From 23146b53d5c29066ed6b48070bd2072e2cdc0240 Mon Sep 17 00:00:00 2001 From: Maksim Fedotov Date: Fri, 31 Jul 2026 13:01:27 +0300 Subject: [PATCH] [deckhouse-cli] fix macOS SIGKILL by installing the binary atomically The installer overwrote the binary in place with `cp` over the existing target path, which keeps the same inode. On macOS this leaves the kernel holding a stale code-signing validation for the previous contents of the ad-hoc signed binary, so an updated d8 is killed with SIGKILL on exec even though `codesign --verify` still passes. Copy to a temporary file next to the target and rename it into place so the new binary always gets a fresh inode. Signed-off-by: Maksim Fedotov --- tools/install.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tools/install.sh b/tools/install.sh index 933a3b1b0..99a0e4588 100755 --- a/tools/install.sh +++ b/tools/install.sh @@ -388,8 +388,9 @@ install_binary() { if user_can_sudo; then fmt_info "Installing ${BINARY_NAME} to ${target_path} (requires sudo)..." sudo mkdir -p "$INSTALL_DIR" - sudo cp "$binary_path" "$target_path" - sudo chmod +x "$target_path" + sudo cp "$binary_path" "${target_path}.tmp.$$" + sudo chmod +x "${target_path}.tmp.$$" + sudo mv -f "${target_path}.tmp.$$" "$target_path" else fmt_error "Cannot write to ${INSTALL_DIR} and sudo is not available" fmt_error "Please run with sudo or choose a different installation directory" @@ -398,8 +399,9 @@ install_binary() { else fmt_info "Installing ${BINARY_NAME} to ${target_path}..." mkdir -p "$INSTALL_DIR" - cp "$binary_path" "$target_path" - chmod +x "$target_path" + cp "$binary_path" "${target_path}.tmp.$$" + chmod +x "${target_path}.tmp.$$" + mv -f "${target_path}.tmp.$$" "$target_path" fi fmt_success "${BINARY_NAME} installed successfully!"