fix(release): re-codesign macOS binaries after strip — v0.5.73

.github/workflows/release.yml

@@ -255,6 +255,37 @@ jobs:
 
           echo "✅ Build completed for ${{ matrix.target }}"
 
+      - name: Re-codesign macOS binaries (post-strip)
+        if: contains(matrix.target, 'apple-darwin')
+        shell: bash
+        run: |
+          # `[profile.release].strip = "symbols"` in Cargo.toml strips the
+          # Mach-O symbol table AFTER the linker has emitted an ad-hoc
+          # (linker-signed) CodeDirectory.  Strip changes the on-disk hash
+          # the CodeDirectory was computed over, leaving the signature
+          # internally inconsistent.  macOS 26+'s taskgated then refuses
+          # to launch the binary with `SIGKILL (Code Signature Invalid)`
+          # / namespace=CODESIGNING / "Taskgated Invalid Signature".
+          #
+          # Re-stamping the ad-hoc signature with `codesign --force
+          # --sign -` recomputes the CodeDirectory over the post-strip
+          # bytes so the in-memory hash matches the on-disk file again.
+          # We deliberately stay ad-hoc: we don't have an Apple Developer
+          # ID; the resulting binaries are still unnotarized and users
+          # see the standard "open anyway" Gatekeeper prompt on first
+          # launch.  But they no longer get killed at exec time.
+          #
+          # Gated on `apple-darwin` so Windows / Linux artifact paths
+          # stay untouched.
+          set -euo pipefail
+          for bin in uffs uffsd uffsmcp uffs_mft; do
+            path="target/${{ matrix.target }}/release/$bin"
+            if [[ -f "$path" ]]; then
+              codesign --force --sign - "$path"
+              codesign --verify --verbose=2 "$path"
+            fi
+          done
+
       - name: Show binary sizes
         shell: bash
         run: |

CHANGELOG.md

@@ -14,6 +14,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.73] - 2026-04-25
+
+### Fixed
+- **macOS arm64 release binaries SIGKILLed at launch** under macOS 26+
+  (`SIGKILL (Code Signature Invalid)` / `namespace=CODESIGNING` /
+  `"Taskgated Invalid Signature"`).  `[profile.release].strip = "symbols"`
+  in `Cargo.toml` strips the Mach-O symbol table **after** the linker has
+  emitted an ad-hoc (linker-signed) `CodeDirectory`, leaving the embedded
+  hash inconsistent with the on-disk file.  macOS 26+'s hardened
+  taskgated then refuses to launch the binary.  In v0.5.72 this hit
+  `uffsmcp` and `uffsd` deterministically; `uffs` and `uffs_mft` survived
+  by binary-layout chance — a fragile guarantee that wouldn't hold on
+  the next rebuild.
+
+  Fix: add a `Re-codesign macOS binaries (post-strip)` step to
+  `release.yml` that re-stamps the ad-hoc signature with `codesign
+  --force --sign -` on every shipping `apple-darwin` binary after
+  `cargo build --release` finishes.  The step is gated on
+  `contains(matrix.target, 'apple-darwin')` so Windows / Linux artifact
+  paths are untouched.  Each re-signed binary is then verified with
+  `codesign --verify --verbose=2` so a regression here fails the
+  workflow loudly instead of shipping broken artifacts.
+
+  Workaround for users still on a v0.5.72 download:
+
+  ```bash
+  codesign --force --sign - ~/bin/uffsmcp ~/bin/uffsd
+  ```
+
+  Re-signs in place; macOS picks up the refreshed `CodeDirectory` on the
+  next exec and the binaries launch normally.
+
+  No code changes; release-only fix.  Recommended upgrade for every Mac
+  user on macOS 26+.
+
 ## [0.5.72] - 2026-04-25
 
 ### Changed

Cargo.toml

@@ -44,7 +44,7 @@ members = [
 # Workspace Package Metadata (inherited by all crates)
 # ─────────────────────────────────────────────────────────────────────────────
 [workspace.package]
-version = "0.5.72"
+version = "0.5.73"
 edition = "2024"
 # MSRV: Pure Rust code compiles on stable 1.91+ (Duration::from_mins),
 # but Polars is built with features = ["nightly", "simd"] which requires