release: the macOS signing script stops changing directory

Found by the first real release, which it stopped twice in two consecutive
steps.

Phase B refused on tfg-gui.app with "was signed by a DIFFERENT certificate,
expected C656..., got none". The signature was correct: codesign -dv on that
same bundle shows Developer ID Application, a chain to the Apple Root CA and a
timestamp. What failed was reading it back.

certificate_of cd'd into a temporary directory and then asked codesign about
the bundle, because --extract-certificates looked like a file name rather than
a path. The bundle path is relative - sign_release.py hands this script a
directory under the home directory - so after the cd it named nothing, codesign
answered "No such file or directory", and no certificate came out. A refusal
that is right about there being a problem and wrong about what it is costs more
than a silent one: it sends somebody to look at the card.

Measured on the Mac, all three ways: relative after a cd gives nothing,
absolute gives exactly the pinned digest, and relative with the prefix written
as a path and no cd gives the same. So the cd goes.

The same trap sat one step further on and was measured before anybody reached
it: the zip for notarisation cd'd into the unpacked directory and wrote to a
path relative to where the script started, so the file was never created. Bare
ditto with both paths as they arrive works, and --keepParent still puts the
.app at the top of the archive - read back out of the zip rather than assumed.

Why the rehearsal did not show this: it ran the script by hand with an absolute
directory, and the real caller passes a relative one. The command was proven,
the call was not.

The guard asks whether there is any cd at all rather than whether the paths are
absolute, because that is the property that can be read off the file. If a
directory change is ever genuinely needed here, the guard is the conversation
about it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: donislawdev

.github/scripts/sign_macos.sh

@@ -120,10 +120,26 @@ A renewal is a DIFFERENT certificate and internal/legal has to move with it."
 }
 
 # The certificate that ACTUALLY signed a bundle, read back out of it.
+# 🔴 Nothing here changes directory, and that is the whole of what this function
+# learned on 2026-08-28, on the first real release.
+#
+# It used to cd into the temporary directory and pass the bundle path after
+# that, because --extract-certificates looked like a file NAME. The path it was
+# given is relative - sign_release.py passes a directory under the home
+# directory - so after the cd it named nothing. codesign answered "No such file
+# or directory", no certificate came out, and the script stopped the release
+# saying the bundle "was signed by a DIFFERENT certificate, got none" about a
+# bundle that was correctly signed, by the pinned certificate, with a timestamp.
+# A refusal that is right about there being a problem and wrong about what it is
+# costs more than a silent one, because it sends somebody to look at the card.
+#
+# The prefix takes a path. Measured rather than assumed: with the prefix written
+# as "$tmp/cert" and the bundle path left exactly as it arrives, cert0 appears
+# and hashes to the pinned digest.
 certificate_of() {
   local bundle="$1" tmp
   tmp="$(mktemp -d)"
-  ( cd "$tmp" && codesign -d --extract-certificates=cert "$bundle" >/dev/null 2>&1 )
+  codesign -d --extract-certificates="$tmp/cert" "$bundle" >/dev/null 2>&1
   if [ ! -f "$tmp/cert0" ]; then
     rm -rf "$tmp"
     echo "none"
@@ -172,8 +188,15 @@ Nothing has been handed back."
   # Apple takes a zip, a pkg or a dmg, and will not take the tar.gz we publish.
   # So the zip exists only to carry the bundle there. What gets stapled and
   # republished is the bundle itself.
+  # The same trap as certificate_of, one step further on, and it was measured
+  # the same day rather than met later: this cd'd into the unpacked directory
+  # and then wrote to a path that was relative to where the script STARTED, so
+  # the zip was never created and the next line would have stopped the release
+  # with "could not zip". Without the cd, ditto is given both paths as they
+  # arrive and --keepParent still puts tfg-gui.app at the top of the archive,
+  # which is the shape notarisation wants - read back out of the zip.
   local zip="${work}/notarise.zip"
-  ( cd "$work" && ditto -c -k --keepParent "$(basename "$app")" "$zip" ) ||
+  ditto -c -k --keepParent "$app" "$zip" ||
     die "could not zip $(basename "$app") for notarisation"
 
   local out

internal/guard/macossigning_test.go

@@ -204,6 +204,45 @@ func TestTheIconMacOSReadsCarriesEverySizeItIsAskedFor(t *testing.T) {
 	t.Logf("%d entries, every size macOS asks for, %d bytes", len(found), len(body))
 }
 
+// The macOS signing script never changes directory.
+//
+// Found by the first real release, on 2026-08-28, and it stopped that release
+// twice in two consecutive steps. Every path this script works with is derived
+// from the directory it is handed, and sign_release.py hands it one relative to
+// the home directory. Two commands ran inside a subshell that had cd'd
+// somewhere else first, so the paths they were given stopped meaning anything:
+//
+//   - certificate_of cd'd into a temporary directory and then asked codesign
+//     about the bundle. codesign answered "No such file or directory", no
+//     certificate came out, and the script refused the release saying the
+//     bundle was "signed by a DIFFERENT certificate, got none" - about a bundle
+//     that was correctly signed by the pinned certificate, with a timestamp,
+//     chaining to the Apple Root CA. Measured after the fact: the same command
+//     with the path resolved gives exactly the pinned digest;
+//   - the zip for notarisation cd'd into the unpacked bundle and wrote to a
+//     path relative to where the script started, so the file was never created.
+//     That one had not been reached yet and would have stopped the next step.
+//
+// Asked as "no cd at all" rather than "the paths are absolute", because that is
+// the property that can be read off the file. If a directory change is ever
+// genuinely needed here, make every path absolute first and this guard is the
+// conversation about it.
+//
+// 🔴 Why nothing caught this before: the rehearsal of 2026-08-28 ran the script
+// by hand with an absolute directory, and sign_release.py passes a relative one.
+// The command was proven, the call was not.
+func TestTheMacSigningScriptDoesNotDependOnWhereItIsRunFrom(t *testing.T) {
+	script := macSigningScript(t)
+
+	if strings.Contains(script, "cd \"") {
+		t.Error("sign_macos.sh changes directory somewhere. Every path in it comes from the " +
+			"directory it is handed, and sign_release.py hands it a relative one - so a cd " +
+			"silently changes what those paths mean.\n" +
+			"What happened when this was last true: codesign reported no certificate for a " +
+			"correctly signed bundle, and the release stopped saying the wrong thing about why.")
+	}
+}
+
 // The pin is a digest with a date, and the script derives its selector from it.
 //
 // Same shape as the Windows pin and for the same reason: codesign selects by