Tauri-build macos-universal has been failing notarytool because the
.dylib files inside the JPDFium native jars (jpdfium-natives-darwin-
x64-*.jar / -arm64-*.jar) ship unsigned — JPDFium's publish workflow
has no Apple Developer credentials, so it can't sign during publish.
Apple's notarytool walks INTO nested .jars in the .app and reports:
"The binary is not signed."
path: Stirling-PDF.zip/Stirling-PDF.app/Contents/Resources/libs/
stirling-pdf-*.jar/BOOT-INF/lib/
jpdfium-natives-darwin-x64-1.0.0-SNAPSHOT.jar/natives/darwin-x64/
libjpdfium.dylib
Tauri's own codesign walk doesn't open .jars, so the fix has to
happen here before tauri-action runs. New step between
`task desktop:prepare` (builds bootJar) and `tauri-action` (builds
.app + notarizes):
scripts/sign-jpdfium-dylibs-in-bootjar.sh
1. jar xf bootJar BOOT-INF/lib/jpdfium-natives-darwin-*.jar
2. for each native jar, explode it, codesign every .dylib with
APPLE_SIGNING_IDENTITY + --options runtime + --timestamp
3. jar cfM0 to repack the natives jar (stored, no deflate —
matches Spring Boot's preferred layout)
4. jar uf bootJar to replace the natives jars in the outer
bootJar with the freshly-signed versions
Gated on macOS-15 + APPLE_SIGNING_IDENTITY being set, so PR builds
from forks (no secret) fall through and the existing
"binary not signed" failure persists — no regression vs current.
Anthony Stirling
1e8c41425b