The --shallow flag doesn't seem like it actually works. When we use it, we see that it initially skips the nested bundle:
1 nested bundles will be copied instead of signed because shallow signing enabled:
Contents/lib/tlclient/vncviewer.app
entering nested bundle Contents/lib/tlclient/vncviewer.app
shallow signing enabled; bundle will be copied instead of signed
leaving nested bundle Contents/lib/tlclient/vncviewer.app
compared to a normal run:
signing 1 nested bundles in the following order:
Contents/lib/tlclient/vncviewer.app
entering nested bundle Contents/lib/tlclient/vncviewer.app
signing bundle at ThinLinc Client Signed.app/Contents/lib/tlclient/vncviewer.app into ThinLinc Client Signed.app/Contents/lib/tlclient/vncviewer.app
signing main executable Contents/MacOS/vncviewer
creating cryptographic signature with certificate Developer ID Application: Cendio AB (PHUT6TWL4H)
leaving nested bundle Contents/lib/tlclient/vncviewer.app
However, it still decides to sign those files unconditionally later in the process:
signing Mach-O file Contents/lib/tlclient/vncviewer.app/Contents/MacOS/vncviewer
Overwriting any existing signature on that file that has been carefully created.
The workaround has been to --exclude the nested bundle instead.
The
--shallowflag doesn't seem like it actually works. When we use it, we see that it initially skips the nested bundle:compared to a normal run:
However, it still decides to sign those files unconditionally later in the process:
Overwriting any existing signature on that file that has been carefully created.
The workaround has been to
--excludethe nested bundle instead.