From 85599c237fef73d0d27cd19ec195ac864083ef7e Mon Sep 17 00:00:00 2001
From: Erik Gomez <egomez@coreweave.com>
Date: Tue, 12 May 2026 09:40:11 -0500
Subject: [PATCH] Move signed pkg to outputs/ before notarization

Fixes regression where a signed-but-unnotarized .pkg was built into
the staging dir and then deleted by cleanup() without ever reaching
outputs/. The pre-refactor script moved the .pkg unconditionally
after munkipkg succeeded; the refactor lost that mv when it was
consolidated into notarize_and_staple().
---
 build_python_framework_pkgs.zsh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/build_python_framework_pkgs.zsh b/build_python_framework_pkgs.zsh
index 9fd8d01..1a0d6e0 100755
--- a/build_python_framework_pkgs.zsh
+++ b/build_python_framework_pkgs.zsh
@@ -197,6 +197,8 @@ build_pkg() {
 JSON
 
     "${MP_BINDIR}/munki-pkg-${MP_SHA}/munkipkg" "$TOOLSDIR/$TYPE"
+    local pkg_built="$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"
+    /bin/mv "$pkg_built" "$OUTPUTSDIR"
 }
 
 notarize_and_staple() {
@@ -208,7 +210,7 @@ notarize_and_staple() {
     xcode_dev="$(/usr/bin/xcode-select -p)"
     xcode_notary="$xcode_dev/usr/bin/notarytool"
     xcode_stapler="$xcode_dev/usr/bin/stapler"
-    pkg="$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"
+    pkg="$OUTPUTSDIR/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"
 
     "$xcode_notary" store-credentials \
         --apple-id "opensource@macadmins.io" \
@@ -217,7 +219,6 @@ notarize_and_staple() {
         macadminpython
     "$xcode_notary" submit "$pkg" --keychain-profile macadminpython --wait
     "$xcode_stapler" staple "$pkg"
-    /bin/mv "$pkg" "$OUTPUTSDIR"
 }
 
 zip_framework() {