Repository navigation
Use stable macOS signing identifiers - #20
Merged
Merged
Conversation
zanieb
marked this pull request as ready for review
October 16, 2026 15:57
woodruffw
reviewed
Oct 16, 2026
| "--pkcs11-key-label", | ||
| os.environ["KEY_NAME"], | ||
| "--binary-identifier", | ||
| source.name, |
Member
There was a problem hiding this comment.
I think RDNS is idiomatic even if we stick to just uv, so maybe f"sh.astral.{source.name}"?
Member
Author
There was a problem hiding this comment.
uhh I thought this is what it was doing, maybe it's being dumb, will check
woodruffw
approved these changes
Oct 16, 2026
This was referenced Oct 16, 2026
zanieb
added a commit
to astral-sh/ty
that referenced
this pull request
Oct 16, 2026
Adopt astral-sh/github-actions#20 so macOS releases use the stable `sh.astral.ty` code-signing identifier across architectures. Rules tied to the existing unprefixed x86_64 identifier will need a one-time update. Co-authored-by: zaniebot <[email protected]>
zanieb
added a commit
to astral-sh/ruff
that referenced
this pull request
Oct 16, 2026
Adopt astral-sh/github-actions#20 so macOS releases use the stable `sh.astral.ruff` code-signing identifier across architectures. Rules tied to the existing unprefixed x86_64 identifier will need a one-time update. Co-authored-by: zaniebot <[email protected]>
zanieb
added a commit
to astral-sh/uv
that referenced
this pull request
Oct 16, 2026
Adopt astral-sh/github-actions#20 so macOS releases use `sh.astral.uv`, `sh.astral.uvx`, and `sh.astral.uv-build` across architectures. These identifiers remain stable across releases as long as the filenames do; rules tied to the existing unprefixed x86_64 identifiers will need a one-time update. Co-authored-by: zaniebot <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
macOS ARM64
uvreleases retain linker-generated code-signing identifiers when signed with Developer ID. Those identifiers change between releases, so rules based on them can treat an upgrade as a different program (astral-sh/uv#22627).Derive each binary's code-signing identifier from its filename in the
sh.astralnamespace. This givesuv,uvx, anduv-builddistinct identifiers that remain stable as long as their filenames remain unchanged. Existing x86_64 binaries use unprefixed filenames as identifiers, so rules tied to those identifiers will need a one-time update.