From a85287d8ce21c8112f7060811c2e5a05824bd219 Mon Sep 17 00:00:00 2001
From: robcholz <84130577+robcholz@users.noreply.github.com>
Date: Sat, 7 Feb 2026 20:53:26 -0500
Subject: [PATCH] refactor: redirect codesign to debug

---
 src/vm.rs | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/vm.rs b/src/vm.rs
index b4e4b3e..17dc880 100644
--- a/src/vm.rs
+++ b/src/vm.rs
@@ -1297,7 +1297,7 @@ pub fn ensure_signed() {
     let entitlements_path = std::env::temp_dir().join("entitlements.plist");
     std::fs::write(&entitlements_path, ENTITLEMENTS).expect("failed to write entitlements");
 
-    let status = Command::new("codesign")
+    let output = Command::new("codesign")
         .args([
             "--sign",
             "-",
@@ -1306,18 +1306,23 @@ pub fn ensure_signed() {
             entitlements_path.to_str().unwrap(),
             exe_str,
         ])
-        .status();
+        .output();
 
     let _ = std::fs::remove_file(&entitlements_path);
 
-    match status {
-        Ok(s) if s.success() => {
+    match output {
+        Ok(o) if o.status.success() => {
+            let stderr = String::from_utf8_lossy(&o.stderr);
+            if !stderr.trim().is_empty() {
+                tracing::debug!(codesign_stderr = %stderr.trim(), "codesign output");
+            }
             let err = Command::new(&exe).args(std::env::args_os().skip(1)).exec();
             tracing::error!(error = %err, "failed to re-exec after signing");
             std::process::exit(1);
         }
-        Ok(s) => {
-            tracing::error!(status = %s, "codesign failed");
+        Ok(o) => {
+            let stderr = String::from_utf8_lossy(&o.stderr);
+            tracing::error!(status = %o.status, codesign_stderr = %stderr.trim(), "codesign failed");
             std::process::exit(1);
         }
         Err(e) => {