Oh, duh. It looks like `Contents/CodeResources` is created by notarization, which makes sense since it only exists on the release-signed and notarized build. https://eclecticlight.co/2019/05/31/can-you-tell-whether-code-has-been-notarized/ `Contents/_CodeSignature/CodeResources` is created by signing. It exists on both the release-signed and dep-signed builds. So update-verify is dying because we're comparing a notarized release-signed app vs a non-notarized dep-signed app. I think we need to train update-verify on Try to ignore `Contents/CodeResources` for mac.
Bug 1677171 Comment 9 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Oh, duh. It looks like `Contents/CodeResources` is created by notarization, which makes sense since it only exists on the release-signed and notarized build. https://eclecticlight.co/2019/05/31/can-you-tell-whether-code-has-been-notarized/ : > You can also look inside the app: the notarization ‘ticket’ is seen as a file named CodeResources in the Contents folder. But that only applies to apps which have gone through the hardening and notarization process from new. `Contents/_CodeSignature/CodeResources` is created by signing. It exists on both the release-signed and dep-signed builds. So update-verify is dying because we're comparing a notarized release-signed app vs a non-notarized dep-signed app. I think we need to train update-verify on Try to ignore `Contents/CodeResources` for mac.