Retry transient macOS codesign failures

Co-Authored-By: Warp <agent@warp.dev>

Author: kevinyang372

script/macos/bundle

@@ -92,6 +92,33 @@ function relpath() {
   python -c "import os,sys;print(os.path.relpath(*(sys.argv[1:])))" "$@";
 }
 
+# Retry timestamped signing because Apple's timestamp service can fail
+# transiently. All call sites use force signing so retries are idempotent.
+function codesign_with_retry() {
+  local max_attempts="${CODESIGN_MAX_ATTEMPTS:-4}"
+  local initial_retry_delay_seconds="${CODESIGN_INITIAL_RETRY_DELAY_SECONDS:-5}"
+  local retry_delay_seconds="$initial_retry_delay_seconds"
+  local attempt
+  local status
+
+  for ((attempt = 1; attempt <= max_attempts; attempt++)); do
+    if codesign "$@"; then
+      return 0
+    else
+      status=$?
+    fi
+
+    if (( attempt == max_attempts )); then
+      echo "Codesigning failed after $attempt attempts."
+      return "$status"
+    fi
+
+    echo "Codesigning failed; retrying in $retry_delay_seconds seconds ($attempt/$max_attempts)."
+    sleep "$retry_delay_seconds"
+    retry_delay_seconds=$((retry_delay_seconds * 2))
+  done
+}
+
 # Submit once so a transient polling failure can resume the same notarization
 # instead of uploading a duplicate artifact.
 function notarize_artifact() {
@@ -842,10 +869,10 @@ elif [[ $CODESIGN = true ]]; then
   if [[ "$ARTIFACT" == app ]]; then
     echo "Codesigning $BUNDLE_DIR/$WARP_APP_NAME.app..."
     # Use --deep so we sign bundled frameworks as well
-    codesign --deep -f -o runtime --timestamp -s "$APPLE_TEAM_ID" "$BUNDLE_DIR/$WARP_APP_NAME.app" --entitlements script/Entitlements.plist
+    codesign_with_retry --deep -f -o runtime --timestamp -s "$APPLE_TEAM_ID" "$BUNDLE_DIR/$WARP_APP_NAME.app" --entitlements script/Entitlements.plist
   elif [[ "$ARTIFACT" == cli || "$ARTIFACT" == warpctrl || "$ARTIFACT" == tui ]]; then
     echo "Codesigning $OUT_DIR/$WARP_BIN..."
-    codesign -f -o runtime --timestamp -s "$APPLE_TEAM_ID" "$OUT_DIR/$WARP_BIN" --entitlements script/Entitlements.plist
+    codesign_with_retry -f -o runtime --timestamp -s "$APPLE_TEAM_ID" "$OUT_DIR/$WARP_BIN" --entitlements script/Entitlements.plist
 
     # Create the .zip for notarization in a separate location - otherwise, Apple's codesigning
     # tools decide that it's a sealed resource that belongs to the binary and needs to also be signed.
@@ -917,7 +944,7 @@ if [[ "$ARTIFACT" = app ]]; then
     create_warp_dmg "$DMG_DIR"
 
     echo "Codesigning $DMG_DIR/$DMG_NAME..."
-    codesign -s "$APPLE_TEAM_ID" --timestamp "$DMG_DIR/$DMG_NAME"
+    codesign_with_retry -f -s "$APPLE_TEAM_ID" --timestamp "$DMG_DIR/$DMG_NAME"
 
     NOTARIZATION_ARTIFACT="$DMG_DIR/$DMG_NAME"
     STAPLE_TICKET=true