A check that verifies itself

Seven releases went out in one day. Three were broken, in three different ways that turned out to be the same bug wearing different clothes.

The curious one: codesign --verify passed clean on a build macOS refuses on download. An adhoc signature is a real signature. It just isn't issued by anyone your Mac trusts, and it verifies beautifully against itself, which is the whole problem. Same day, gh release view showed a downloadable file on a private repo that 404s for literally everyone else, because gh was checking in as the one account that could always see it.

Every one of those checks asked the near side of its own boundary a question it already knew the answer to. The fix: check the signing authority by name, fetch the file the way a stranger would, read the licence keys back out of the built app instead of trusting that a shell variable got set somewhere upstream. "It was set" and "it landed in the artifact" are different claims. Only the second one is worth anything.