Add option to skip signing of runtime on macOS #138

Activity

1. neilcsmith-net

   added the

   Feature

   issue type on Jun 8, 2026
2. geertjanw commented on Oct 1, 2026

   

   geertjanw

   on Oct 1, 2026

   Member

   More actions

   I've taken a first stab at adding an option to skip re-signing the bundled JDK runtime on macOS.

   New option: package.macos.codesign-runtime (boolean, default true). Leaving it at the default keeps current behaviour. Setting it to false keeps the runtime's existing signatures, which should avoid the jlink "modified runtime" errors.

   A couple of things on the approach:

   • It filters by the runtime path (Contents/Home) rather than adjusting the signing glob, since FileUtils.find also matches on filename, so the default glob's *.dylib would still catch the runtime libs by name.
   • The final whole-bundle codesign doesn't use --deep, so it doesn't re-sign the runtime contents either, filtering the native-binary list is enough to preserve the JDK's original signatures.
   • Also added help text, a short README note, a log line when the runtime is skipped, and a test.

   Something ekse, per the mailing-list thread: skipping runtime re-signing could affect notarization or runtime permissions, so it'd be good for us to run a package built with codesign-runtime=false through notarization + stapling before relying on it.
3. geertjanw commented on Oct 1, 2026

   

   geertjanw

   on Oct 1, 2026

   Last edited by geertjanw

   Member

   More actions

   For review: #146
4. geertjanw

   added a commit that references this issue on Oct 1, 2026

   Add option to skip signing of JDK runtime on macOS (#138)

   ...

   0ecb1ac