From 23e1cdeb04031625f76cea9893eb624f60e183de Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 13 Aug 2026 07:29:17 +0000
Subject: [PATCH] cmake-rn: make CODE_SIGNING_ALLOWED configurable for Apple
 builds

Add a --code-signing-allowed flag to the Apple platform of cmake-rn.
CODE_SIGNING_ALLOWED=NO remains the default (needed for the
free-standing dynamic libraries we produce), but a consumer who needs
signed binaries in the XCFramework - enterprise distribution, or a
target whose downstream tooling verifies signatures - can now opt in.

Addresses the Apple half of #418.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DaK9eAAF5G8wj6UT8VekAm
---
 .changeset/silly-cobras-invite.md        |  5 +++++
 packages/cmake-rn/src/platforms/apple.ts | 18 +++++++++++++-----
 2 files changed, 18 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/silly-cobras-invite.md

diff --git a/.changeset/silly-cobras-invite.md b/.changeset/silly-cobras-invite.md
new file mode 100644
index 00000000..6c79c0e3
--- /dev/null
+++ b/.changeset/silly-cobras-invite.md
@@ -0,0 +1,5 @@
+---
+"cmake-rn": minor
+---
+
+Add a `--code-signing-allowed` flag to `cmake-rn`. `CODE_SIGNING_ALLOWED=NO` remains the default (needed for the free-standing dynamic libraries we produce), but a consumer who needs signed binaries in the XCFramework can now pass `--code-signing-allowed` to opt in.
diff --git a/packages/cmake-rn/src/platforms/apple.ts b/packages/cmake-rn/src/platforms/apple.ts
index 36c595b9..b2c8b640 100644
--- a/packages/cmake-rn/src/platforms/apple.ts
+++ b/packages/cmake-rn/src/platforms/apple.ts
@@ -161,9 +161,15 @@ const appleBundleIdentifierOption = new Option(
   "Unique CFBundleIdentifier used for Apple framework artifacts",
 ).default(undefined, "com.callstackincubator.node-api.{libraryName}");
 
+const codeSigningAllowedOption = new Option(
+  "--code-signing-allowed",
+  "Allow code signing when building free dynamic libraries (passed as CODE_SIGNING_ALLOWED to xcodebuild)",
+).default(false);
+
 type AppleOpts = {
   xcframeworkExtension: boolean;
   appleBundleIdentifier?: string;
+  codeSigningAllowed: boolean;
 };
 
 function getBuildPath(baseBuildPath: string, triplet: Triplet) {
@@ -259,7 +265,8 @@ export const platform: Platform<Triplet[], AppleOpts> = {
   amendCommand(command) {
     return command
       .addOption(xcframeworkExtensionOption)
-      .addOption(appleBundleIdentifierOption);
+      .addOption(appleBundleIdentifierOption)
+      .addOption(codeSigningAllowedOption);
   },
   assertValidTriplets(triplets) {
     for (const suffix of SIMULATOR_TRIPLET_SUFFIXES) {
@@ -366,7 +373,7 @@ export const platform: Platform<Triplet[], AppleOpts> = {
   },
   async build(
     { spawn, triplet },
-    { build, target, configuration, appleBundleIdentifier },
+    { build, target, configuration, appleBundleIdentifier, codeSigningAllowed },
   ) {
     // We expect the final application to sign these binaries
     if (target.length > 1) {
@@ -440,9 +447,10 @@ export const platform: Platform<Triplet[], AppleOpts> = {
         ...(target.length > 0 ? ["--target", ...target] : []),
         "--",
 
-        // Skip code-signing (needed when building free dynamic libraries)
-        // TODO: Make this configurable
-        "CODE_SIGNING_ALLOWED=NO",
+        // Skip code-signing by default (needed when building free dynamic
+        // libraries), but let a consumer opt into signed binaries via
+        // --code-signing-allowed.
+        `CODE_SIGNING_ALLOWED=${codeSigningAllowed ? "YES" : "NO"}`,
       ]);
       // Create a framework
       const { artifacts } = sharedLibrary;