From 2605bf78f943321ce11d8fc7138f612d79050eaa Mon Sep 17 00:00:00 2001
From: xishang0128 <xishang02@gmail.com>
Date: Sun, 24 Aug 2025 19:53:31 +0800
Subject: [PATCH] fix: add code signing for macOS executables during file copy

---
 component/updater/update_core.go | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/component/updater/update_core.go b/component/updater/update_core.go
index 71d264d8..5f7113d0 100644
--- a/component/updater/update_core.go
+++ b/component/updater/update_core.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -159,7 +160,7 @@ func (u *CoreUpdater) Update(currentExePath string, channel string, force bool)
 		return fmt.Errorf("backuping: %w", err)
 	}
 
-	err = u.replace(updateExePath, currentExePath)
+	err = u.copyFile(updateExePath, currentExePath)
 	if err != nil {
 		return fmt.Errorf("replacing: %w", err)
 	}
@@ -284,21 +285,6 @@ func (u *CoreUpdater) backup(currentExePath, backupExePath, backupDir string) (e
 	return nil
 }
 
-// replace moves the current executable with the updated one
-func (u *CoreUpdater) replace(updateExePath, currentExePath string) error {
-	log.Infoln("replacing: %s to %s", updateExePath, currentExePath)
-
-	// Use copyFile to retain the original file attributes
-	err := u.copyFile(updateExePath, currentExePath)
-	if err != nil {
-		return err
-	}
-
-	log.Infoln("updater: copy: %s to %s", updateExePath, currentExePath)
-
-	return nil
-}
-
 // clean removes the temporary directory itself and all it's contents.
 func (u *CoreUpdater) clean(updateDir string) {
 	_ = os.RemoveAll(updateDir)
@@ -474,5 +460,13 @@ func (u *CoreUpdater) copyFile(src, dst string) (err error) {
 		return fmt.Errorf("io.Copy(): %w", err)
 	}
 
+	if runtime.GOOS == "darwin" {
+		err = exec.Command("/usr/bin/codesign", "--sign", "-", dst).Run()
+		if err != nil {
+			log.Warnln("codesign failed: %v", err)
+		}
+	}
+
+	log.Infoln("updater: copy: %s to %s", src, dst)
 	return nil
 }