→ ${target.bunTarget}`);
   await $`bun build ${ENTRY} --compile --minify --target=${target.bunTarget} --outfile=${binPath}`.quiet();
 
+  if (target.bunTarget.startsWith("bun-darwin-")) {
+    await adhocSignDarwin(binPath);
+  }
+
   const archiveName = target.archive === "tar.gz"
     ? `quoteforge-${target.triple}.tar.gz`
     : `quoteforge-${target.triple}.zip`;