Native macOS code signatures

Stado's Darwin release worker signs staged native executables through Wisent Products before creating the immutable release archive. The archive digest and release receipt therefore describe the signed bytes, not an unsigned build that a consumer changes after verification. Python and JavaScript entrypoints, data files and non-Darwin builds are not re-signed.

Inspect and repair installed code

stado product signatures jeden --surface cli --json
stado product signatures jeden --surface cli --apply --json
wisent-products signing inspect ~/.stado/bin/jeden --json

The report includes each actual path, identifier, Apple team, authority, designated requirement, CDHash, state and operating-system error. adhoc means the identity depends on the bytes of one compilation. unsigned, invalid, missing and untrusted remain failures rather than readiness. An executable permission bit or a successful plain codesign --verify is not proof of stable identity.

Apply uses only the product's recorded installed paths. It signs sibling staged copies with an available Apple Development or Developer ID Application certificate and replaces a file only after verification. It does not restart services, reset TCC, grant Photos or Full Disk Access, or open a browser. An initial migration from ad-hoc signing can need one new macOS consent; later updates retain the identifier and Apple team. A new executable must satisfy the preceding stable designated requirement before replacement.

Builder and installer requirements

Wisent Products and the signing certificate must be available on the Darwin build host. WISENT_CODESIGN_IDENTITY selects an exact available certificate name or hash. A prior signed installation retains its authority unless a compatible identity was explicitly selected. A new installation selects an unambiguous Developer ID Application certificate, otherwise Apple Development. Missing or ambiguous identities refuse the operation. Passing - is refused with ad-hoc signing is not an installation identity.

wisent-products signing sign --product jeden target/release/jeden target/release/jeden-sandbox-helper
wisent-products signing sign --identifier com.wisent.stado.apple-challenge-capture /path/to/staged-helper
wisent-products signing stage --manifest .wisent-release.json --output .wisent-output --platform darwin-arm64 --json

A changed identifier is refused with code identifier would change: OLD -> NEW. A file changed concurrently is refused without replacing it. Native Cargo installations are built in a staging root, signed, and only then copied to the installed path. A macOS CLI carrying an unstable identity is reported as drifted by wisent-products status, even when its source revision is current.

A Darwin host that holds no signing certificate can be handed one for the length of a single command. WISENT_CODESIGN_CERTIFICATE_PEM carries the signing certificate first and its issuers after it, and WISENT_CODESIGN_PRIVATE_KEY_PEM carries the matching private key; both are required together. The signer stages them owner-only, refuses a key that does not belong to the certificate before replacing any file, imports the material into a temporary keychain, lists that keychain for the command only, and signs with the certificate's own SHA-1 identity. The keychain search list is restored, the temporary keychain deleted and the staging directory removed when the command ends. Nothing is written to a login keychain and no system dialog is opened. Apple's intermediate is not present on every Mac; without it macOS reports the certificate as no identity at all, and the refusal now says that the searched keychain holds the certificate and that its issuers are missing.

The Apple challenge helper uses this signer instead of ad-hoc signing. stado workload run gui-automation --target <target> --plan apple-only.json --json installs the pinned signer revision into ~/.stado/cache/native-signing/<sha256> on the target from the fleet's own object namespace, verifying that digest before use, then signs the compiled helper with the Apple certificate and key read from the Skarbiec item desktop-signing-apple-development and the pinned Apple issuer certificate. Certificate, key and issuer travel on the host channel's standard input and into the signing child's environment, never in a command line. The preparation path then reconciles the exact Accessibility requirement and performs its existing prompt-free readiness check; an ad-hoc helper is no longer reusable merely because its version matches.

Stado Desktop

Settings → Native code signatures on the Stado API host accepts a product and CLI or service surface. Read signatures submits the read-only product command. Repair signatures presents the selected product and endpoint before sending the same command with --apply and the existing mutation confirmation. The screen retains stdout, stderr, exit status, endpoint and any truncation or refusal. No local CLI process or second signing implementation exists in the application.

Verification

The Wisent Products real update test executes two distinct native product releases, signs both using a real Apple certificate, and verifies the replacement against the original requirement with macOS codesign. It also exercises refusals for an ad-hoc signing identity and a changed product identifier. A third story reads the stored certificate item, signs with the supplied certificate and key, signs a second file with the certificate and its issuer together, extracts the signing certificate back out of the signed bytes, refuses a key that does not match the certificate without replacing it, and reads the user keychain search list before and after to prove it is unchanged. Reports retain source identity, commands and exit statuses under that repository's .wisent-output/signing-tests/. This verifies code-identity continuity; it does not claim that macOS has granted a privacy permission.