GH-51694: [C++][CI][Packaging][FlightPRC][ODBC] Upload macOS DYLIB and PKG to GitHub release by alinaliBQ · Pull Request #55321 · apache/arrow

alinaliBQ · 2026-10-29T23:01:17Z

Rationale for this change

GH-51694

Also see #49411 (comment) for context

What changes are included in this PR?

Upload unsigned macOS DYLIB and PKG to draft releases.

An ARM64 base package is uploaded alongside DYLIB to skip rebuild of PKG.

Adds a check to skip upload process for universal PKG/MSI artifacts if they already exist.

To release macOS and Windows ODBC after this PR:

Assumption: developer running dev/release/07-flightsqlodbc-upload.sh would be able to sign both Windows and macOS artifacts on the same machine.

Generate unsigned DYLIB, macOS base PKG, and DLL with CI
- a macOS base PKG is uploaded to skip rebuild in step 4
Sign DYLIB and DLL and upload to GitHub release
Generate unsigned universal PKG (using base PKG) and MSI with CI
Sign universal PKG and MSI and upload to GitHub release

Are these changes tested?

Tested in fork

Are there any user-facing changes?

N/A

Was AI used for this PR?

In accordance to the AI generation guidelines, please disclose below whether and how AI was used in this PR.

PR code and description written by:

Human
AI

Reviewed before submission by:

Human
AI
Not reviewed

GitHub Issue: [FlightRPC][C++][FlightPRC][ODBC] macOS PKG installer upload CI #51694

github-actions · 2026-10-29T23:01:49Z

⚠️ GitHub issue #49411 has been automatically assigned in GitHub to PR creator.

alinaliBQ · 2026-10-30T20:09:51Z

@raulcd @amoeba cc @kou @lidavidm PR is ready for review.

alinaliBQ · 2026-10-30T20:15:42Z

Here are the suggested changes for 07-flightsqlodbc-upload.sh that I generated with help from Claude. I added TODO comments.

Assumption: PMC member running 07-flightsqlodbc-upload.sh would be able to sign both Windows and macOS artifacts on the same machine. rcodesign might be a good candidate as codesign only works on mac it seems..

diff --git a/dev/release/07-flightsqlodbc-upload.sh b/dev/release/07-flightsqlodbc-upload.sh
index c823bc84ae..bb924cc785 100755
--- a/dev/release/07-flightsqlodbc-upload.sh
+++ b/dev/release/07-flightsqlodbc-upload.sh
@@ -53,6 +53,7 @@ fi
 
 . "${SOURCE_DIR}/utils-env.sh"
 
+# TODO: Add checks for required macos signer storepass
 if [ -z "${ESIGNER_STOREPASS:-}" ]; then
   echo "ERROR: ESIGNER_STOREPASS is not set" >&2
   exit 1
@@ -73,12 +74,17 @@ dll_signed="arrow_flight_sql_odbc.dll"
 
 : "${GITHUB_REPOSITORY:=apache/arrow}"
 
+# In PHASE_BUILD_MSI step, both unsigned MSI and PKG will be built
 : "${PHASE_DEFAULT:=1}"
 : "${PHASE_SIGN_DLL:=${PHASE_DEFAULT}}"
+: "${PHASE_SIGN_DYLIB:=${PHASE_DEFAULT}}"
 : "${PHASE_BUILD_MSI:=${PHASE_DEFAULT}}"
 : "${PHASE_SIGN_MSI:=${PHASE_DEFAULT}}"
+: "${PHASE_SIGN_PKG:=${PHASE_DEFAULT}}"
 
-if [ "${PHASE_SIGN_DLL}" -eq 0 ] && [ "${PHASE_BUILD_MSI}" -eq 0 ] && [ "${PHASE_SIGN_MSI}" -eq 0 ]; then
+if [ "${PHASE_SIGN_DLL}" -eq 0 ] && [ "${PHASE_SIGN_DYLIB}" -eq 0 ] &&
+  [ "${PHASE_BUILD_MSI}" -eq 0 ] && [ "${PHASE_SIGN_MSI}" -eq 0 ] &&
+  [ "${PHASE_SIGN_PKG}" -eq 0 ]; then
   echo "No phases specified. Exiting."
   exit 1
 fi
@@ -102,7 +108,7 @@ if [ -e "${tmp_dir}" ]; then
 fi
 
 if [ "${PHASE_SIGN_DLL}" -gt 0 ]; then
-  echo "[1/8] Downloading ${dll_unsigned} from release..."
+  echo "[1/15] Downloading ${dll_unsigned} from release..."
   gh release download "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --pattern "${dll_unsigned}" \
@@ -112,7 +118,7 @@ if [ "${PHASE_SIGN_DLL}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[2/8] Signing ${dll_unsigned}..."
+  echo "[2/15] Signing ${dll_unsigned}..."
   echo "NOTE: Running jsign. You may be prompted for your OTP PIN..."
   jsign --storetype ESIGNER \
     --alias d97c5110-c66a-4c0c-ac0c-1cd6af812ee6 \
@@ -128,27 +134,66 @@ if [ "${PHASE_SIGN_DLL}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[3/8] Uploading signed DLL to GitHub Release..."
+  echo "[3/15] Uploading signed DLL to GitHub Release..."
   gh release upload "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --clobber \
     "${tmp_dir}/${dll_signed}"
 fi
 
+# The signed DYLIB must be on the release before PHASE_BUILD_MSI: the workflow
+# downloads it (libarrow_flight_sql_odbc.*.dylib) to build the universal PKG.
+if [ "${PHASE_SIGN_DYLIB}" -gt 0 ]; then
+  echo "[4/15] Downloading unsigned universal DYLIB from release..."
+  gh release download "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --pattern "libarrow_flight_sql_odbc_unsigned.*.dylib" \
+    --dir "${tmp_dir}"
+  dylib_unsigned="$(ls "${tmp_dir}"/libarrow_flight_sql_odbc_unsigned.*.dylib)"
+  dylib_unsigned_name="$(basename "${dylib_unsigned}")"
+  dylib_signed="${tmp_dir}/${dylib_unsigned_name/_unsigned/}"
+  if is_dylib_signed "${dylib_unsigned}"; then
+    echo "ERROR: ${dylib_unsigned_name} is already signed" >&2
+    exit 1
+  fi
+
+  echo "[5/15] Signing ${dylib_unsigned_name}..."
+  # Rename before signing: codesign derives the signature identifier from the
+  # file name, so signing it as *_unsigned.* would leak that into the identifier.
+  mv "${dylib_unsigned}" "${dylib_signed}"
+  # TODO: replace example `codesign` command with ASF approved way to sign DYLIB
+  codesign --force \
+    --timestamp \
+    --options runtime \
+    --sign "${APPLE_CODESIGN_IDENTITY}" \
+    "${dylib_signed}"
+  if ! is_dylib_signed "${dylib_signed}"; then
+    echo "ERROR: $(basename "${dylib_signed}") is not signed" >&2
+    exit 1
+  fi
+
+  echo "[6/15] Uploading signed DYLIB to GitHub Release..."
+  gh release upload "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --clobber \
+    "${dylib_signed}"
+fi
+
+# This also builds the universal macOS PKG, using the signed DYLIB above.
 if [ "${PHASE_BUILD_MSI}" -gt 0 ]; then
-  echo "[4/8] Triggering odbc_release_step in package_odbc.yml workflow..."
+  echo "[7/15] Triggering odbc_release_step in package_odbc.yml workflow..."
   gh workflow run package_odbc.yml \
     --repo "${GITHUB_REPOSITORY}" \
     --ref "${tag}" \
     --field odbc_release_step=true
 
-  echo "[5/8] Waiting for workflow to complete. This can take a very long time..."
+  echo "[8/15] Waiting for workflow to complete. This can take a very long time..."
   REPOSITORY="${GITHUB_REPOSITORY}" \
     "${SOURCE_DIR}/utils-watch-gh-workflow.sh" "${tag}" package_odbc.yml
 fi
 
 if [ "${PHASE_SIGN_MSI}" -gt 0 ]; then
-  echo "[6/8] Downloading unsigned MSI..."
+  echo "[9/15] Downloading unsigned MSI..."
   gh release download "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --pattern "Apache-Arrow-Flight-SQL-ODBC-${version}-win64.msi" \
@@ -159,7 +204,7 @@ if [ "${PHASE_SIGN_MSI}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[7/8] Signing MSI..."
+  echo "[10/15] Signing MSI..."
   echo "NOTE: Running jsign. You may be prompted for your OTP PIN..."
   jsign --storetype ESIGNER \
     --alias d97c5110-c66a-4c0c-ac0c-1cd6af812ee6 \
@@ -174,9 +219,53 @@ if [ "${PHASE_SIGN_MSI}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[8/8] Uploading signed MSI to GitHub Release..."
+  echo "[11/15] Uploading signed MSI to GitHub Release..."
   gh release upload "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --clobber \
     "${msi}"
 fi
+
+if [ "${PHASE_SIGN_PKG}" -gt 0 ]; then
+  echo "[12/15] Downloading unsigned PKG..."
+  gh release download "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --pattern "ArrowFlightSQLODBC-*_unsigned.pkg" \
+    --dir "${tmp_dir}"
+  pkg_unsigned="$(ls "${tmp_dir}"/ArrowFlightSQLODBC-*_unsigned.pkg)"
+  pkg_name="$(basename "${pkg_unsigned}" _unsigned.pkg)"
+  pkg_signed="${tmp_dir}/${pkg_name}.pkg"
+  if is_pkg_signed "${pkg_unsigned}"; then
+    echo "ERROR: PKG is already signed" >&2
+    exit 1
+  fi
+
+  echo "[13/15] Signing PKG..."
+  # TODO: replace example `productsign` command with ASF approved way to sign PKG
+  productsign \
+    --timestamp \
+    --sign "${APPLE_INSTALLER_IDENTITY}" \
+    "${pkg_unsigned}" \
+    "${pkg_signed}"
+  if ! is_pkg_signed "${pkg_signed}"; then
+    echo "ERROR: PKG is not signed" >&2
+    exit 1
+  fi
+
+  echo "[14/15] Notarizing and stapling PKG. This can take a while..."
+  # TODO: replace example `xcrun` command with ASF approved way to notarize PKG
+  xcrun notarytool submit "${pkg_signed}" \
+    --keychain-profile "${APPLE_NOTARY_PROFILE}" \
+    --wait
+  # Stapling fails if there is no notarization ticket, so a rejected submission
+  # can't slip through even if notarytool exits successfully.
+  xcrun stapler staple "${pkg_signed}"
+  xcrun stapler validate "${pkg_signed}"
+  spctl --assess --type install --verbose "${pkg_signed}"
+
+  echo "[15/15] Uploading signed PKG to GitHub Release..."
+  gh release upload "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --clobber \
+    "${pkg_signed}"
+fi

amoeba

Thanks, left a few comments.

Can you check the file permissions final universal pkg contents and the installed files? Looking at the code here I think it's possible some of the files could end up owned by the GHA runner user.

amoeba · 2026-11-02T20:00:00Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


This addition of this job seems fine. Just curious, this hasn't been an issue yet right?

yes, I don't think there's an existing GitHub issue for this
edited msg

Sorry, just meant to ask whether we ran into a scenario yet where this was a problem. I'll resolve this conversation since it sounds like it hasn't.

I am reopening this as I think @amoeba has a point here. I think AI tends to be overly defensive on lots of places. In general those defenses are worth taking a look at but in this case I think adding more is detrimental for the release.
In this specific case it will work as is but if in the future we make changes to other workflows for example changing the tag or the name of the assets this is a place where we have to update "stuff". The problem is that we might forget to do so and this would require a new RC as it will only fail mid release. I'd rather remove this step entirely as if this fails it would still fail the following steps nonetheless.
In my opinion this only adds maintenance burden without adding too much value.

That makes sense, let's remove it.

@raulcd you have a good point, I have removed this check. Since future changes to release workflows are expected, I think the costs outweigh the gain here.

Just a side note, I actually asked AI to add this check, the reason is that I wanted the CI to skip the rebuild is the MSI or PKG is already generated. For example, with the check implemented, if a workflow run fails for macOS but succeeds for Windows, re-running the workflow will only try to generate the missing macOS .pkg installer.

if this fails it would still fail the following steps nonetheless.

Good point. So re-running won't really help in this sense

alinaliBQ

pushing the changes to test, will work on issues that come up.
Thanks Bryce for the detailed review!

alinaliBQ · 2026-11-02T21:31:22Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


yes, I don't think there's an existing GitHub issue for this
edited msg

raulcd · 2026-11-03T09:38:40Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


I am reopening this as I think @amoeba has a point here. I think AI tends to be overly defensive on lots of places. In general those defenses are worth taking a look at but in this case I think adding more is detrimental for the release.
In this specific case it will work as is but if in the future we make changes to other workflows for example changing the tag or the name of the assets this is a place where we have to update "stuff". The problem is that we might forget to do so and this would require a new RC as it will only fail mid release. I'd rather remove this step entirely as if this fails it would still fail the following steps nonetheless.
In my opinion this only adds maintenance burden without adding too much value.

alinaliBQ

Addressed comments. These are great feedback, thank you both @raulcd and @amoeba.
I am waiting on the fork CI to see if there's any new failures

alinaliBQ · 2026-11-03T21:25:46Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


@raulcd you have a good point, I have removed this check. Since future changes to release workflows are expected, I think the costs outweigh the gain here.

Just a side note, I actually asked AI to add this check, the reason is that I wanted the CI to skip the rebuild is the MSI or PKG is already generated. For example, with the check implemented, if a workflow run fails for macOS but succeeds for Windows, re-running the workflow will only try to generate the missing macOS .pkg installer.

if this fails it would still fail the following steps nonetheless.

Good point. So re-running won't really help in this sense

In-progress fix CI logic Revert "Increase nugettimeout to 30 mins" This reverts commit 62b8d41. Increase nugettimeout to 30 mins Upload gRPC can take long for vcpkg Clean up IN-PROGRESS add check Address Raul and Bryce comments - removed `Check runner architecture` - remove `odbc-release-check` Fix sudo issue Empty commit to retrigger CI to fix https://github.com/apache/arrow/actions/runs/41538385140/job/125596157426 ODBC debug AMD64 macOS 26-intel error Re-use macOS ODBC workflow .github/actions/odbc-mac/action.yml mirrors .github/actions/odbc-windows/action.yml Address Bryce's comments Co-Authored-By: Bryce Mecum <brycemecum@gmail.com>

amoeba

Thanks for the changes @alinaliBQ. This looks good now but I'll give @raulcd a chance to re-review.

I think the 07 script will need a few tweaks to work with the changes we're about to merge here but we can work on that in another PR.

alinaliBQ · 2026-11-05T19:00:20Z

Sounds good Bryce. I assume an Arrow PMC member would need to work on the 07 script, since the changes can only be tested with PMC access. My suggestions are in #55321 (comment) comment.

alinaliBQ · 2026-11-05T19:01:41Z

I am waiting on the fork CI to see if there's any new failures

The fork CI results are successful. PR ready for another round of review

github-actions Bot added the awaiting review Awaiting review label Oct 29, 2026

alinaliBQ changed the title ~~GH-49411: [C++][CI][Packaging][FlightPRC][ODBC] Upload macOS DYLIB and PKG to GitHub release~~ GH-51694: [C++][CI][Packaging][FlightPRC][ODBC] Upload macOS DYLIB and PKG to GitHub release Oct 29, 2026

alinaliBQ added the CI: Extra: C++ Run extra C++ CI label Oct 29, 2026

alinaliBQ force-pushed the gh-49411-macos-ci-upload branch from 9e429c7 to eea3482 Compare October 30, 2026 19:57

alinaliBQ marked this pull request as ready for review October 30, 2026 20:08

alinaliBQ requested review from assignUser, jonkeane, kou and raulcd as code owners October 30, 2026 20:08

alinaliBQ mentioned this pull request Oct 30, 2026

[C++][CI][Packaging][FlightPRC] ODBC macOS DYLIB and PKG installer signing #49411

Open

amoeba reviewed Nov 2, 2026

View reviewed changes

github-actions Bot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels Nov 2, 2026

amoeba reviewed Nov 2, 2026

View reviewed changes

Comment thread .github/workflows/package_odbc.yml Resolved

alinaliBQ commented Nov 2, 2026

View reviewed changes

Comment thread .github/workflows/package_odbc.yml Resolved

raulcd reviewed Nov 3, 2026

View reviewed changes

github-actions Bot added awaiting changes Awaiting changes and removed awaiting committer review Awaiting committer review labels Nov 3, 2026

amoeba reviewed Nov 3, 2026

View reviewed changes

Comment thread .github/actions/odbc-mac/action.yml Resolved

Comment thread .github/actions/odbc-mac/action.yml Resolved

Comment thread .github/actions/odbc-mac/action.yml Resolved

Comment thread .github/workflows/package_odbc.yml Resolved

github-actions Bot added awaiting change review Awaiting change review and removed awaiting changes Awaiting changes labels Nov 3, 2026

alinaliBQ commented Nov 3, 2026

View reviewed changes

alinaliBQ force-pushed the gh-49411-macos-ci-upload branch from 2f4d307 to e26b604 Compare November 4, 2026 16:55

amoeba approved these changes Nov 4, 2026

View reviewed changes

alinaliBQ requested a review from raulcd November 6, 2026 18:07

		# skip the process if MSI/PKG artifacts with signed
		# ODBC libraries are already generated

Conversation

alinaliBQ commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale for this change

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

Was AI used for this PR?

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

alinaliBQ commented Oct 30, 2026

Uh oh!

alinaliBQ commented Oct 30, 2026

Uh oh!

amoeba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

amoeba Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

alinaliBQ Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

amoeba Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

raulcd Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

amoeba Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

alinaliBQ Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alinaliBQ left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alinaliBQ Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

raulcd Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alinaliBQ left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alinaliBQ Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alinaliBQ commented Oct 29, 2026 •

edited

Loading

alinaliBQ Nov 2, 2026 •

edited

Loading

alinaliBQ left a comment •

edited

Loading

alinaliBQ Nov 2, 2026 •

edited

Loading