fix(setup): truncate Bun trailing padding before codesign; stop false-alarm Apple Silicon warning

[brandonlipman]

Symptom

On Apple Silicon, ./setup prints:

warning: codesign failed for browse/dist/find-browse (binary may not run on Apple Silicon)
warning: codesign failed for bin/gstack-global-discover (binary may not run on Apple Silicon)

Both binaries run fine — the warning is a false alarm. browse, design, and pdf never warn.

Root cause

bun build --compile leaves ~19 KB of trailing zero-padding after the Mach-O LC_CODE_SIGNATURE region for find-browse and gstack-global-discover (verified: browse/design/pdf have 0 trailing bytes). macOS codesign requires the signature to be the last content and extend to EOF, so the padding makes both setup steps fail:

• codesign --remove-signature → internal error in Code Signing subsystem
• codesign -s - -f → main executable failed strict validation

The re-sign fails, leaving Bun's original adhoc linker-signed signature in place. That signature still covers the executable code pages, so the kernel's exec-time check passes and the binary runs — even though codesign --verify is unhappy.

Measured (signature end vs file size):

binary	trailing bytes after sig	codesign --verify
browse / design / pdf	0	PASS
find-browse / gstack-global-discover	19326	FAIL

Confirmation test: truncating a copy of find-browse to the signature end makes the identical codesign -s - -f succeed and codesign --verify --strict pass, and the binary still runs.

Fix

setup (the Darwin + arm64 codesign loop):

1. Truncate trailing bytes past LC_CODE_SIGNATURE (offset from otool dataoff+datasize) before signing. Degrades safely if otool is unavailable or there is no trailing slack.
2. SIGKILL-gated warning — if the re-sign still fails, probe the binary and reserve the "may not run on Apple Silicon" warning for a genuine exit 137 (SIGKILL); otherwise emit an informational note. The probe is set -e safe (|| _probe_rc=$?).

Tests

Two regression tests added to test/setup-codesign.test.ts (truncation logic + SIGKILL-gated warning). Both fail on the pre-fix setup. Full suite: 8 pass / 0 fail.

🤖 Generated with Claude Code