Repository navigation
Conversation
By default NBPackage re-signs the whole installation payload on macOS, including the bundled JDK runtime. Re-signing rewrites each runtime binary's signature, which changes the hash that jlink verifies against and leads to "modified runtime" errors. Add a package.macos.codesign-runtime option (boolean, default true) to keep the runtime's existing signatures. When false, native binaries under Contents/Home are excluded from the signing list; the final bundle codesign does not use --deep so the runtime is left untouched.
The nativeBinaries list stores paths with the OS separator, so the Contents/Home checks failed on Windows. Normalize to forward slashes before matching.
geertjanw
force-pushed
the
issue-138-skip-runtime-signing
branch
from
October 1, 2026 10:20
05dcb07 to
77b841e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #138.
Adds an opt-in option to skip re-signing the bundled JDK runtime on macOS.
New option:
package.macos.codesign-runtime(boolean, defaulttrue). Leaving it at the default keeps the current behaviour. Setting it tofalsekeeps the runtime's existing signatures, which avoids thejlink"modified runtime" errors described in the issue and mailing-list thread.Notes on the approach:
Contents/Home) rather than adjusting the signing glob, sinceFileUtils.findalso matches on filename — so the default glob's*.dylibwould still catch the runtime libs by name.codesigndoes not use--deep, so it does not re-sign the runtime contents either; filtering the native-binary list is enough to preserve the JDK's original signatures.Worth keeping in mind, per the mailing-list thread: skipping runtime re-signing could affect notarization or runtime permissions in some setups, so a package built with
codesign-runtime=falseshould be run through notarization + stapling before leaning on it. Happy to adjust the option name or default if there's a preference.