macOS portable release publishes despite Invalid notarization result

Aperta
  • Qualcosa non va?
#706 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
50/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, macos, shell
Ambito
ci-cd, release

Direzione di ricerca

The relevant step is 'Zip package and notarize Macos' in .github/workflows/build.yml, which runs xcrun notarytool submit ... --wait, followed by the 'Publish To S3' step that uploads lean-latest-macos.zip. Start by capturing the submission result as structured output and reading how the job reaches publication. Done means the step fails and skips upload unless the status is Accepted, with Accepted and Invalid cases covered by a test.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Observed failure

The macOS portable release for 1.0.233 was uploaded even though notarization returned Invalid:

https://github.com/QuantConnect/lean-cli/actions/runs/40571320470/job/122434730166

The job's notarization result is status: Invalid at 2026-10-27 20:15:49 UTC. It then runs Publish To S3, uploads lean-latest-macos.zip, and finishes successfully. Both the notarization and publication steps are marked successful.

This happened on macos-14, before #695, and the relevant commands are unchanged by that PR.

Where

In .github/workflows/build.yml, Zip package and notarize Macos runs xcrun notarytool submit ... --wait, but the subsequent publication does not check that the returned status is Accepted. A successful job therefore does not establish that the published archive passed notarization.

Expected behavior and suggested fix
  • Capture the submission result as structured output and explicitly require status == "Accepted" before uploading the macOS archive.
  • Make rejected, incomplete, or malformed results fail the job and prevent publication; cover Accepted and Invalid results with tests.
  • Retrieve the notarization diagnostic report to investigate the rejection separately. The public job log establishes the rejected result, but not its underlying cause.

The existing release log is the reproduction; no new release was triggered. This should be fixed before relying on the next macOS release's green workflow status as proof of successful notarization.

Lingua principale
Python
Stelle
329
Fork
169
Merge medio
2g 21h
PR unite (30g)
18

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di QuantConnect/lean-cli

Tutte le issue di QuantConnect/lean-cli

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.