Repository: tauri
Issue: [bug] MacOS - Codesigning and notarization issue when using ExternalBin
Labels: type: bug,status: needs triage

### Describe the bug

We are in the process of distributing 2 different Tauri applications for multiple architecture, one is still on V1 while the other is V2. When building a release version for MacOS we're getting notarization errors the moment we add 1 or more sidecar's via the `externalBin` property.

Both the applications successfully build and notarized when the `externalBin` property is removed from the configuration.

I've tested this also with a clean project and a clean binary (prints hello world) where I also followed the steps defined in 
[https://v2.tauri.app/develop/sidecar/](https://v2.tauri.app/develop/sidecar/) and [https://v2.tauri.app/plugin/shell/](https://v2.tauri.app/plugin/shell/)


### Reproduction

I've created a basic setup here [https://github.com/GillesPlatteeuw/tauri-sidecar-test/tree/main](https://github.com/GillesPlatteeuw/tauri-sidecar-test/tree/main)

To reproduce the error i've created a tauri application with 
```
yarn create tauri-app
```
The frontend framework does not really matter in this case

I've created the test binary via rust `cargo new test_binary` and created a release executable via `cargo build --release`. I've copied over the binary to the `binaries` folder and renamed it with the correct target triple appended.

I then followed the documentation to add a sidecar binary. [https://v2.tauri.app/develop/sidecar/](https://v2.tauri.app/develop/sidecar/) and [https://v2.tauri.app/plugin/shell/](https://v2.tauri.app/plugin/shell/)

Then make sure you've updated the `tauri.conf.json` with the MacOS specific configuration for signing and notarization, i've redacted our signing identity with *** in the example below ( tauri.conf.json > bundle > macOS)
```
    "macOS": {
      "signingIdentity": "***",
      "hardenedRuntime": true,
      "minimumSystemVersion": "10.13"
    }
```

Finally you can run `yarn tauri build -- --verbose` to build, codesign, notarize and bundle.


### Expected behavior

Have a valid codesigned and notarized bundled application (DMG)

### Full `tauri info` output

```text
$ tauri info

[✔] Environment
    - OS: Mac OS 15.0.1 arm64 (X64)
    ✔ Xcode Command Line Tools: installed
    ✔ rustc: 1.82.0 (f6e511eec 2024-10-15)
    ✔ cargo: 1.82.0 (8f40fc59f 2024-08-21)
    ✔ rustup: 1.27.1 (54dd3d00f 2024-04-24)
    ✔ Rust toolchain: stable-aarch64-apple-darwin (default)
    - node: 23.3.0
    - yarn: 1.22.22
    - npm: 10.9.0

[-] Packages
    - tauri 🦀: 2.1.1
    - tauri-build 🦀: 2.0.3
    - wry 🦀: 0.47.2
    - tao 🦀: 0.30.8
    - tauri-cli 🦀: 1.5.11
    - @tauri-apps/api : 2.1.1
    - @tauri-apps/cli : 2.1.0

[-] Plugins
    - tauri-plugin-shell 🦀: 2.2.0
    - @tauri-apps/plugin-shell : 2.2.0

[-] App
    - build-type: bundle
    - CSP: unset
    - frontendDist: ../dist
    - devUrl: http://localhost:1420/
    - framework: SolidJS
    - bundler: Vite
```
```


### Stack trace

```text
The error we're getting on all of our projects is the following (I've stripped our developer identity with *)

$ tauri build --verbose
    Debug [ignore::gitignore] opened gitignore file: /var/folders/nj/wss671w55fqg4q7_81y1rj0m0000gn/T/.gitignore
    Debug [globset] built glob set; 0 literals, 2 basenames, 0 extensions, 0 prefixes, 0 suffixes, 0 required extensions, 0 regexes
    Debug [ignore::gitignore] opened gitignore file: /Users/gilles/_git/binary-app/.gitignore
    Debug [globset] built glob set; 0 literals, 2 basenames, 0 extensions, 0 prefixes, 0 suffixes, 0 required extensions, 0 regexes
    Debug [ignore::walk] ignoring /Users/gilles/_git/binary-app/.DS_Store: Ignore(IgnoreMatch(Hidden))
    Debug [ignore::walk] ignoring /Users/gilles/_git/binary-app/node_modules: Ignore(IgnoreMatch(Gitignore(Glob { from: Some("/Users/gilles/_git/binary-app/.gitignore"), original: "node_modules", actual: "**/node_modules", is_whitelist: false, is_only_dir: false })))
    Debug [ignore::walk] ignoring /Users/gilles/_git/binary-app/.gitignore: Ignore(IgnoreMatch(Hidden))
    Debug [ignore::gitignore] opened gitignore file: /Users/gilles/_git/binary-app/src-tauri/.gitignore
    Debug [globset] built glob set; 2 literals, 0 basenames, 0 extensions, 0 prefixes, 0 suffixes, 0 required extensions, 0 regexes
    Running [tauri_cli::helpers] beforeBuildCommand `yarn build`
    Debug [tauri_cli::helpers] Setting environment for hook {"TAURI_ENV_PLATFORM_VERSION": "15.0.1", "TAURI_ENV_FAMILY": "unix", "TAURI_ENV_PLATFORM": "darwin", "TAURI_ENV_ARCH": "aarch64", "TAURI_ENV_TARGET_TRIPLE": "aarch64-apple-darwin"}
    Running [tauri_cli] Command `sh  -c yarn build`
$ vite build
vite v6.0.3 building for production...
✓ 10 modules transformed.
dist/index.html                 0.60 kB │ gzip: 0.36 kB
dist/assets/logo-BKhbptE1.svg   1.60 kB │ gzip: 0.55 kB
dist/assets/index-BuP8cbzy.css  1.37 kB │ gzip: 0.65 kB
dist/assets/index-jMxP8T_C.js   8.39 kB │ gzip: 3.53 kB
✓ built in 110ms
    Running [tauri_cli] Command `cargo  build --bins --features tauri/custom-protocol,tauri/native-tls --release`

...
.... (Rust compilation output)
...

    Finished `release` profile [optimized] target(s) in 33.36s
    Built [tauri_cli::build] application at: /Users/gilles/_git/binary-app/src-tauri/target/release/binary-app
    Bundling [tauri_bundler::bundle::macos::app] binary-app.app (/Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app)
    Running [tauri_bundler::bundle::common] Command `xattr  -crs /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app`
    Signing [tauri_bundler::bundle::macos::sign] with identity "*****************************"
Signing with identity "*****************************"
Signing /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app/Contents/MacOS/test_binary
    Running [tauri_macos_sign] Command `codesign  --force -s ***************************** --options runtime /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app/Contents/MacOS/test_binary`
/Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app/Contents/MacOS/test_binary: replacing existing signature
Signing with identity "*****************************"
Signing /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app/Contents/MacOS/binary-app
    Running [tauri_macos_sign] Command `codesign  --force -s ***************************** --options runtime /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app/Contents/MacOS/binary-app`
/Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app/Contents/MacOS/binary-app: replacing existing signature
Signing with identity "*****************************"
Signing /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app
    Running [tauri_macos_sign] Command `codesign  --force -s ***************************** --options runtime /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app`
/Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app: replacing existing signature
    Running [tauri_macos_sign] Command `ditto  -c -k --keepParent --sequesterRsrc /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app /var/folders/nj/wss671w55fqg4q7_81y1rj0m0000gn/T/.tmpPPynUE/binary-app.zip`
Signing with identity "*****************************"
Signing /var/folders/nj/wss671w55fqg4q7_81y1rj0m0000gn/T/.tmpPPynUE/binary-app.zip
    Running [tauri_macos_sign] Command `codesign  --force -s ***************************** /var/folders/nj/wss671w55fqg4q7_81y1rj0m0000gn/T/.tmpPPynUE/binary-app.zip`
Notarizing /Users/gilles/_git/binary-app/src-tauri/target/release/bundle/macos/binary-app.app
failed to bundle project: Finished with status Invalid for id f96d2728-295a-4fce-b17c-95bd52de9d00 (Processing complete)
Log:
{
  "logFormatVersion": 1,
  "jobId": "f96d2728-295a-4fce-b17c-95bd52de9d00",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "binary-app.zip",
  "uploadDate": "2024-12-17T13:02:50.901Z",
  "sha256": "b0c2ce73a9a49ad35bdf7d2cf3e315727b43eda9128006bee39ccad481b2ecf6",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "binary-app.zip/binary-app.app/Contents/MacOS/binary-app",
      "message": "The signature of the binary is invalid.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",
      "architecture": "arm64"
    }
  ]
}

    Error [tauri_cli_node] failed to bundle project: Finished with status Invalid for id f96d2728-295a-4fce-b17c-95bd52de9d00 (Processing complete)
Log:
{
  "logFormatVersion": 1,
  "jobId": "f96d2728-295a-4fce-b17c-95bd52de9d00",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "binary-app.zip",
  "uploadDate": "2024-12-17T13:02:50.901Z",
  "sha256": "b0c2ce73a9a49ad35bdf7d2cf3e315727b43eda9128006bee39ccad481b2ecf6",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "binary-app.zip/binary-app.app/Contents/MacOS/binary-app",
      "message": "The signature of the binary is invalid.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087735",
      "architecture": "arm64"
    }
  ]
}
```
```


### Additional context

Windows code signing works without any trouble.