@@ -1297,7 +1297,7 @@ pub fn ensure_signed() {
1297 let entitlements_path = std::env::temp_dir().join("entitlements.plist");
1297 let entitlements_path = std::env::temp_dir().join("entitlements.plist");
1298 std::fs::write(&entitlements_path, ENTITLEMENTS).expect("failed to write entitlements");
1298 std::fs::write(&entitlements_path, ENTITLEMENTS).expect("failed to write entitlements");
1300− let status = Command::new("codesign")
1300+ let output = Command::new("codesign")
1302 "--sign",
1302 "--sign",
@@ -1306,18 +1306,23 @@ pub fn ensure_signed() {
1306 entitlements_path.to_str().unwrap(),
1306 entitlements_path.to_str().unwrap(),
1307 exe_str,
1307 exe_str,
1309− .status();
1309+ .output();
1311 let _ = std::fs::remove_file(&entitlements_path);
1311 let _ = std::fs::remove_file(&entitlements_path);
1313− match status {
1313+ match output {
1314− Ok(s) if s.success() => {
1314+ Ok(o) if o.status.success() => {
1315+ let stderr = String::from_utf8_lossy(&o.stderr);
1316+ if !stderr.trim().is_empty() {
1317+ tracing::debug!(codesign_stderr = %stderr.trim(), "codesign output");
1315 let err = Command::new(&exe).args(std::env::args_os().skip(1)).exec();
1319 let err = Command::new(&exe).args(std::env::args_os().skip(1)).exec();
1316 tracing::error!(error = %err, "failed to re-exec after signing");
1320 tracing::error!(error = %err, "failed to re-exec after signing");
1317 std::process::exit(1);
1321 std::process::exit(1);
1319− Ok(s) => {
1323+ Ok(o) => {
1324+ let stderr = String::from_utf8_lossy(&o.stderr);
1320− tracing::error!(status = %s, "codesign failed");
1325+ tracing::error!(status = %o.status, codesign_stderr = %stderr.trim(), "codesign failed");
1321 std::process::exit(1);
1326 std::process::exit(1);
1323 Err(e) => {
1328 Err(e) => {