From 1558e8cda7f1b87f22122f61c2c035de7e216ce1 Mon Sep 17 00:00:00 2001 From: Ryan Aslett Date: Mon, 19 Oct 2026 09:46:29 -0700 Subject: [PATCH] tools: retry Gatekeeper check and stapling after notarization Apple's ticket service can lag behind notarytool reporting "Accepted", which makes the spctl assessment fail with "source=Unnotarized Developer ID" even though the package was notarized. Retry spctl and stapler with exponential backoff (up to ~7.5 minutes) before failing, and fail the script if stapling does not succeed instead of ignoring its exit status. Refs: https://github.com/nodejs/build/issues/4527 Signed-off-by: Ryan Aslett --- tools/osx-notarize.sh | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/tools/osx-notarize.sh b/tools/osx-notarize.sh index d860074bf7d..06ba801c9e8 100755 --- a/tools/osx-notarize.sh +++ b/tools/osx-notarize.sh @@ -48,12 +48,31 @@ else exit 1 fi -if ! xcrun spctl --assess --type install --context context:primary-signature --ignore-cache --verbose=2 "node-$pkgid.pkg"; then +# The notarization ticket can take a while to become available from Apple's +# servers after notarytool reports "Accepted", so retry with backoff. +retry() { + delay=15 + attempt=1 + while ! "$@"; do + if [ "$attempt" -ge 6 ]; then + return 1 + fi + echo "Attempt $attempt failed, retrying in ${delay}s..." + sleep "$delay" + attempt=$((attempt + 1)) + delay=$((delay * 2)) + done +} + +if ! retry xcrun spctl --assess --type install --context context:primary-signature --ignore-cache --verbose=2 "node-$pkgid.pkg"; then echo "error: Signature will not be accepted by Gatekeeper!" 1>&2 exit 1 else echo "Verification was successful." fi -xcrun stapler staple "node-$pkgid.pkg" +if ! retry xcrun stapler staple "node-$pkgid.pkg"; then + echo "error: Stapling node-$pkgid.pkg failed." 1>&2 + exit 1 +fi echo "Stapler was successful." \ No newline at end of file