Bypassing macOS code signing for ZIP-appended binaries

Feed
2025-07-02 zipclaudemac

I wanted to append a zip data to the end of a binary executable in C to create a single executable server that reads its own zip tail on launch.

Doing this directly on my mac M2 via cat repl site.zip > repl.app and chmod +x repl.app returned a corrupted file which did not run.

Apparently macOS kills Mach-O binaries with appended data due to some code signing & notarization rules.

There is a possible workaround solution that looks like it should work, instead I tried a simpler approach by creating a ‘polyglot file’ (a techie jargon for header files) which is part shell script and part binary. Claude helped me with this. Now doing cat header.sh repl site.zip > repl.app works with a little catch: I have to calculate (#bytes in repl - #bytes in site.zip) and update the header.sh dynamically when either of the two files change.