Fix Sparkle codesigning for XPC services (#5393)

- Use ditto instead of cp -R to copy Sparkle.framework (preserves bundle structure)
- Skip individual signing of Sparkle's internal XPC services, apps, and executables
- Use --deep flag when signing Sparkle.framework to handle its internal components
- Verify cached Sparkle.framework has proper symlink structure, re-download if corrupted

Fixes "bundle format unrecognized" error during codesigning.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

scripts/codesign_mac_app.sh

@@ -39,32 +39,51 @@ find "$APP_PATH" -name "*.bundle" -print0 | while IFS= read -r -d '' item; do
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign XPC services (inside Sparkle framework)
+# Sign XPC services (but skip ones inside Sparkle.framework - they're already signed)
 find "$APP_PATH" -name "*.xpc" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle XPC service (pre-signed): $item"
+        continue
+    fi
     echo "Signing XPC service: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign nested apps (like Sparkle's Updater.app)
+# Sign nested apps (but skip ones inside Sparkle.framework - they're already signed)
 find "$APP_PATH" -path "*/Frameworks/*.app" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle nested app (pre-signed): $item"
+        continue
+    fi
     echo "Signing nested app: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign standalone executables inside frameworks (like Autoupdate)
+# Sign standalone executables inside frameworks (but skip Sparkle.framework internals)
 find "$APP_PATH" -path "*/Frameworks/*/Versions/*/Autoupdate" -type f -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle executable (pre-signed): $item"
+        continue
+    fi
     echo "Signing executable: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
 # Sign all frameworks (after their contents are signed)
+# Use --deep for Sparkle.framework to handle its XPC services
 find "$APP_PATH" -name "*.framework" -print0 | while IFS= read -r -d '' item; do
-    echo "Signing framework: $item"
-    codesign --force --verify --verbose --timestamp --options runtime \
-        --sign "$SIGNING_IDENTITY" "$item"
+    if [[ "$item" == *"Sparkle.framework" ]]; then
+        echo "Signing Sparkle framework with --deep: $item"
+        codesign --deep --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    else
+        echo "Signing framework: $item"
+        codesign --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    fi
 done
 
 echo "=== Signing main app bundle ==="

scripts/inject_sparkle.sh

@@ -27,33 +27,59 @@ if [ -z "${SPARKLE_EDDSA_PUBLIC_KEY:-}" ]; then
     exit 1
 fi
 
-# Download Sparkle if not cached
+# Always use a fresh Sparkle download to avoid cache corruption issues
 SPARKLE_DIR="$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION"
-if [ ! -d "$SPARKLE_DIR/Sparkle.framework" ]; then
-    echo "=== Downloading Sparkle $SPARKLE_VERSION ==="
-    mkdir -p "$SPARKLE_CACHE_DIR"
-    SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
-    curl -L "$SPARKLE_URL" | tar -xJ -C "$SPARKLE_CACHE_DIR"
-    mv "$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION" "$SPARKLE_DIR" 2>/dev/null || true
-    # If the extracted directory doesn't match version pattern, it may just be "Sparkle"
-    if [ ! -d "$SPARKLE_DIR" ]; then
-        mkdir -p "$SPARKLE_DIR"
-        mv "$SPARKLE_CACHE_DIR/Sparkle.framework" "$SPARKLE_DIR/" 2>/dev/null || true
-        mv "$SPARKLE_CACHE_DIR/bin" "$SPARKLE_DIR/" 2>/dev/null || true
-    fi
+echo "=== Clearing Sparkle cache and downloading fresh copy ==="
+rm -rf "$SPARKLE_DIR"
+mkdir -p "$SPARKLE_DIR"
+
+SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
+echo "Downloading from: $SPARKLE_URL"
+curl -L "$SPARKLE_URL" -o /tmp/sparkle.tar.xz
+tar -xJf /tmp/sparkle.tar.xz -C "$SPARKLE_DIR"
+rm /tmp/sparkle.tar.xz
+
+# Show what was extracted
+echo "=== Extracted contents ==="
+ls -la "$SPARKLE_DIR/"
+
+# The tarball extracts files directly, not into a subdirectory
+# Verify the framework has proper symlink structure
+echo "=== Verifying Sparkle.framework structure ==="
+ls -la "$SPARKLE_DIR/Sparkle.framework/"
+
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Sparkle.framework/Sparkle is not a symlink"
+    file "$SPARKLE_DIR/Sparkle.framework/Sparkle"
+    exit 1
 fi
 
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Versions/Current" ]; then
+    echo "ERROR: Sparkle.framework/Versions/Current is not a symlink"
+    ls -la "$SPARKLE_DIR/Sparkle.framework/Versions/"
+    exit 1
+fi
+
+echo "Sparkle framework structure verified OK"
+
 echo "=== Injecting Sparkle framework ==="
 FRAMEWORKS_DIR="$APP_PATH/Contents/Frameworks"
 mkdir -p "$FRAMEWORKS_DIR"
 
-# Copy Sparkle framework
-cp -R "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/"
+# Remove any existing Sparkle.framework in the app
+rm -rf "$FRAMEWORKS_DIR/Sparkle.framework"
 
-# Also copy the XPC services if present
-if [ -d "$SPARKLE_DIR/Sparkle.framework/Versions/B/XPCServices" ]; then
-    echo "Sparkle XPC services present"
+# Copy Sparkle framework (use ditto to preserve symlinks and bundle structure)
+ditto "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/Sparkle.framework"
+
+# Verify the copied framework still has proper structure
+echo "=== Verifying copied Sparkle.framework structure ==="
+ls -la "$FRAMEWORKS_DIR/Sparkle.framework/"
+if [ ! -L "$FRAMEWORKS_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Copied framework lost symlink structure"
+    exit 1
 fi
+echo "Copied framework structure OK"
 
 echo "=== Updating Info.plist ==="
 PLIST_PATH="$APP_PATH/Contents/Info.plist"