From 4adb9cf4bbf21486113eb13680b8be6a08fc5d0e Mon Sep 17 00:00:00 2001 From: Jeffrey Morgan Date: Wed, 14 Jan 2026 07:48:10 -0800 Subject: [PATCH] scripts: fix macOS auto-update signature verification failure (#13713) Add --norsrc flag to ditto commands when creating Ollama-darwin.zip to exclude AppleDouble resource fork files (._* files) from the archive. The mlx.metallib file has extended attributes, which causes ditto to include a ._mlx.metallib AppleDouble file in the zip. Since this file is not part of the code signature seal, macOS rejects the bundle during auto-update verification with: "a sealed resource is missing or invalid" "file added: .../._mlx.metallib" The --norsrc flag prevents ditto from preserving resource forks and extended attributes, ensuring only signed files are included in the release archive. --- scripts/build_darwin.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/build_darwin.sh b/scripts/build_darwin.sh index 7293be012..ed5f97aa5 100755 --- a/scripts/build_darwin.sh +++ b/scripts/build_darwin.sh @@ -179,7 +179,7 @@ _build_macapp() { fi rm -f dist/Ollama-darwin.zip - ditto -c -k --keepParent dist/Ollama.app dist/Ollama-darwin.zip + ditto -c -k --norsrc --keepParent dist/Ollama.app dist/Ollama-darwin.zip (cd dist/Ollama.app/Contents/Resources/; tar -cf - ollama ollama-mlx *.so *.dylib *.metallib 2>/dev/null) | gzip -9vc > dist/ollama-darwin.tgz # Notarize and Staple @@ -187,7 +187,7 @@ _build_macapp() { $(xcrun -f notarytool) submit dist/Ollama-darwin.zip --wait --timeout 20m --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" rm -f dist/Ollama-darwin.zip $(xcrun -f stapler) staple dist/Ollama.app - ditto -c -k --keepParent dist/Ollama.app dist/Ollama-darwin.zip + ditto -c -k --norsrc --keepParent dist/Ollama.app dist/Ollama-darwin.zip rm -f dist/Ollama.dmg