macOS arm64 v0.6.11 release assets fail strict code-signature verification
Author: kanhoiCreated Sep 9, 2026Updated Sep 9, 2026
On Apple Silicon macOS, both official v0.6.11 macOS artifacts match the SHA-256 digests returned by the GitHub release API, but the contained app fails signature verification.
Artifacts checked:
LLM.Wiki_aarch64.app.tar.gz(9625672a3be10b4c772641885349e1718b9c42d3b0804600da3117fc6a39256b)LLM.Wiki_0.6.11_aarch64.dmg(9f30b33f82092c17ba613e1592aa880c134712a14f0812abd101620da243e5df)
The DMG image checksum passes. The app from both packages returns:
LLM Wiki.app: invalid signature (code or signature have been modified)with:
codesign --verify --deep --strict --verbose=2 "LLM Wiki.app"spctl --assess --type execute --verbose=4 also does not accept the app. The
bundle displays TeamIdentifier R6KDF42PRK and a stapled notarization ticket, but
strict integrity verification still fails.
Would you please reproduce this on a clean runner and add post-build checks for
both the .app and mounted .dmg before release upload? I did not bypass
Gatekeeper or open the app.
Source: nashsu/llm_wiki