macOS runner: codesign "code object is not signed at all" in CI

By Kaveh Alemi·Latchkey

A codesign --verify (or a downstream notarize/staple step) inspected the bundle and found a binary with no signature at all. Signing was skipped, or a nested helper, framework, or dylib was not signed.

What this error means

codesign or a verification step fails with "code object is not signed at all" naming the bundle or a nested executable inside it.

MyApp.app: code object is not signed at all
In subcomponent: MyApp.app/Contents/Frameworks/Helper.framework

Common causes

A nested component was never signed

Frameworks, embedded helpers, and dylibs must be signed before the outer bundle. If one was skipped, verification reports the whole object as not signed.

The signing step did not run or targeted the wrong path

A build copied the binary after signing, or the codesign command pointed at a different path, leaving the shipped artifact unsigned.

How to fix it

Sign deep, inside-out

1. Sign nested frameworks and helpers first, then the app bundle.
2. Use --deep only with care; prefer signing each component explicitly.
3. Verify with codesign --verify --deep --strict.

codesign --force --sign "$IDENTITY" MyApp.app/Contents/Frameworks/Helper.framework
codesign --force --options runtime --sign "$IDENTITY" MyApp.app
codesign --verify --deep --strict MyApp.app

Sign the final artifact, not an intermediate

Ensure codesign runs on the exact bundle you ship, after all copying and bundling steps complete.

How to prevent it

• Sign nested components before the outer bundle, inside-out.
• Verify with codesign --verify --deep --strict in CI.
• Sign the final shipped artifact, not a pre-copy build product.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions