[TartanLeGrand]

What does this PR do?

Makes Zupersign sign real (non ad hoc) identities with a single SHA-256 CodeDirectory, as codesign does for deployment targets of iOS 11 / macOS 10.13 and later. Ad hoc signatures are unchanged.

zsign_sign called ZSignAsset::Init(..., is_adhoc, false /* bSHA256Only */, false), so every signature had a SHA-1 primary CodeDirectory plus a SHA-256 alternate one. App Store Connect rejects that pair:

90034: Missing or invalid signature. The bundle '<bundle id>' at bundle path 'Payload/<App>.app' is not signed using an Apple submission certificate.

even though the certificate, the profiles, the entitlements and the signature itself were valid (page hashes, special slots, CMS verified with OpenSSL, 100.9.1 / 100.9.2 cdhash attributes consistent, requirements byte-identical to codesign's). The only remaining structural difference with an Xcode export was the CodeDirectory set. The SHA-256 only mode already exists in ZSignAsset; this passes !is_adhoc for it.

How was it tested?

Real uploads of a production Tauri app (app plus a WidgetKit extension), signed for distribution through xtool (xtool-org/xtool#326) with an Apple Distribution certificate:

• Before: upload rejected with 90034 about 5 minutes after the commit.
• After: one CodeDirectory (slot 0, SHA-256), CMS valid, entitlements unchanged. App Store Connect accepted the uploads; several builds reached VALID in about 2 minutes and installed through TestFlight on an iPhone with iOS 27.
• swift build of the Zupersign target; xtool's signing tests updated to expect a single SHA-256 CodeDirectory.

Not tested: development signatures installed on a device with this change (development and ad hoc installs used SHA-1 + SHA-256 before; codesign itself emits SHA-256 only for these deployment targets, so no difference is expected), and deployment targets older than iOS 11, which would need the SHA-1 CodeDirectory.

Two smaller differences from codesign remain and did not block processing: the SignerInfo signatureAlgorithm is rsaEncryption (codesign: sha256WithRSAEncryption), and the CMS is DER encoded without the NULL algorithm parameters.

Merge note: #3 edits the same call; whichever lands second needs a one-line rebase.

Developed with AI assistance; validated on device and against App Store Connect as described above.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e16841b4-ed4e-4653-bd7d-da59055e14b0

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}