From 8b95c10bac85f3cc9c4a809ab44ff3f2982cc5c6 Mon Sep 17 00:00:00 2001
From: Bruno Alexandre Rosa <1791393+brunoalr@users.noreply.github.com>
Date: Sat, 14 Mar 2026 17:27:57 -0300
Subject: [PATCH] be extremely defensive against malformed input

---
 scripts/macos_fix_codesign.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/macos_fix_codesign.sh b/scripts/macos_fix_codesign.sh
index 5ca9a7063..141e85a46 100755
--- a/scripts/macos_fix_codesign.sh
+++ b/scripts/macos_fix_codesign.sh
@@ -69,17 +69,17 @@ fix_app() {
 
   # 1. Remove quarantine
   echo "  Removing quarantine..."
-  xattr -dr com.apple.quarantine "$resolved_app"
+  xattr -dr com.apple.quarantine -- "$resolved_app"
 
   # 2. Ad-hoc sign all binaries and dylibs
   echo "  Signing dylibs, frameworks and executables..."
   # find .dylib files by name and executable files (binaries, frameworks, etc.) by permission via `-perm +111`
-  find "$resolved_app" -type f \( -name "*.dylib" -o -perm +111 \) -print0 | \
-    xargs -0 -I {} codesign -s - -f {}
+  find -- "$resolved_app" -type f \( -name "*.dylib" -o -perm +111 \) -print0 | \
+    xargs -0 -I {} codesign -s - -f -- {}
 
   # 3. Deep sign the app bundle
   echo "  Deep signing app bundle..."
-  codesign -s - --force --deep "$resolved_app"
+  codesign -s - --force --deep -- "$resolved_app"
 
   echo "  Done."
 }