mac: codesigning errors not caught/reported

[minrk]

If codesigning fails on mac with an exit code, this error is ignored, apparently because SystemTools.call doesn't throw an error on exit codes.

this code appears to be meant to catch errors, but it seems to only catches things like "command not found", not nonzero exit codes (available as output.status)

The underlying cause of the error was the fact that conda-forge-distributed sigtool doesn't support the --preserve-metadata=entitlements,requirements argument, causing all codesign calls to fail with:

The following argument was not expected: --preserve-metadata=entitlements,requirements

So two things:

1. catch and report failures in codesign
2. (possibly?) support conda codesign, which means losing the --preserve-metadata arg, or checking for its support

Originally found in #1477 (comment)

[wolfv]

Should we pull the latest rattler-build release? This seems quite serious.

[minrk]

Ah, I didn't realize this arg was new in 0.38 (#1461). Yeah, maybe. If conda-forge installs sigtool in the env with rattler-build (e.g. if conda-build is present), then this will result in silent failure to codesign every time the install_name_tool branch is not taken.

[minrk]

linking upstream, the conda-packaged codesign is from sigtool, which aimed to be a drop-in for codesign, but hasn't been updated in some years, so doesn't support all arguments.

Maybe this issue can be side-stepped with apple-codesign?

[wolfv]

Fixed in #1479