contrib: remove deprecated --deep signing from macdeployqtplus #33592

1. 
   amishhaa commented at 9:11 PM on October 9, 2025: contributor

   Removed the deprecated --deep flag from codesign in macdeployqtplus and replaced it with an explicit recursive signing process for all binaries, frameworks, and plugins.

   Fixes #32486

2. Contrib: Updated macdeployqtplus to remove deprecated --deep signing

   Removed the deprecated --deep flag from codesign in macdeployqtplus and replaced it with an explicit recrusive signing process for all binaries, frameworks, and plugins.

   3ef0103393
3. DrahtBot added the label Scripts and tools on Oct 9, 2025
4. 
   DrahtBot commented at 9:11 PM on October 9, 2025: contributor

   <!--e57a25ab6845829454e8d69fc972939a-->

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   <!--006a51241073e994b41acfe9ec718e94-->

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/33592.

   <!--021abf342d371248e50ceaed478a90ca-->

   Reviews

   See the guideline for information on the review process.

   Type	Reviewers
   Concept ACK	hebasto

   If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

   <!--174a7506f384e20aa4161008e828411d-->

   Conflicts

   No conflicts as of last run.

   <!--5faf32d7da4f0f540f40219e4f7537a3-->

5. 
   hebasto commented at 7:26 AM on October 10, 2025: member

   Concept ACK.

6. fanquake renamed this:
   Contrib: Updated macdeployqtplus to remove deprecated --deep signing
   contrib: remove deprecated --deep signing from macdeployqtplus
   on Oct 10, 2025
7. 
   sedited commented at 9:26 AM on March 5, 2026: contributor

   Could somebody with a Mac try this out? It's been open for a while, but I'm having a hard time judging its correctness.

8. in contrib/macdeploy/macdeployqtplus:534 in 3ef0103393

    529 | +    macos_path = os.path.join(contents_path, "MacOS")
    530 | +    if os.path.exists(macos_path):
    531 | +        for f in os.listdir(macos_path):
    532 | +            full_path = os.path.join(macos_path, f)
    533 | +            if os.path.isfile(full_path) and is_macho_executable(full_path):
    534 | +                sign_item(full_path, identity)
   

   ---

   ---

   

   hebasto commented at 5:25 PM on March 5, 2026:

   My tests also pass without this snippet for some reason.

9. 
   hebasto commented at 5:26 PM on March 5, 2026: member

   Tested 3ef010339313f8627f91be1f9c632ebd1b49150d on macOS Tahoe 26.2 as follows:

   % cmake -B build -DBUILD_GUI=ON
   % cmake --build build -t bitcoin-qt deploy
   % codesign --verify --deep --strict --verbose=4 build/dist/Bitcoin-Qt.app
   

10. sedited requested review from Sjors on Mar 19, 2026
11. 
    Sjors commented at 4:37 PM on March 24, 2026: member

    I updated #32486 with the apple manual entry, which says about the deprecated --deep: "This is almost never what you want"

    So just reproducing what it did seems the wrong approach. I made a more targeted version in #34914 (with @amishhaa as the co-author).

12. 
    fanquake commented at 12:27 AM on March 25, 2026: member

    Going to close this for now, in favour of #34914.

13. fanquake closed this on Mar 25, 2026

    ---

Contributors

amishhaaDrahtBothebastoseditedSjorsfanquake

Review Requested
Sjors