Repository navigation
Bump Bun to 1.4 so macOS standalone binaries get a valid code signature - #20578
Conversation
18f7606 to
3170190
Compare
|
I rebased this PR on the latest Sent by an AI assistant on behalf of @RobinMalfait. |
 [High impact] The PR appears safe to merge; no blocking issue was found. Reviews (3) · Last reviewed commit: "Add changelog entry for the Bun bump (#2..." · Reviewed by Greptile |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe standalone package manifest updates the Priority: ➖ Normal Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the Bun 1.4 update and its purpose of fixing macOS standalone binary code signatures. |
| Description check | |
The description directly explains the Bun update, the macOS code-signature issue, validation steps, and testing limitations. |
| Linked Issues check | |
The PR addresses issue #20544 by updating bun and @types/bun in packages/@tailwindcss-standalone/package.json from ^1.3.14 to ^1.4.1. The reported build validation resolved Bun 1.4.3, built … |
| Out of Scope Changes check | |
The reported changes are limited to the standalone package dependency bump and a related changelog entry. The reported lockfile update supports the dependency bump. These changes directly support issu… |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Bun 1.3.14 writes the last page hash of the ad-hoc Mach-O signature over a zero-padded page. macOS 27 checks that page at launch and kills the standalone CLI (tailwindlabs#20544). Bun 1.4.1 and later sign the real bytes. This bumps `bun` and `@types/bun` in `@tailwindcss/standalone` to `^1.4.1`. The lockfile resolves Bun 1.4.3.
b852173 to
3fa4783
Compare
RobinMalfait
left a comment
RobinMalfait
left a comment
There was a problem hiding this comment.
Thanks for the PR!
Sent by an AI assistant on behalf of @RobinMalfait.
2 participants
Summary
Fixes #20544.
bun build --compilein Bun 1.3.14 writes the ad-hoc Mach-O signature with the hash of the last 4 KiB page taken over a zero-padded page, not the real bytes.codesign --verifyreports an invalid signature, and macOS 27 checks that page at launch and killstailwindcss-macos-arm64. Bun 1.4.1 and later sign the real bytes.This bumps
bunand@types/bunin@tailwindcss/standalonefrom^1.3.14to^1.4.1. The lockfile now resolves Bun 1.4.3. The fix reaches users with the next release, because the binaries are built at release time.Test plan
I built the standalone binaries before and after the bump on Linux (
cd packages/@tailwindcss-standalone && pnpm build) and hashed every 4096-byte page ofdist/tailwindcss-macos-arm64against itsLC_CODE_SIGNATURECodeDirectory:main[(17905, 2736)]I could not run the binary on macOS 27, so the launch kill itself is not tested here.
Also checked with the bump:
pnpm install --frozen-lockfilepasses, the build finishes for all 7 targets, and thetailwindcss-linux-x64binary builds@import "tailwindcss"and generates.flex,.p-4andhover:underlinefor a small HTML file.dist/tailwindcss-macos-arm64grows from 73.9 MB to 81.3 MB.I did not run
integrations/cli/standalone.test.ts, because it needspnpm packtarballs of every package, including the WASM build.I am new to open source, and this pull request was made with AI assistance.