macOS portable release publishes despite Invalid notarization result

Aberta
  • Algo errado?
#706 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 2 dias

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
50/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
github-actions, macos, shell
Domínio
ci-cd, release

Direção de pesquisa

The relevant step is 'Zip package and notarize Macos' in .github/workflows/build.yml, which runs xcrun notarytool submit ... --wait, followed by the 'Publish To S3' step that uploads lean-latest-macos.zip. Start by capturing the submission result as structured output and reading how the job reaches publication. Done means the step fails and skips upload unless the status is Accepted, with Accepted and Invalid cases covered by a test.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Observed failure

The macOS portable release for 1.0.233 was uploaded even though notarization returned Invalid:

https://github.com/QuantConnect/lean-cli/actions/runs/40571320470/job/122434730166

The job's notarization result is status: Invalid at 2026-10-27 20:15:49 UTC. It then runs Publish To S3, uploads lean-latest-macos.zip, and finishes successfully. Both the notarization and publication steps are marked successful.

This happened on macos-14, before #695, and the relevant commands are unchanged by that PR.

Where

In .github/workflows/build.yml, Zip package and notarize Macos runs xcrun notarytool submit ... --wait, but the subsequent publication does not check that the returned status is Accepted. A successful job therefore does not establish that the published archive passed notarization.

Expected behavior and suggested fix
  • Capture the submission result as structured output and explicitly require status == "Accepted" before uploading the macOS archive.
  • Make rejected, incomplete, or malformed results fail the job and prevent publication; cover Accepted and Invalid results with tests.
  • Retrieve the notarization diagnostic report to investigate the rejection separately. The public job log establishes the rejected result, but not its underlying cause.

The existing release log is the reproduction; no new release was triggered. This should be fixed before relying on the next macOS release's green workflow status as proof of successful notarization.

Linguagem predominante
Python
Estrelas
329
Forks
169
Merge médio
2d 21h
PRs com merge (30d)
18

Preparar o ambiente

Este projeto não oferece contêiner de desenvolvimento, Dockerfile nem guia de contribuição, então a configuração fica por sua conta: comece pelo README e veja nosso guia da primeira contribuição para os passos gerais.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de QuantConnect/lean-cli

Todas as issues de QuantConnect/lean-cli

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.