{"record":{"id":"a485f05e81130eaf","repo":"golang/go","slug":"unexpected-content-after-code-signature","errorCode":null,"errorMessage":"unexpected content after code signature","messagePattern":"unexpected content after code signature","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/link/internal/ld/macho.go","lineNumber":1569,"sourceCode":"\t\t\t}\n\t\t}\n\t\tloadOff += int64(sz)\n\t}\n\n\tif sigOff == 0 {\n\t\t// The C linker doesn't generate a signed binary, for some reason.\n\t\t// Skip.\n\t\treturn nil\n\t}\n\n\tfi, err := f.Stat()\n\tif err != nil {\n\t\treturn err\n\t}\n\tif sigOff+sigSz != fi.Size() {\n\t\t// We don't expect anything after the signature (this will invalidate\n\t\t// the signature anyway.)\n\t\treturn fmt.Errorf(\"unexpected content after code signature\")\n\t}\n\n\tsz := codesign.Size(sigOff, \"a.out\")\n\tif sz != sigSz {\n\t\t// Update the load command,\n\t\tvar tmp [8]byte\n\t\tmf.ByteOrder.PutUint32(tmp[:4], uint32(sz))\n\t\t_, err = f.WriteAt(tmp[:4], csCmdOff+12)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// Uodate the __LINKEDIT segment.\n\t\tsegSz := sigOff + sz - int64(linkeditSeg.Offset)\n\t\tmf.ByteOrder.PutUint64(tmp[:8], uint64(segSz))\n\t\t_, err = f.WriteAt(tmp[:8], linkeditOff+int64(unsafe.Offsetof(macho.Segment64{}.Memsz)))\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":1551,"sourceCodeEnd":1587,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/link/internal/ld/macho.go#L1551-L1587","documentation":"When the linker resizes a Mach-O code signature in place, it requires the signature to be the final bytes of the output file (Apple's codesign invariant: anything after the signature superblob invalidates it). The check `sigOff+sigSz != fi.Size()` detects trailing bytes — if present, the link aborts because patching the signature would leave an unverifiable binary.","triggerScenarios":"The combine-DWARF or codesign-update flow running on a binary already modified by an external tool (`codesign`, `dsymutil`, a custom post-linker) that appended data; a prior interrupted linker run that left partial trailing data; an external `-extld` that produced a non-standard tail layout.","commonSituations":"A build pipeline that runs `codesign` then re-invokes the Go linker; mixing `go build` with a post-processing step that pads the binary; concurrent/duplicate link invocations writing the same output file.","solutions":["Ensure the Go linker runs before any external `codesign`/post-processing, not after.","Delete the output binary and relink from scratch so the signature is the last thing written.","Remove custom `-extldflags` that alter the output tail; use the default external linker behavior.","Avoid concurrent builds writing to the same output path."],"exampleFix":"# before: external codesign ran, then linker tried to resize sig\ncodesign -s MySign bin/app   # wrong order\ngo build -o bin/app ./...\n\n# after: link first, sign last\ngo build -o bin/app ./...\ncodesign -s MySign bin/app","handlingStrategy":"validation","validationCode":"# Before relinking, confirm the existing binary has no trailing bytes after the signature\nif [ -f bin/app ]; then\n  codesign -dv bin/app 2>&1 | grep -q 'CodeDirectory v' && echo 'binary is signed; relink from scratch instead of patching'\nfi","typeGuard":null,"tryCatchPattern":"# Relink cleanly on failure rather than patch a signed binary\nset +e\ngo build -o bin/app ./...\nrc=$?\nset -e\nif [ $rc -ne 0 ]; then\n  rm -f bin/app\n  go build -o bin/app ./...\nfi","preventionTips":["Always run the Go linker before `codesign`, never after.","Relink from scratch rather than re-patching an existing signed binary.","Do not run two linkers concurrently on the same output file.","Avoid `-extldflags` that append trailing data to the Mach-O."],"tags":["linker","go-toolchain","macos","codesigning","mach-o"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}