From 02d50a3568466631c513ef69f7357c0e2483506c Mon Sep 17 00:00:00 2001
From: Evan Hoffman <evandhoffman@gmail.com>
Date: Fri, 4 Sep 2026 22:52:58 -0400
Subject: [PATCH] Sign monitord so the notary service accepts the zip

---
 Scripts/make-app.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Scripts/make-app.sh b/Scripts/make-app.sh
index ddffdbf..a05d133 100755
--- a/Scripts/make-app.sh
+++ b/Scripts/make-app.sh
@@ -142,6 +142,15 @@ swift build -c release --product monitord
 monitord="$(swift build -c release --product monitord --show-bin-path)/monitord"
 [ -x "$monitord" ] || { echo "no binary at $monitord" >&2; exit 1; }
 
+# The daemon must be signed too, or the notary service rejects the whole zip:
+# it scans every binary in the archive, and an unsigned one is "Invalid".
+if [ -n "$identity" ]; then
+    codesign --force --options runtime --timestamp --sign "$identity" "$monitord"
+else
+    codesign --force --sign - --timestamp=none "$monitord" >/dev/null 2>&1 \
+        || echo "warning: could not sign $monitord; it will still run" >&2
+fi
+
 package=".build/package"
 rm -rf "$package"
 mkdir -p "$package"