Verify app bundles through the signed? helper

Review feedback: two call sites each spelled out their own `codesign
--verify` invocation, leaving the reader to work out how they differed.
The helper now owns the command, and the difference lives at the call
site instead: an unsigned disk image is tolerated, an unsigned app
bundle is not.

Failures on an app bundle now carry the `codesign` output in the error
message, which the previous fixed string dropped.

---

Generated with the help of Claude Code, https://claude.ai/code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mokagio

lib/fastlane/plugin/wpmreleasetoolkit/actions/macos/macos_verify_code_signing.rb

@@ -29,7 +29,7 @@ def self.run(params)
       end
 
       def self.verify_app_bundle(path:, expected_authority:, verify_notarization:)
-        verify!("The code signature of #{path} is not valid", 'codesign', '--verify', '--deep', '--strict', '--verbose=2', path)
+        UI.user_error!("#{path} is not signed at all") unless signed?(path, deep: true)
         verify_authority!(path: path, expected_authority: expected_authority) unless expected_authority.nil?
 
         return unless verify_notarization
@@ -61,8 +61,14 @@ def self.verify_disk_image(path:, expected_authority:, verify_notarization:)
       # Distinguishes an artifact that carries no signature at all from one whose signature is
       # broken: the former is expected for a disk image, the latter always a failure.
       #
-      def self.signed?(path)
-        exitstatus, output = sh('codesign', '--verify', '--strict', '--verbose=2', path) { |status, result, _| [status.exitstatus, result] }
+      # @param deep [Boolean] Whether to also verify the nested code an app bundle embeds.
+      #
+      def self.signed?(path, deep: false)
+        command = ['codesign', '--verify']
+        command << '--deep' if deep
+        command += ['--strict', '--verbose=2', path]
+
+        exitstatus, output = sh(*command) { |status, result, _| [status.exitstatus, result] }
 
         return true if exitstatus.zero?
         return false if output.include?('not signed at all')

spec/macos_verify_code_signing_spec.rb

@@ -21,8 +21,8 @@ def with_artifacts(*names)
     end
   end
 
-  def expect_codesign_verify_deep(path, exitstatus: 0)
-    expect_shell_command('codesign', '--verify', '--deep', '--strict', '--verbose=2', path, exitstatus: exitstatus)
+  def expect_codesign_verify_deep(path, exitstatus: 0, output: '')
+    expect_shell_command('codesign', '--verify', '--deep', '--strict', '--verbose=2', path, exitstatus: exitstatus, output: output)
   end
 
   def expect_codesign_verify(path, exitstatus: 0, output: '')
@@ -93,13 +93,23 @@ def expect_stapler_validate(path, exitstatus: 0)
 
     it 'fails when the signature is not valid' do
       with_artifacts('Test.app') do |(path)|
-        expect_codesign_verify_deep(path, exitstatus: 1)
+        expect_codesign_verify_deep(path, exitstatus: 1, output: "#{path}: invalid signature (code or signature have been modified)\n")
 
         expect { run_described_fastlane_action(artifact_path: path) }
           .to raise_error(FastlaneCore::Interface::FastlaneError, /The code signature of .*Test\.app is not valid/)
       end
     end
 
+    # Unlike a disk image, an app bundle without a signature is always a failure.
+    it 'fails when it is not signed at all' do
+      with_artifacts('Test.app') do |(path)|
+        expect_codesign_verify_deep(path, exitstatus: 1, output: "#{path}: code object is not signed at all\n")
+
+        expect { run_described_fastlane_action(artifact_path: path) }
+          .to raise_error(FastlaneCore::Interface::FastlaneError, /Test\.app is not signed at all/)
+      end
+    end
+
     it 'fails when Gatekeeper rejects it' do
       with_artifacts('Test.app') do |(path)|
         expect_codesign_verify_deep(path)