[release/v7.5.7] Add macOS binary code signing and package notarization - #27467
Merged
Aditya Patwardhan (adityapatwardhan) merged 2 commits intoMay 18, 2026
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
We still need to apply the template signing so that Guardian tasks pass and so that script files are signed. After doing what's essentially Windows signing, we sign and harden the binaries for macOS. Then we do the same for the PKG installer, and finally notarize it. The ESRP signing service requires a zip of files for Apple signing at all stages. Now that we can use it via the OneBranch signing task we no longer need the service connection or variable group that was trying to set it up. Notarization requires the BundleId from Get-MacOSPackageIdentifierInfo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Uses codesign in the macOS build step to apply entitlements from a plist. This is required for the hardened runtime (which is required for notarization). See: https://learn.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues#default-entitlements Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Aditya Patwardhan (adityapatwardhan)
requested a review
from a team
as a code owner
May 17, 2026 18:48
Copilot started reviewing on behalf of
Aditya Patwardhan (adityapatwardhan)
May 17, 2026 18:49
View session
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Backport of #27347 to release/v7.5.7. Adds macOS Mach-O binary code signing (with hardened runtime entitlements), Apple ESRP signing of the build output, and notarization of the PKG installer; also exports Get-MacOSPackageIdentifierInfo so the BundleId can be passed to the notarization step.
Changes:
- Apply local ad-hoc codesign with hardened runtime + entitlements plist to pwsh during build; add a new assets/macos-entitlements.plist.
- Add OneBranch Apple ESRP signing of Mach-O binaries (zip/sign/unzip) and PKG notarization steps using CP-401337-Apple; remove the old mscodehub-macos-package-signing variable group / $(KeyCode) indirection.
- Export Get-MacOSPackageIdentifierInfo from packaging.psd1 and use it to surface BundleId as a pipeline output consumed by the notarization job; rework PKG expand/move logic to handle ESRP's nested .zip.unzipped layout.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| assets/macos-entitlements.plist | New entitlements plist enabling JIT, unsigned exec memory, dyld env vars, library validation disable — required for hardened runtime / notarization. |
| tools/packaging/packaging.psd1 | Exports Get-MacOSPackageIdentifierInfo so it's callable from the pipeline. |
| .pipelines/templates/mac.yml | Adds entitlement codesign step in build job and post-sign Apple ESRP signing of Mach-O binaries via zip/sign/expand. |
| .pipelines/templates/mac-package-build.yml | Adds Apple signature verification, computes BundleId, removes variable-group/KeyCode indirection, adds notarize task, and restructures PKG extraction for ESRP's nested zip layout. |
Sorry, something went wrong.
Patrick Meinecke (SeeminglyScience)
approved these changes
May 18, 2026
Aditya Patwardhan (adityapatwardhan)
merged commit b4905a1
into
PowerShell:release/v7.5.7
May 18, 2026
37 of 39 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27347 to release/v7.5.7
Triggered by Aditya Patwardhan (@adityapatwardhan) on behalf of Andy Jordan (@andyleejordan)
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Adds appLicensing capability to Appx manifest for improved packaging.
Customer Impact
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
No new tests required; change validated by successful build and Appx manifest inspection.
Risk
REQUIRED: Check exactly one box.
This change only adds a capability to the Appx manifest and does not affect runtime behavior.