From 28ee91b1e5f2c120f07d8a95b70cb6cf32e697d5 Mon Sep 17 00:00:00 2001
From: Rafal Sikora <24563931+s1korrrr@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:18:47 +0200
Subject: [PATCH] Use current codesign certificate extraction syntax

---
 .../tests/notarize_release_contract_test.sh       | 15 +++++++++++----
 Packaging/DeveloperID/verify_release_artifact.sh  |  5 +++--
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/Packaging/DeveloperID/tests/notarize_release_contract_test.sh b/Packaging/DeveloperID/tests/notarize_release_contract_test.sh
index 36b49ce..47d038a 100755
--- a/Packaging/DeveloperID/tests/notarize_release_contract_test.sh
+++ b/Packaging/DeveloperID/tests/notarize_release_contract_test.sh
@@ -114,10 +114,17 @@ printf 'codesign %s\n' "$*" >> "$CALL_LOG"
 if [[ "$*" == *"--verify"* && "${FAIL_GATE:-}" == codesign-verify ]]; then exit 74; fi
 if [[ "$*" == *"--extract-certificates"* ]]; then
   while [[ $# -gt 0 ]]; do
-    if [[ "$1" == --extract-certificates ]]; then
-      printf 'public certificate fixture\n' > "$2"0
-      exit 0
-    fi
+    case "$1" in
+      --extract-certificates=*)
+        certificate_prefix="${1#*=}"
+        printf 'public certificate fixture\n' > "${certificate_prefix}0"
+        exit 0
+        ;;
+      --extract-certificates)
+        echo "Certificate prefix must use --extract-certificates=<prefix>." >&2
+        exit 75
+        ;;
+    esac
     shift
   done
 elif [[ "$*" == *"-dvvv"* ]]; then
diff --git a/Packaging/DeveloperID/verify_release_artifact.sh b/Packaging/DeveloperID/verify_release_artifact.sh
index 2864745..88722f8 100755
--- a/Packaging/DeveloperID/verify_release_artifact.sh
+++ b/Packaging/DeveloperID/verify_release_artifact.sh
@@ -3,6 +3,7 @@ set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 source "$ROOT_DIR/script/disk_image_tools.sh"
+source "$ROOT_DIR/Packaging/DeveloperID/codesign_details.sh"
 DMG_PATH=""
 MANIFEST_PATH=""
 PHASE=""
@@ -120,7 +121,7 @@ signature_fingerprint() {
   local fingerprint
   certificate_dir="$(mktemp -d "${TMPDIR:-/tmp}/codebase-combiner-signature-certificates.XXXXXX")"
   certificate_prefix="$certificate_dir/certificate-"
-  if ! codesign -d --extract-certificates "$certificate_prefix" "$artifact" >/dev/null 2>&1; then
+  if ! codesign -d --extract-certificates="$certificate_prefix" "$artifact" >/dev/null 2>&1; then
     rm -rf "$certificate_dir"
     echo "Unable to extract the public signing certificate from $artifact." >&2
     return 1
@@ -203,7 +204,7 @@ if [[ "$SIGNING_MODE" == developer-id ]]; then
   codesign -dvvv "$MOUNTED_APP" >/dev/null 2> "$app_details"
   grep -F 'Authority=Developer ID Application:' "$app_details" >/dev/null
   grep -F "TeamIdentifier=$TEAM_ID" "$app_details" >/dev/null
-  grep -E '^flags=.*runtime' "$app_details" >/dev/null
+  codesign_details_has_hardened_runtime "$app_details"
   grep -F 'Timestamp=' "$app_details" >/dev/null
   rm -f "$app_details"
 fi