#739·llm_wiki

macOS arm64 v0.6.11 release assets fail strict code-signature verification

Author: kanhoiCreated Sep 9, 2026Updated Sep 9, 2026

On Apple Silicon macOS, both official v0.6.11 macOS artifacts match the SHA-256 digests returned by the GitHub release API, but the contained app fails signature verification.

Artifacts checked:

  • LLM.Wiki_aarch64.app.tar.gz (9625672a3be10b4c772641885349e1718b9c42d3b0804600da3117fc6a39256b)
  • LLM.Wiki_0.6.11_aarch64.dmg (9f30b33f82092c17ba613e1592aa880c134712a14f0812abd101620da243e5df)

The DMG image checksum passes. The app from both packages returns:

LLM Wiki.app: invalid signature (code or signature have been modified)

with:

bash
codesign --verify --deep --strict --verbose=2 "LLM Wiki.app"

spctl --assess --type execute --verbose=4 also does not accept the app. The bundle displays TeamIdentifier R6KDF42PRK and a stapled notarization ticket, but strict integrity verification still fails.

Would you please reproduce this on a clean runner and add post-build checks for both the .app and mounted .dmg before release upload? I did not bypass Gatekeeper or open the app.