From aea050b43e9d8e92cf0af7624e37e2c2e3f3e825 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sat, 20 Jun 2026 19:25:38 +0200
Subject: [PATCH] fix(mac): clean failed notary zip staging

---
 scripts/package-mac-dist.sh           | 11 +++++++++++
 test/scripts/package-mac-dist.test.ts | 18 ++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/scripts/package-mac-dist.sh b/scripts/package-mac-dist.sh
index e853fe50f8f..948cdbf4197 100755
--- a/scripts/package-mac-dist.sh
+++ b/scripts/package-mac-dist.sh
@@ -154,6 +154,13 @@ SKIP_NOTARIZE="${SKIP_NOTARIZE:-0}"
 NOTARIZE=1
 SKIP_DSYM="${SKIP_DSYM:-0}"
 SKIP_DMG="${SKIP_DMG:-0}"
+NOTARY_ZIP_PENDING_CLEANUP=0
+
+cleanup_notary_zip() {
+  if [[ "$NOTARY_ZIP_PENDING_CLEANUP" == "1" ]]; then
+    rm -f "$NOTARY_ZIP"
+  fi
+}
 
 if [[ "$SKIP_NOTARIZE" == "1" ]]; then
   NOTARIZE=0
@@ -185,9 +192,13 @@ fi
 if [[ "$NOTARIZE" == "1" ]]; then
   echo "📦 Notary zip: $NOTARY_ZIP"
   rm -f "$NOTARY_ZIP"
+  NOTARY_ZIP_PENDING_CLEANUP=1
+  trap cleanup_notary_zip EXIT
   ditto -c -k --sequesterRsrc --keepParent "$APP" "$NOTARY_ZIP"
   STAPLE_APP_PATH="$APP" "$ROOT_DIR/scripts/notarize-mac-artifact.sh" "$NOTARY_ZIP"
   rm -f "$NOTARY_ZIP"
+  NOTARY_ZIP_PENDING_CLEANUP=0
+  trap - EXIT
 fi
 
 echo "📦 Zip: $ZIP"
diff --git a/test/scripts/package-mac-dist.test.ts b/test/scripts/package-mac-dist.test.ts
index caaba3e6940..6f4bda60b75 100644
--- a/test/scripts/package-mac-dist.test.ts
+++ b/test/scripts/package-mac-dist.test.ts
@@ -232,6 +232,24 @@ describe("package-mac-dist plist validation", () => {
     expect(result.stderr).not.toContain("node reran after failed install");
   });
 
+  it("cleans the temporary notary zip when notarization exits early", () => {
+    const script = readFileSync(scriptPath, "utf8");
+    const notaryBlock = script.slice(
+      script.indexOf('if [[ "$NOTARIZE" == "1" ]]'),
+      script.indexOf('if [[ "$SKIP_DMG" != "1" ]]'),
+    );
+
+    expect(script).toContain("cleanup_notary_zip()");
+    expect(notaryBlock).toContain("NOTARY_ZIP_PENDING_CLEANUP=1");
+    expect(notaryBlock).toContain("trap cleanup_notary_zip EXIT");
+    expect(notaryBlock).toContain(
+      'STAPLE_APP_PATH="$APP" "$ROOT_DIR/scripts/notarize-mac-artifact.sh" "$NOTARY_ZIP"',
+    );
+    expect(notaryBlock).toContain('rm -f "$NOTARY_ZIP"');
+    expect(notaryBlock).toContain("NOTARY_ZIP_PENDING_CLEANUP=0");
+    expect(notaryBlock).toContain("trap - EXIT");
+  });
+
   it("fails closed when required dSYM outputs are missing", () => {
     const script = readFileSync(scriptPath, "utf8");
     const dsymBlock = script.slice(script.indexOf('if [[ "$SKIP_DSYM" != "1" ]]'));