Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

v26.13.0 Darwin tarball binaries are not notarized

Abierto
  • ¿Algo no está bien?
#4,545 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
47/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
macos
Área
release

Línea de trabajo

Start by checking the macOS release packaging job and the post-notarization check referenced in #4527, then compare how it handles the pkg and Darwin tarball binaries. Determine why the v26.13.0 arm64 and x64 tarballs lack notarization tickets while the pkg and v26.12.1 tarball are notarized. Done means both existing tarball binaries are registered with Apple without changing their SHAs.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

I was chasing down a sudden performance regression in a tool that spawns a lot of child processes, and ended up narrowing it to notarization issues with the 26.13.0 macOS tarballs.

The missing notarization sends Gatekeeper / syspolicyd into conniptions: in any process tree launched through a #!/bin/sh bin shim (so every npm/pnpm CLI), syspolicyd logs violates validation category policy. This will likely result in a block in the future and does a full trust evaluation on every process event. That adds ~3.5 ms to every posix_spawn attempt libuv makes while walking PATH, so a child_process spawn by bare name goes from ~10 ms to ~70 ms. Node 22, 24 and 26.12.1 binaries on the same machine are fine.

The bin/node binaries in the published node-v26.13.0-darwin-arm64.tar.gz and node-v26.13.0-darwin-x64.tar.gz are Developer ID signed but have no notarization ticket. node-v26.13.0.pkg is notarized and stapled. The darwin-arm64 tarball binary from v26.12.1 does have a ticket, so this looks specific to the v26.13.0 release build rather than to tarballs in general.

Quick check:

for v in v26.13.0 v26.12.1; do
  curl -fsSLO "https://nodejs.org/dist/$v/node-$v-darwin-arm64.tar.gz"
  tar -xzf "node-$v-darwin-arm64.tar.gz" "node-$v-darwin-arm64/bin/node"
  codesign --verify --verbose=2 -R='notarized' "node-$v-darwin-arm64/bin/node"
done

This logs:

node-v26.13.0-darwin-arm64/bin/node: valid on disk
node-v26.13.0-darwin-arm64/bin/node: satisfies its Designated Requirement
test-requirement: code failed to satisfy specified code requirement(s)
node-v26.12.1-darwin-arm64/bin/node: valid on disk
node-v26.12.1-darwin-arm64/bin/node: satisfies its Designated Requirement
node-v26.12.1-darwin-arm64/bin/node: explicit requirement satisfied

Same for the x64 tarball.

This may be related to #4527, where the post-notarization check in the macOS release-pkg job intermittently reported source=Unnotarized Developer ID. The retry loop there wraps the pkg check, so the tarball binaries may have slipped past it.

As far as I understand it, fixing this doesn't require changing the published tarballs: submitting a zip of each existing bin/node to notarytool registers its CDHash with Apple, and Gatekeeper looks tickets up by hash, so the SHAs stay the same. Would that be possible so people don't have to tiptoe around 26.13.0?

(Not sure if this belongs here or in nodejs/node. Apologies if I guessed wrong.)

Lenguaje dominante
Jinja
Estrellas
544
Forks
184
Merge medio
3 d 12 h
PR fusionados (30 d)
7

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de nodejs/build

Todos los issues de nodejs/build

Issues similares

Más issues de Release

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.