@@ -1297,7 +1297,7 @@ pub fn ensure_signed() {
12971297 let entitlements_path = std::env::temp_dir().join("entitlements.plist");
12981298 std::fs::write(&entitlements_path, ENTITLEMENTS).expect("failed to write entitlements");
12991299
1300− let status = Command::new("codesign")
1300+ let output = Command::new("codesign")
13011301 .args([
13021302 "--sign",
13031303 "-",
@@ -1306,18 +1306,23 @@ pub fn ensure_signed() {
13061306 entitlements_path.to_str().unwrap(),
13071307 exe_str,
13081308 ])
1309− .status();
1309+ .output();
13101310
13111311 let _ = std::fs::remove_file(&entitlements_path);
13121312
1313− match status {
1314− Ok(s) if s.success() => {
1313+ match output {
1314+ Ok(o) if o.status.success() => {
1315+ let stderr = String::from_utf8_lossy(&o.stderr);
1316+ if !stderr.trim().is_empty() {
1317+ tracing::debug!(codesign_stderr = %stderr.trim(), "codesign output");
1318+ }
13151319 let err = Command::new(&exe).args(std::env::args_os().skip(1)).exec();
13161320 tracing::error!(error = %err, "failed to re-exec after signing");
13171321 std::process::exit(1);
13181322 }
1319− Ok(s) => {
1320− tracing::error!(status = %s, "codesign failed");
1323+ Ok(o) => {
1324+ let stderr = String::from_utf8_lossy(&o.stderr);
1325+ tracing::error!(status = %o.status, codesign_stderr = %stderr.trim(), "codesign failed");
13211326 std::process::exit(1);
13221327 }
13231328 Err(e) => {