From ad4eeaf859c447894e83c855bcff63bb70f58be4 Mon Sep 17 00:00:00 2001
From: Sjors Provoost <sjors@sprovoost.nl>
Date: Wed, 25 Mar 2026 11:03:47 +0100
Subject: [PATCH 1/2] ci: avoid modifying GOAL in 03_test_script.sh

The modification caused "codesign --verify" to be silently skipped.

Introduce BUILD_TARGETS for the cmake target list so GOAL remains
unmodified throughout the script.
---
 ci/test/03_test_script.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index 293a804f967..d00005c0450 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -123,15 +123,16 @@ cmake -S "$BASE_ROOT_DIR" -B "$BASE_BUILD_DIR" "${CMAKE_ARGS[@]}" || (
   false
 )
 
+BUILD_TARGETS="${GOAL}"
 if [[ "${GOAL}" != all && "${GOAL}" != *codegen* ]]; then
-  GOAL="all ${GOAL}"
+  BUILD_TARGETS="all ${GOAL}"
 fi
 
 # shellcheck disable=SC2086
-cmake --build "${BASE_BUILD_DIR}" "$MAKEJOBS" --target $GOAL || (
+cmake --build "${BASE_BUILD_DIR}" "$MAKEJOBS" --target $BUILD_TARGETS || (
   echo "Build failure. Verbose build follows."
   # shellcheck disable=SC2086
-  cmake --build "${BASE_BUILD_DIR}" -j1 --target $GOAL --verbose
+  cmake --build "${BASE_BUILD_DIR}" -j1 --target $BUILD_TARGETS --verbose
   false
 )
 

From da7d7dbc7c0040d5e91fe21e19fdc1cb3b8ea7b2 Mon Sep 17 00:00:00 2001
From: Sjors Provoost <sjors@sprovoost.nl>
Date: Wed, 25 Mar 2026 09:28:02 +0100
Subject: [PATCH 2/2] contrib: remove deprecated --deep codesign flag

Replace the deprecated `codesign --deep` with explicit per-component
signing of Frameworks, Plugins and the top-level bundle.

CI is updated to verify with --deep --strict.

Can be verified with:
codesign --verify --deep --strict --verbose=4 build/dist/Bitcoin-Qt.app

Co-authored-by: amisha <amishhhaaaa@gmail.com>
---
 ci/test/03_test_script.sh         |  2 +-
 contrib/macdeploy/macdeployqtplus | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index d00005c0450..c8292d989f4 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -183,7 +183,7 @@ fi
 
 if [[ "$CI_OS_NAME" == "macos" && "${GOAL}" = "install deploy" ]]; then
   unzip "${BASE_BUILD_DIR}/bitcoin-macos-app.zip" -d "${BASE_BUILD_DIR}/deploy"
-  if ! ( codesign --verify "${BASE_BUILD_DIR}/deploy/Bitcoin-Qt.app" ); then
+  if ! ( codesign --verify --deep --strict "${BASE_BUILD_DIR}/deploy/Bitcoin-Qt.app" ); then
     echo "Codesigning failed."
     false
   fi
diff --git a/contrib/macdeploy/macdeployqtplus b/contrib/macdeploy/macdeployqtplus
index c8244af1532..19c778c9cfd 100755
--- a/contrib/macdeploy/macdeployqtplus
+++ b/contrib/macdeploy/macdeployqtplus
@@ -488,7 +488,19 @@ with open(os.path.join(applicationBundle.resourcesPath, "qt.conf"), "wb") as f:
 # ------------------------------------------------
 
 if platform.system() == "Darwin":
-    subprocess.check_call(f"codesign --deep --force --sign - {target}", shell=True)
+    # The earlier strip and install_name_tool calls invalidated existing framework
+    # and plugin code signatures.
+    print("+ Signing app bundle +")
+    sign_targets = [
+        path
+        for pattern in ("Frameworks/*", "PlugIns/*/*")
+        for path in Path(target, "Contents").glob(pattern)
+        if path.is_file() or path.name.endswith(".framework")
+    ]
+    # Sign the app bundle last
+    sign_targets.append(Path(target))
+    for sign_target in sign_targets:
+        subprocess.check_call(["codesign", "--force", "--sign", "-", sign_target.as_posix()])
 
 # ------------------------------------------------