From a23c6a117d8b891e99022455162e865bb760a0b7 Mon Sep 17 00:00:00 2001 From: Dave Page Date: Mon, 26 Oct 2026 20:38:08 +0000 Subject: [PATCH 1/2] Retry stapler validate in the macOS acceptance test. It looks the notarisation ticket up in Apple's CloudKit, and a dropped connection there failed the arm64 job on a disk image that was fine. --- .github/workflows/acceptance-test.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/acceptance-test.yml b/.github/workflows/acceptance-test.yml index 5573daaef68..292e8dc7a74 100644 --- a/.github/workflows/acceptance-test.yml +++ b/.github/workflows/acceptance-test.yml @@ -335,7 +335,15 @@ jobs: # on the bundle, set by SetFile -a E in _create_dmg to hide the .app # extension in the window, and --strict rejects any xattr at all. echo "=== notarisation and Gatekeeper ===" - xcrun stapler validate "${app}" + # stapler looks the ticket up in Apple's CloudKit, and a dropped + # connection there fails the step with error 68, so it is retried. + # A genuinely broken ticket still fails all three attempts. + for attempt in 1 2 3; do + xcrun stapler validate "${app}" && break + [ "${attempt}" -lt 3 ] || exit 1 + echo "stapler validate failed; retrying in $((attempt * 30))s" + sleep $((attempt * 30)) + done spctl --assess --type execute --verbose=4 "${app}" echo "=== signature ===" From de91577aa3b6458ae65ba400956d70bbb2d4f8d3 Mon Sep 17 00:00:00 2001 From: Dave Page Date: Mon, 26 Oct 2026 23:56:08 +0000 Subject: [PATCH 2/2] Retry stapler validate in the macOS build's verification step too. The same CloudKit connection drop failed the arm64 build of a release candidate whose bundle Gatekeeper had just accepted as notarised. --- .github/workflows/snapshot-macos.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/snapshot-macos.yml b/.github/workflows/snapshot-macos.yml index f4afdcfdbb1..797cb2129e9 100644 --- a/.github/workflows/snapshot-macos.yml +++ b/.github/workflows/snapshot-macos.yml @@ -141,10 +141,21 @@ jobs: echo "=== gatekeeper assessment ===" spctl --assess --type execute --verbose=4 "${APP}" echo "=== stapled notarisation ===" - xcrun stapler validate "${APP}" + # stapler looks the ticket up in Apple's CloudKit, and a dropped + # connection there fails the step with error 68, so it is retried. + # A genuinely broken ticket still fails all three attempts. + validate() { + for attempt in 1 2 3; do + xcrun stapler validate "$1" && return 0 + [ "${attempt}" -lt 3 ] || return 1 + echo "stapler validate failed; retrying in $((attempt * 30))s" + sleep $((attempt * 30)) + done + } + validate "${APP}" for F in dist/*.dmg; do echo "--- ${F} ---" - xcrun stapler validate "${F}" + validate "${F}" done - name: Archive the disk image and zip