macOS gitian issue

gistfile1.txt

# Downloading the unsigned tarball 
Desktop curl -O https://bitcoin.jonasschnelli.ch/bitcoin-osx-unsigned.tar.gz
shasum -a 256 bitcoin-osx-unsigned.tar.gz
5e3a08ae8195190d6f1b12e3e1e9d710e7ad385941a6e8d04e3391f12deddb11  bitcoin-osx-unsigned.tar.gz
# hash matches with other gitian builders

#unpacking
mkdir bitcoin-osx-unsigned
tar -xzf bitcoin-osx-unsigned.tar.gz -C bitcoin-osx-unsigned
cd bitcoin-osx-unsigned

#signing
./detached-sig-create.sh -s "Bitcoin Core Code"
Adding detached signature for: dist/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt. Size: 225312. Offset: 26472848
Adding resource for: "dist/Bitcoin-Qt.app/Contents/_CodeSignature/CodeResources"
Created signature-osx.tar.gz

#verifying (OK)
codesign -v -d dist/Bitcoin-Qt.app
Executable=/Users/jonasschnelli/Desktop/bitcoin-osx-unsigned/dist/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt
Identifier=org.bitcoinfoundation.Bitcoin-Qt
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=207040 flags=0x0(none) hashes=6464+3 location=embedded
Signature size=8973
Timestamp=11 Dec 2020 at 21:58:28
Info.plist entries=17
TeamIdentifier=YZC7WH3MRU
Sealed Resources version=2 rules=13 files=32
Internal requirements count=1 size=192

#uploaded the whole dir as zip here: https://bitcoin.jonasschnelli.ch/bitcoin-osx-unsigned-nowsigned.zip


#copy over signature.tar.gz to gitian host and build the signer
# using https://github.com/bitcoin/bitcoin/pull/20630
./bin/gbuild --num-make 6 -j11 --memory 5000 --url bitcoin=/home/jonasschnelli/gitian/bitcoin --commit signature=v0.21.0rc3 ../gitian-osx-signer-local.yml

getting a70a41e062cef0789f0d4fd527dab8266a33950821c7ad0561d15f7c59d2750b  bitcoin-osx-signed.dmg

# Downloaded on local mac (file is here: https://bitcoin.jonasschnelli.ch/bitcoin-osx-signed3.dmg
shasum -a 256 bitcoin-osx-signed.dmg
a70a41e062cef0789f0d4fd527dab8266a33950821c7ad0561d15f7c59d2750b  bitcoin-osx-signed.dmg

# verify signature (FAILED)
open bitcoin-osx-signed.dmg
codesign -v /Volumes/Bitcoin-Core/Bitcoin-Qt.app
/Volumes/Bitcoin-Core/Bitcoin-Qt.app: invalid signature (code or signature have been modified)
In architecture: x86_64