Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[bug] bl update: darwin-arm64 binary ships invalid ad-hoc signature, killed by macOS (Killed: 9)

Open Beginner friendly
#223 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
cli, macos, nodejs, typescript
Domain
cli, release

Research direction

The issue is with the darwin-arm64 binary's invalid ad-hoc signature. Start by examining the CI/CD release pipeline (likely in .github/workflows) to see how the binary is built and signed. Look for the step that creates the macOS artifact. The fix is to ensure the binary is properly signed with codesign --force --sign - after any modifications. Test by building a local binary and verifying it runs on macOS Apple Silicon.

Written by the indexing model from the issue text.

Description

Environment

  • CLI: bl 2.0.1（binary 布局 ~/.local/share/bailian-cli/versions/2.0.1/bl）
  • Skill: 2.0.1
  • Node: v22.23.1（npm 渠道副本；二进制渠道不依赖 Node）
  • OS: macOS 27.0 (26A428), Apple Silicon (arm64)
  • Region: cn

Reproduce

  1. 环境原有 npm 安装的 bl 1.28.0（工作正常）

  2. 运行 bl update → 更新到 2.0.1 二进制布局（~/.local/bin/bl → versions/2.0.1/bl）

  3. 运行 bl --version：

    zsh: killed     bl --version
# exit 137 (SIGKILL)

  4. 签名校验：

    $ codesign -v .../versions/2.0.1/bl
...: invalid signature (code or signature have been modified)
In architecture: arm64

$ codesign -dvv .../versions/2.0.1/bl
CodeDirectory v=20400 size=492094 flags=0x20002(adhoc,linker-signed)
Signature=adhoc
Identifier=a.out

Expected

官方 darwin-arm64 二进制应带有效签名，bl update 后可直接运行。

Actual

二进制自带 ad-hoc（linker-signed）签名无效，Apple Silicon 内核强制签名校验直接 SIGKILL，无法启动。

已排除下载损坏/篡改

  • 从 CDN 重新下载 v2.0.1 zip，sha256 与 manifest.json 的 assets.darwin-arm64.sha256 一致
  • 解压后二进制 sha256 与 bl update 安装到本地的完全一致（tar.gz 通道亦同）
  • 即官方 artifact 本身签名即无效，非网络损坏或篡改；文件无 com.apple.quarantine 属性，与 Gatekeeper 隔离无关

Workaround

codesign --force --sign - ~/.local/share/bailian-cli/versions/<ver>/bl

本地 ad-hoc 重签后 bl --version 正常输出 bl 2.0.1。

Notes

  • Frequency: always（2.0.1 darwin-arm64 必现）
  • Invoked via: terminal / agent
  • 推测发布流水线在 link 后修改了二进制未重签；建议发布前 codesign --force --sign - 或 CI 中加签名校验
Dominant language
TypeScript
Stars
333
Forks
28
Avg merge
1d 8h
Merged PRs (30d)
38

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelstudioai/cli

All issues in modelstudioai/cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.