Also feels like the code signing should be done when creating bottles rather than pouring existing ones.

Wouldn't relocation invalidate the signature? So it needs to be done after pouring.

Wouldn't relocation invalidate the signature? So it needs to be done after pouring.

Good point. Regardless it shouldn't be fatal on Intel (until we figure this out or have a DSL to opt-out on specific formulae) and I still wonder whether something like code signing before bottling and then resigning after pouring only if there was an existing code signature would make sense (to avoid trying to sign things that failed to be signed during our CI process).

@woodruffw @mistydemeo thinking about this more I think it might be easier to have a separate ruby-macho API call required for code-signing (raising exceptions on failures) that we can call in Homebrew/brew and control whether it's called or fatal for ARM/Intel on this side. That would make it easier to tweak behaviour in cases like this without needing to do a full revert (and perhaps even enable/disable code signing on Intel for e.g. gdb on other macOS versions with a DSL).