[release/v7.5.8] Verify Apple codesign immediately after ESRP signing - #27541
Merged
Patrick Meinecke (SeeminglyScience) merged 1 commit intoMay 28, 2026
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Patrick Meinecke (SeeminglyScience)
requested a review
from a team
as a code owner
May 28, 2026 18:40
Copilot started reviewing on behalf of
Patrick Meinecke (SeeminglyScience)
May 28, 2026 18:40
View session
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Backport of #27486 to release/v7.5.8 that adds a post-ESRP verification step in the macOS signing jobs to detect silent ESRP no-ops by scanning signed Mach-O binaries for the expected "Developer ID Application: Microsoft Corporation" string, failing the job if any are missing.
Changes:
- Adds a PowerShell verification step in Sign_macOS_* jobs immediately after ESRP zip expansion.
- Fails fast on missing Developer ID signatures so bad signed artifacts are never published.
Sorry, something went wrong.
Aditya Patwardhan (adityapatwardhan)
approved these changes
May 28, 2026
Patrick Meinecke (SeeminglyScience)
merged commit c3fb5fa
into
PowerShell:release/v7.5.8
May 28, 2026
35 checks passed
Patrick Meinecke (SeeminglyScience)
deleted the
backport/release/v7.5.8/27486-5e6ecd370
branch
May 29, 2026 17:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27486 to release/v7.5.8
Triggered by Patrick Meinecke (@SeeminglyScience) on behalf of Andy Jordan (@andyleejordan)
Original CL Label: CL-BuildPackaging
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Adds codesign --verify --deep --strict verification immediately after ESRP signing in Sign_macOS_* pipeline jobs. This ensures silent ESRP no-ops are caught in the signing job itself rather than discovered later in packaging, preventing publication of bad signed artifacts.
Customer Impact
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Verified by next pipeline run. This is a pipeline YAML-only change adding a defensive verification step — no unit tests apply. The original change was validated during a release build where ESRP silently no-op'd; this check would have caught it at the sign stage.
Risk
REQUIRED: Check exactly one box.
Pipeline YAML only — no runtime code changes. The added step is read-only verification (codesign --verify) that fails fast rather than publishing a bad artifact. No customer-facing behavior is affected.