From 49e569774641b994747080e0169a924a9833d0ba Mon Sep 17 00:00:00 2001
From: Dave Lane <42013603+ReenigneArcher@users.noreply.github.com>
Date: Fri, 7 Aug 2026 18:52:46 -0400
Subject: [PATCH] build(macOS): sign only valid framework bundles (#5484)

---
 cmake/packaging/macos.cmake | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/cmake/packaging/macos.cmake b/cmake/packaging/macos.cmake
index ec773abe..4b26f528 100644
--- a/cmake/packaging/macos.cmake
+++ b/cmake/packaging/macos.cmake
@@ -96,13 +96,17 @@ qt6_deploy_runtime_dependencies(
           # Sign bundled frameworks and plugins before signing the app itself.
           set(_fw_dir \"\${_app}/Contents/Frameworks\")
           if(EXISTS \"\${_fw_dir}\")
-              file(GLOB_RECURSE _sign_items
-                  # Include framework directories; GLOB_RECURSE omits them.
+              # Framework bundles are top-level directories.
+              file(GLOB _framework_items
                   LIST_DIRECTORIES true
                   \"\${_fw_dir}/*.framework\"
+              )
+              # Recursively collect only library files.
+              file(GLOB_RECURSE _sign_items
                   \"\${_fw_dir}/*.dylib\"
                   \"\${_app}/Contents/PlugIns/*.dylib\"
               )
+              list(APPEND _sign_items \${_framework_items})
 
               foreach(item IN LISTS _sign_items)
                   execute_process(COMMAND /usr/bin/codesign --verbose=2