macOS portable release publishes despite Invalid notarization result

Abierto
  • ¿Algo no está bien?
#706 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
50/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, macos, shell
Área
ci-cd, release

Línea de trabajo

The relevant step is 'Zip package and notarize Macos' in .github/workflows/build.yml, which runs xcrun notarytool submit ... --wait, followed by the 'Publish To S3' step that uploads lean-latest-macos.zip. Start by capturing the submission result as structured output and reading how the job reaches publication. Done means the step fails and skips upload unless the status is Accepted, with Accepted and Invalid cases covered by a test.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Observed failure

The macOS portable release for 1.0.233 was uploaded even though notarization returned Invalid:

https://github.com/QuantConnect/lean-cli/actions/runs/40571320470/job/122434730166

The job's notarization result is status: Invalid at 2026-10-27 20:15:49 UTC. It then runs Publish To S3, uploads lean-latest-macos.zip, and finishes successfully. Both the notarization and publication steps are marked successful.

This happened on macos-14, before #695, and the relevant commands are unchanged by that PR.

Where

In .github/workflows/build.yml, Zip package and notarize Macos runs xcrun notarytool submit ... --wait, but the subsequent publication does not check that the returned status is Accepted. A successful job therefore does not establish that the published archive passed notarization.

Expected behavior and suggested fix
  • Capture the submission result as structured output and explicitly require status == "Accepted" before uploading the macOS archive.
  • Make rejected, incomplete, or malformed results fail the job and prevent publication; cover Accepted and Invalid results with tests.
  • Retrieve the notarization diagnostic report to investigate the rejection separately. The public job log establishes the rejected result, but not its underlying cause.

The existing release log is the reproduction; no new release was triggered. This should be fixed before relying on the next macOS release's green workflow status as proof of successful notarization.

Lenguaje dominante
Python
Estrellas
329
Forks
169
Merge medio
2 d 21 h
PR fusionados (30 d)
18

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de QuantConnect/lean-cli

Todos los issues de QuantConnect/lean-cli

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.