From 4bac7a68c62167cf61328909d257b3ea5f70dac5 Mon Sep 17 00:00:00 2001
From: Martijn Walraven <martijn@martijnwalraven.com>
Date: Sun, 5 Jul 2026 14:50:19 +0200
Subject: [PATCH 1/3] fix: build darwin-arm64 release binaries with GOOS=darwin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The auth-darwin-arm64 make target sets GOOS=linux — a copy-paste of the
auth-arm64 recipe above it, introduced when #2436 restructured the
inline release builds into per-target rules. Every darwin-arm64 release
asset since rc2.189.0-rc.1 has therefore contained a Linux ELF binary
under the darwin name (v2.188.x, built before the restructure, shipped
real Mach-O). The archive name comes from the target stem while its
content comes from the recipe env, and the release-notes checksums are
computed over the same wrong binary, so nothing in the pipeline could
catch the divergence: a new verify-release target now fails the release
when a staged binary's format contradicts its platform.
---
 Makefile | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index a81975c43..e8324a577 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all build deps image migrate test vet sec vulncheck format unused release
+.PHONY: all build deps image migrate test vet sec vulncheck format unused release verify-release
 .PHONY: check-gosec check-govulncheck check-oapi-codegen check-staticcheck
 CHECK_FILES ?= ./...
 
@@ -60,7 +60,7 @@ auth-arm64: deps
 	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(call BUILD_CMD,$(@),)
 
 auth-darwin-arm64: deps
-	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(call BUILD_CMD,$(@),)
+	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(call BUILD_CMD,$(@),)
 
 auth-amd64-strip: deps
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(call BUILD_CMD,$(@), -s)
@@ -79,7 +79,18 @@ release-test: \
 	vulncheck \
 	test
 
-release: $(RELEASE_ARCHIVES)
+release: $(RELEASE_ARCHIVES) verify-release
+
+# The archive name comes from the make target stem while its content comes
+# from the recipe's build env, so a mismatched GOOS ships silently (the
+# darwin-arm64 assets of v2.189.0..v2.192.0 contained Linux ELF binaries).
+# Fail the release when a staged binary's format contradicts its platform.
+verify-release: $(foreach t,$(RELEASE_TARGETS),release-$(t)/auth)
+	file release-x86/auth | grep -q 'ELF'
+	file release-arm64/auth | grep -q 'ELF'
+	file release-darwin-arm64/auth | grep -q 'Mach-O'
+	file release-amd64-strip/auth | grep -q 'ELF'
+	file release-arm64-strip/auth | grep -q 'ELF'
 
 auth-$(VERSION)-%.tar.gz: \
 		release-%/auth \

From 5137dd673cbac307ebb0f89b6259dd12adebc8d6 Mon Sep 17 00:00:00 2001
From: Chris Stockton <chris.stockton@supabase.io>
Date: Tue, 14 Jul 2026 10:24:59 -0700
Subject: [PATCH 2/3] chore: remove release-verify target

---
 Makefile | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/Makefile b/Makefile
index e8324a577..c40f6f918 100644
--- a/Makefile
+++ b/Makefile
@@ -79,18 +79,7 @@ release-test: \
 	vulncheck \
 	test
 
-release: $(RELEASE_ARCHIVES) verify-release
-
-# The archive name comes from the make target stem while its content comes
-# from the recipe's build env, so a mismatched GOOS ships silently (the
-# darwin-arm64 assets of v2.189.0..v2.192.0 contained Linux ELF binaries).
-# Fail the release when a staged binary's format contradicts its platform.
-verify-release: $(foreach t,$(RELEASE_TARGETS),release-$(t)/auth)
-	file release-x86/auth | grep -q 'ELF'
-	file release-arm64/auth | grep -q 'ELF'
-	file release-darwin-arm64/auth | grep -q 'Mach-O'
-	file release-amd64-strip/auth | grep -q 'ELF'
-	file release-arm64-strip/auth | grep -q 'ELF'
+release: $(RELEASE_ARCHIVES)
 
 auth-$(VERSION)-%.tar.gz: \
 		release-%/auth \

From 12f17352f5cd9f99dda02d01de41fd507323bb12 Mon Sep 17 00:00:00 2001
From: Chris Stockton <chris.stockton@supabase.io>
Date: Tue, 14 Jul 2026 10:34:19 -0700
Subject: [PATCH 3/3] chore: remove phony target

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c40f6f918..76405f37e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all build deps image migrate test vet sec vulncheck format unused release verify-release
+.PHONY: all build deps image migrate test vet sec vulncheck format unused release
 .PHONY: check-gosec check-govulncheck check-oapi-codegen check-staticcheck
 CHECK_FILES ?= ./...