Fix OpenSSL Signature

Author: NovaDev404

.github/workflows/release.yml

@@ -6,6 +6,8 @@ on:
 jobs:
   build:
     runs-on: macos-26
+    env:
+      TMPDIR: ${{ runner.temp }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3

Makefile

@@ -5,8 +5,11 @@ TMP := $(TMPDIR)/$(NAME)
 STAGE := $(TMP)/stage
 APP := $(TMP)/Build/Products/Release-$(PLATFORM)
 CERT_JSON_URL := https://backloop.dev/pack.json
+WORKSPACE := NexStore.xcworkspace
+SOURCE_PACKAGES := $(TMP)/SourcePackages
+OPENSSL_XCFRAMEWORK := $(SOURCE_PACKAGES)/artifacts/openssl-package/OpenSSL/OpenSSL.xcframework
 
-.PHONY: all deps clean $(SCHEMES)
+.PHONY: all deps clean prepare_packages repair_openssl_artifact $(SCHEMES)
 
 all: $(SCHEMES)
 
@@ -28,15 +31,41 @@ deps:
 	jq -r '.key1, .key2' cert.json > deps/server.pem
 	jq -r '.info.domains.commonName' cert.json > deps/commonName.txt
 
-$(SCHEMES): deps
+prepare_packages: deps
+	mkdir -p "$(SOURCE_PACKAGES)"
+
+	# Xcode 26 rejects the shipped OpenSSL artifact signature, so resolve first,
+	# repair the xcframework in-place, then build without re-resolving packages.
+	xcodebuild \
+	    -resolvePackageDependencies \
+	    -workspace $(WORKSPACE) \
+	    -scheme "$(firstword $(SCHEMES))" \
+	    -clonedSourcePackagesDirPath "$(SOURCE_PACKAGES)" \
+	    -skipPackagePluginValidation || test -d "$(OPENSSL_XCFRAMEWORK)"
+
+	$(MAKE) repair_openssl_artifact
+
+repair_openssl_artifact:
+	@if [ -d "$(OPENSSL_XCFRAMEWORK)" ]; then \
+		echo "Re-signing $(OPENSSL_XCFRAMEWORK)"; \
+		xattr -cr "$(OPENSSL_XCFRAMEWORK)" || true; \
+		codesign --remove-signature "$(OPENSSL_XCFRAMEWORK)" 2>/dev/null || true; \
+		codesign --force --deep --sign - --timestamp=none "$(OPENSSL_XCFRAMEWORK)"; \
+		codesign --verify --deep --strict "$(OPENSSL_XCFRAMEWORK)"; \
+	else \
+		echo "OpenSSL.xcframework artifact not found, skipping signature repair."; \
+	fi
+
+$(SCHEMES): prepare_packages
 	xcodebuild \
-	    -workspace NexStore.xcworkspace \
+	    -workspace $(WORKSPACE) \
 	    -scheme "$@" \
 	    -configuration Release \
 	    -arch arm64 \
 	    -sdk $(PLATFORM) \
 	    -derivedDataPath $(TMP) \
-	    -clonedSourcePackagesDirPath "$(TMP)/SourcePackages" \
+	    -clonedSourcePackagesDirPath "$(SOURCE_PACKAGES)" \
+	    -disableAutomaticPackageResolution \
 	    -skipPackagePluginValidation \
 	    CODE_SIGNING_ALLOWED=NO \
 	    ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES=NO