GH-51694: [C++][CI][Packaging][FlightPRC][ODBC] Upload macOS DYLIB and PKG to GitHub release by alinaliBQ · Pull Request #55321 · apache/arrow

alinaliBQ · 2026-10-29T23:01:17Z

Rationale for this change

GH-51694

Also see #49411 (comment) for context

What changes are included in this PR?

Upload unsigned macOS DYLIB and PKG to draft releases.

An ARM64 base package is uploaded alongside DYLIB to skip rebuild of PKG.

Adds a check to skip upload process for universal PKG/MSI artifacts if they already exist.

To release macOS and Windows ODBC after this PR:

Assumption: developer running dev/release/07-flightsqlodbc-upload.sh would be able to sign both Windows and macOS artifacts on the same machine.

Generate unsigned DYLIB, macOS base PKG, and DLL with CI
- a macOS base PKG is uploaded to skip rebuild in step 4
Sign DYLIB and DLL and upload to GitHub release
Generate unsigned universal PKG (using base PKG) and MSI with CI
Sign universal PKG and MSI and upload to GitHub release

Are these changes tested?

Tested in fork

Are there any user-facing changes?

N/A

Was AI used for this PR?

In accordance to the AI generation guidelines, please disclose below whether and how AI was used in this PR.

PR code and description written by:

Human
AI

Reviewed before submission by:

Human
AI
Not reviewed

GitHub Issue: [FlightRPC][C++][FlightPRC][ODBC] macOS PKG installer upload CI #51694

github-actions · 2026-10-29T23:01:49Z

⚠️ GitHub issue #49411 has been automatically assigned in GitHub to PR creator.

In-progress fix CI logic Revert "Increase nugettimeout to 30 mins" This reverts commit 62b8d41. Increase nugettimeout to 30 mins Upload gRPC can take long for vcpkg Clean up IN-PROGRESS add check

alinaliBQ · 2026-10-30T20:09:51Z

@raulcd @amoeba cc @kou @lidavidm PR is ready for review.

alinaliBQ · 2026-10-30T20:15:42Z

Here are the suggested changes for 07-flightsqlodbc-upload.sh that I generated with help from Claude. I added TODO comments.

Assumption: PMC member running 07-flightsqlodbc-upload.sh would be able to sign both Windows and macOS artifacts on the same machine. rcodesign might be a good candidate as codesign only works on mac it seems..

diff --git a/dev/release/07-flightsqlodbc-upload.sh b/dev/release/07-flightsqlodbc-upload.sh
index c823bc84ae..bb924cc785 100755
--- a/dev/release/07-flightsqlodbc-upload.sh
+++ b/dev/release/07-flightsqlodbc-upload.sh
@@ -53,6 +53,7 @@ fi
 
 . "${SOURCE_DIR}/utils-env.sh"
 
+# TODO: Add checks for required macos signer storepass
 if [ -z "${ESIGNER_STOREPASS:-}" ]; then
   echo "ERROR: ESIGNER_STOREPASS is not set" >&2
   exit 1
@@ -73,12 +74,17 @@ dll_signed="arrow_flight_sql_odbc.dll"
 
 : "${GITHUB_REPOSITORY:=apache/arrow}"
 
+# In PHASE_BUILD_MSI step, both unsigned MSI and PKG will be built
 : "${PHASE_DEFAULT:=1}"
 : "${PHASE_SIGN_DLL:=${PHASE_DEFAULT}}"
+: "${PHASE_SIGN_DYLIB:=${PHASE_DEFAULT}}"
 : "${PHASE_BUILD_MSI:=${PHASE_DEFAULT}}"
 : "${PHASE_SIGN_MSI:=${PHASE_DEFAULT}}"
+: "${PHASE_SIGN_PKG:=${PHASE_DEFAULT}}"
 
-if [ "${PHASE_SIGN_DLL}" -eq 0 ] && [ "${PHASE_BUILD_MSI}" -eq 0 ] && [ "${PHASE_SIGN_MSI}" -eq 0 ]; then
+if [ "${PHASE_SIGN_DLL}" -eq 0 ] && [ "${PHASE_SIGN_DYLIB}" -eq 0 ] &&
+  [ "${PHASE_BUILD_MSI}" -eq 0 ] && [ "${PHASE_SIGN_MSI}" -eq 0 ] &&
+  [ "${PHASE_SIGN_PKG}" -eq 0 ]; then
   echo "No phases specified. Exiting."
   exit 1
 fi
@@ -102,7 +108,7 @@ if [ -e "${tmp_dir}" ]; then
 fi
 
 if [ "${PHASE_SIGN_DLL}" -gt 0 ]; then
-  echo "[1/8] Downloading ${dll_unsigned} from release..."
+  echo "[1/15] Downloading ${dll_unsigned} from release..."
   gh release download "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --pattern "${dll_unsigned}" \
@@ -112,7 +118,7 @@ if [ "${PHASE_SIGN_DLL}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[2/8] Signing ${dll_unsigned}..."
+  echo "[2/15] Signing ${dll_unsigned}..."
   echo "NOTE: Running jsign. You may be prompted for your OTP PIN..."
   jsign --storetype ESIGNER \
     --alias d97c5110-c66a-4c0c-ac0c-1cd6af812ee6 \
@@ -128,27 +134,66 @@ if [ "${PHASE_SIGN_DLL}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[3/8] Uploading signed DLL to GitHub Release..."
+  echo "[3/15] Uploading signed DLL to GitHub Release..."
   gh release upload "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --clobber \
     "${tmp_dir}/${dll_signed}"
 fi
 
+# The signed DYLIB must be on the release before PHASE_BUILD_MSI: the workflow
+# downloads it (libarrow_flight_sql_odbc.*.dylib) to build the universal PKG.
+if [ "${PHASE_SIGN_DYLIB}" -gt 0 ]; then
+  echo "[4/15] Downloading unsigned universal DYLIB from release..."
+  gh release download "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --pattern "libarrow_flight_sql_odbc_unsigned.*.dylib" \
+    --dir "${tmp_dir}"
+  dylib_unsigned="$(ls "${tmp_dir}"/libarrow_flight_sql_odbc_unsigned.*.dylib)"
+  dylib_unsigned_name="$(basename "${dylib_unsigned}")"
+  dylib_signed="${tmp_dir}/${dylib_unsigned_name/_unsigned/}"
+  if is_dylib_signed "${dylib_unsigned}"; then
+    echo "ERROR: ${dylib_unsigned_name} is already signed" >&2
+    exit 1
+  fi
+
+  echo "[5/15] Signing ${dylib_unsigned_name}..."
+  # Rename before signing: codesign derives the signature identifier from the
+  # file name, so signing it as *_unsigned.* would leak that into the identifier.
+  mv "${dylib_unsigned}" "${dylib_signed}"
+  # TODO: replace example `codesign` command with ASF approved way to sign DYLIB
+  codesign --force \
+    --timestamp \
+    --options runtime \
+    --sign "${APPLE_CODESIGN_IDENTITY}" \
+    "${dylib_signed}"
+  if ! is_dylib_signed "${dylib_signed}"; then
+    echo "ERROR: $(basename "${dylib_signed}") is not signed" >&2
+    exit 1
+  fi
+
+  echo "[6/15] Uploading signed DYLIB to GitHub Release..."
+  gh release upload "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --clobber \
+    "${dylib_signed}"
+fi
+
+# This also builds the universal macOS PKG, using the signed DYLIB above.
 if [ "${PHASE_BUILD_MSI}" -gt 0 ]; then
-  echo "[4/8] Triggering odbc_release_step in package_odbc.yml workflow..."
+  echo "[7/15] Triggering odbc_release_step in package_odbc.yml workflow..."
   gh workflow run package_odbc.yml \
     --repo "${GITHUB_REPOSITORY}" \
     --ref "${tag}" \
     --field odbc_release_step=true
 
-  echo "[5/8] Waiting for workflow to complete. This can take a very long time..."
+  echo "[8/15] Waiting for workflow to complete. This can take a very long time..."
   REPOSITORY="${GITHUB_REPOSITORY}" \
     "${SOURCE_DIR}/utils-watch-gh-workflow.sh" "${tag}" package_odbc.yml
 fi
 
 if [ "${PHASE_SIGN_MSI}" -gt 0 ]; then
-  echo "[6/8] Downloading unsigned MSI..."
+  echo "[9/15] Downloading unsigned MSI..."
   gh release download "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --pattern "Apache-Arrow-Flight-SQL-ODBC-${version}-win64.msi" \
@@ -159,7 +204,7 @@ if [ "${PHASE_SIGN_MSI}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[7/8] Signing MSI..."
+  echo "[10/15] Signing MSI..."
   echo "NOTE: Running jsign. You may be prompted for your OTP PIN..."
   jsign --storetype ESIGNER \
     --alias d97c5110-c66a-4c0c-ac0c-1cd6af812ee6 \
@@ -174,9 +219,53 @@ if [ "${PHASE_SIGN_MSI}" -gt 0 ]; then
     exit 1
   fi
 
-  echo "[8/8] Uploading signed MSI to GitHub Release..."
+  echo "[11/15] Uploading signed MSI to GitHub Release..."
   gh release upload "${tag}" \
     --repo "${GITHUB_REPOSITORY}" \
     --clobber \
     "${msi}"
 fi
+
+if [ "${PHASE_SIGN_PKG}" -gt 0 ]; then
+  echo "[12/15] Downloading unsigned PKG..."
+  gh release download "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --pattern "ArrowFlightSQLODBC-*_unsigned.pkg" \
+    --dir "${tmp_dir}"
+  pkg_unsigned="$(ls "${tmp_dir}"/ArrowFlightSQLODBC-*_unsigned.pkg)"
+  pkg_name="$(basename "${pkg_unsigned}" _unsigned.pkg)"
+  pkg_signed="${tmp_dir}/${pkg_name}.pkg"
+  if is_pkg_signed "${pkg_unsigned}"; then
+    echo "ERROR: PKG is already signed" >&2
+    exit 1
+  fi
+
+  echo "[13/15] Signing PKG..."
+  # TODO: replace example `productsign` command with ASF approved way to sign PKG
+  productsign \
+    --timestamp \
+    --sign "${APPLE_INSTALLER_IDENTITY}" \
+    "${pkg_unsigned}" \
+    "${pkg_signed}"
+  if ! is_pkg_signed "${pkg_signed}"; then
+    echo "ERROR: PKG is not signed" >&2
+    exit 1
+  fi
+
+  echo "[14/15] Notarizing and stapling PKG. This can take a while..."
+  # TODO: replace example `xcrun` command with ASF approved way to notarize PKG
+  xcrun notarytool submit "${pkg_signed}" \
+    --keychain-profile "${APPLE_NOTARY_PROFILE}" \
+    --wait
+  # Stapling fails if there is no notarization ticket, so a rejected submission
+  # can't slip through even if notarytool exits successfully.
+  xcrun stapler staple "${pkg_signed}"
+  xcrun stapler validate "${pkg_signed}"
+  spctl --assess --type install --verbose "${pkg_signed}"
+
+  echo "[15/15] Uploading signed PKG to GitHub Release..."
+  gh release upload "${tag}" \
+    --repo "${GITHUB_REPOSITORY}" \
+    --clobber \
+    "${pkg_signed}"
+fi

amoeba

Thanks, left a few comments.

Can you check the file permissions final universal pkg contents and the installed files? Looking at the code here I think it's possible some of the files could end up owned by the GHA runner user.

amoeba · 2026-11-02T20:00:00Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


This addition of this job seems fine. Just curious, this hasn't been an issue yet right?

yes, I don't think there's an existing GitHub issue for this
edited msg

Sorry, just meant to ask whether we ran into a scenario yet where this was a problem. I'll resolve this conversation since it sounds like it hasn't.

I am reopening this as I think @amoeba has a point here. I think AI tends to be overly defensive on lots of places. In general those defenses are worth taking a look at but in this case I think adding more is detrimental for the release.
In this specific case it will work as is but if in the future we make changes to other workflows for example changing the tag or the name of the assets this is a place where we have to update "stuff". The problem is that we might forget to do so and this would require a new RC as it will only fail mid release. I'd rather remove this step entirely as if this fails it would still fail the following steps nonetheless.
In my opinion this only adds maintenance burden without adding too much value.

That makes sense, let's remove it.

@raulcd you have a good point, I have removed this check. Since future changes to release workflows are expected, I think the costs outweigh the gain here.

Just a side note, I actually asked AI to add this check, the reason is that I wanted the CI to skip the rebuild is the MSI or PKG is already generated. For example, with the check implemented, if a workflow run fails for macOS but succeeds for Windows, re-running the workflow will only try to generate the missing macOS .pkg installer.

if this fails it would still fail the following steps nonetheless.

Good point. So re-running won't really help in this sense

amoeba · 2026-11-02T20:29:28Z

+          done
+ 
+          mkdir universal
+          pkgutil --flatten-full expanded "universal/${pkg_name}.pkg"


Opus 5.5 caught that the embedded Distribution will still show the installed size of the .pkg as ~53MB but it'll actually be nearer to double that because we're splicing in the universal dylib. When I expand the .pkg with pkgutil and look at Distribution, I see installKBytes="51607":

$ grep installKBytes Distribution <pkg-ref id="com.Apache Software Foundation.Apache-Arrow-Flight-SQL-ODBC.ArrowFlightSQLODBC" version="27.0.0" installKBytes="51607" auth="Admin" onConclusion="None" updateKBytes="0">#ArrowFlightSQLODBC-27.0.0-ArrowFlightSQLODBC.pkg</pkg-ref> -- >8 --

Opus came up with this patch which doesn't look too bad. Could you test it?

# --flatten-full regenerates each component's Bom and PackageInfo # installKBytes, but leaves Distribution with the ARM64 base PKG's # sizes. Copy the regenerated sizes into Distribution, then # re-flatten without -full so the payloads are reused as-is. pkgutil --flatten-full expanded flattened.pkg pkgutil --expand flattened.pkg shallow for component in shallow/*.pkg; do component_name="$(basename "${component}")" kbytes="$(sed -n 's/.*installKBytes="$[0-9]*$".*/\1/p' "${component}/PackageInfo")" sed -i '' \ "/>#${component_name}<\/pkg-ref>/ s/installKBytes=\"[0-9]*\"/installKBytes=\"${kbytes}\"/" \ shallow/Distribution done mkdir universal pkgutil --flatten shallow "universal/${pkg_name}.pkg"

pushed the changes, let me test it next

Update: the patch fixed the issue and shows actual payload size (~100 MB)

Co-Authored-By: Bryce Mecum <brycemecum@gmail.com>

.github/actions/odbc-mac/action.yml mirrors .github/actions/odbc-windows/action.yml

alinaliBQ

pushing the changes to test, will work on issues that come up.
Thanks Bryce for the detailed review!

alinaliBQ · 2026-11-02T21:31:22Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


yes, I don't think there's an existing GitHub issue for this
edited msg

alinaliBQ · 2026-11-02T22:34:42Z

+          done
+ 
+          mkdir universal
+          pkgutil --flatten-full expanded "universal/${pkg_name}.pkg"


pushed the changes, let me test it next

alinaliBQ · 2026-11-02T22:49:23Z

+          # Installed files must not be owned by the runner user.
+          runner_uid="$(id -u)"
+          for bom in verify/*.pkg/Bom; do
+            echo "${bom}:"
+            lsbom -p MugF "${bom}"
+            if lsbom -p u "${bom}" | grep -qx "${runner_uid}"; then
+              echo "${bom} contains files owned by the runner user (uid ${runner_uid})"
+              exit 1
+            fi
+          done


Can you check the file permissions final universal pkg contents and the installed files? Looking at the code here I think it's possible some of the files could end up owned by the GHA runner user.

Added check here to verify. I will also need to verify on my machine once the GA runs on my fork finish.

verified the fix, owner now shows as root

to fix https://github.com/apache/arrow/actions/runs/41538385140/job/125596157426 ODBC debug AMD64 macOS 26-intel error

raulcd · 2026-11-03T09:38:40Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


I am reopening this as I think @amoeba has a point here. I think AI tends to be overly defensive on lots of places. In general those defenses are worth taking a look at but in this case I think adding more is detrimental for the release.
In this specific case it will work as is but if in the future we make changes to other workflows for example changing the tag or the name of the assets this is a place where we have to update "stuff". The problem is that we might forget to do so and this would require a new RC as it will only fail mid release. I'd rather remove this step entirely as if this fails it would still fail the following steps nonetheless.
In my opinion this only adds maintenance burden without adding too much value.

raulcd · 2026-11-03T09:44:22Z

+  # (the release step runs as a separate workflow run, so artifacts from the
+  # tag-triggered run are not available) and the signed universal dylib from
+  # the release is swapped in.
+  odbc-macos-upload-pkg:


why do we have to rebuild at this point? At this point of the release we should just use already built artifacts don't we?

I think this was the result of my comment in #55321 (comment). I think we want to avoid rebuilding here. My comment was that I didn't like seeing just the unsigned ARM64 .pkg in the release. This is the .pkg we turn into the universal .pkg by modifying it. The reason was that it could be confusing to see just the ARM64 .pkg in the release and not the AMD64 one but:

It's not that confusing

We'll eventually drop AMD64 macOS anyway

During the reviews of the Windows PRs for this, we decided to keep temporary artifacts like the unsigned Windows DLL in the release which I think is a good idea. So it'd be good to do that here too and keep the ARM64 base .pkg in the release.

Maybe we can just not worry about having the unsigned ARM64 base .pkg in the release without the accompanying AMD64 .pkg?

I see. I think it's better to have an unsigned ARM64 base .pkg in the release than rebuilding at this point. Rebuilding might fail (we all know about temporary shenanigans on CI jobs) and at this point on the release it shouldn't be necessary so downloading the already built package seems to be a safer bet in my opinion.

Sounds good. @alinaliBQ let's switch this back to how it was.

I have switched back to upload ARM64_base.pkg

amoeba · 2026-11-03T17:25:22Z

+  # (the release step runs as a separate workflow run, so artifacts from the
+  # tag-triggered run are not available) and the signed universal dylib from
+  # the release is swapped in.
+  odbc-macos-upload-pkg:


I think this was the result of my comment in #55321 (comment). I think we want to avoid rebuilding here. My comment was that I didn't like seeing just the unsigned ARM64 .pkg in the release. This is the .pkg we turn into the universal .pkg by modifying it. The reason was that it could be confusing to see just the ARM64 .pkg in the release and not the AMD64 one but:

It's not that confusing

We'll eventually drop AMD64 macOS anyway

During the reviews of the Windows PRs for this, we decided to keep temporary artifacts like the unsigned Windows DLL in the release which I think is a good idea. So it'd be good to do that here too and keep the ARM64 base .pkg in the release.

Maybe we can just not worry about having the unsigned ARM64 base .pkg in the release without the accompanying AMD64 .pkg?

- removed `Check runner architecture` - remove `odbc-release-check`

alinaliBQ

Addressed comments. These are great feedback, thank you both @raulcd and @amoeba.
I am waiting on the fork CI to see if there's any new failures

alinaliBQ · 2026-11-03T20:12:25Z

+          done
+ 
+          mkdir universal
+          pkgutil --flatten-full expanded "universal/${pkg_name}.pkg"


Update: the patch fixed the issue and shows actual payload size (~100 MB)

alinaliBQ · 2026-11-03T20:14:26Z

+          # Installed files must not be owned by the runner user.
+          runner_uid="$(id -u)"
+          for bom in verify/*.pkg/Bom; do
+            echo "${bom}:"
+            lsbom -p MugF "${bom}"
+            if lsbom -p u "${bom}" | grep -qx "${runner_uid}"; then
+              echo "${bom} contains files owned by the runner user (uid ${runner_uid})"
+              exit 1
+            fi
+          done


verified the fix, owner now shows as root

alinaliBQ · 2026-11-03T21:25:46Z

+  # skip the process if MSI/PKG artifacts with signed 
+  # ODBC libraries are already generated 


@raulcd you have a good point, I have removed this check. Since future changes to release workflows are expected, I think the costs outweigh the gain here.

Just a side note, I actually asked AI to add this check, the reason is that I wanted the CI to skip the rebuild is the MSI or PKG is already generated. For example, with the check implemented, if a workflow run fails for macOS but succeeds for Windows, re-running the workflow will only try to generate the missing macOS .pkg installer.

if this fails it would still fail the following steps nonetheless.

Good point. So re-running won't really help in this sense

alinaliBQ · 2026-11-03T22:09:07Z

+  # (the release step runs as a separate workflow run, so artifacts from the
+  # tag-triggered run are not available) and the signed universal dylib from
+  # the release is swapped in.
+  odbc-macos-upload-pkg:


I have switched back to upload ARM64_base.pkg

github-actions Bot added the awaiting review Awaiting review label Oct 29, 2026

alinaliBQ changed the title ~~GH-49411: [C++][CI][Packaging][FlightPRC][ODBC] Upload macOS DYLIB and PKG to GitHub release~~ GH-51694: [C++][CI][Packaging][FlightPRC][ODBC] Upload macOS DYLIB and PKG to GitHub release Oct 29, 2026

alinaliBQ added the CI: Extra: C++ Run extra C++ CI label Oct 29, 2026

Upload macOS package to GitHub release

eea3482

In-progress fix CI logic Revert "Increase nugettimeout to 30 mins" This reverts commit 62b8d41. Increase nugettimeout to 30 mins Upload gRPC can take long for vcpkg Clean up IN-PROGRESS add check

alinaliBQ force-pushed the gh-49411-macos-ci-upload branch from 9e429c7 to eea3482 Compare October 30, 2026 19:57

alinaliBQ marked this pull request as ready for review October 30, 2026 20:08

alinaliBQ requested review from assignUser, jonkeane, kou and raulcd as code owners October 30, 2026 20:08

alinaliBQ mentioned this pull request Oct 30, 2026

[C++][CI][Packaging][FlightPRC] ODBC macOS DYLIB and PKG installer signing #49411

Open

amoeba reviewed Nov 2, 2026

View reviewed changes

github-actions Bot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels Nov 2, 2026

amoeba reviewed Nov 2, 2026

View reviewed changes

Comment thread .github/workflows/package_odbc.yml Resolved

alinaliBQ and others added 2 commits November 2, 2026 14:46

Address Bryce's comments

bd506e7

Co-Authored-By: Bryce Mecum <brycemecum@gmail.com>

Re-use macOS ODBC workflow

dd3d4af

.github/actions/odbc-mac/action.yml mirrors .github/actions/odbc-windows/action.yml

alinaliBQ commented Nov 2, 2026

View reviewed changes

alinaliBQ added 2 commits November 2, 2026 17:39

Empty commit to retrigger CI

ab9f01e

to fix https://github.com/apache/arrow/actions/runs/41538385140/job/125596157426 ODBC debug AMD64 macOS 26-intel error

Fix sudo issue

5152ede

raulcd reviewed Nov 3, 2026

View reviewed changes

github-actions Bot added awaiting changes Awaiting changes and removed awaiting committer review Awaiting committer review labels Nov 3, 2026

amoeba reviewed Nov 3, 2026

View reviewed changes

Address Raul and Bryce comments

2f4d307

- removed `Check runner architecture` - remove `odbc-release-check`

github-actions Bot removed the awaiting changes Awaiting changes label Nov 3, 2026

github-actions Bot added the awaiting change review Awaiting change review label Nov 3, 2026

alinaliBQ commented Nov 3, 2026

View reviewed changes

		# skip the process if MSI/PKG artifacts with signed
		# ODBC libraries are already generated

Conversation

alinaliBQ commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale for this change

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

Was AI used for this PR?

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

alinaliBQ commented Oct 30, 2026

Uh oh!

alinaliBQ commented Oct 30, 2026

Uh oh!

amoeba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alinaliBQ Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

alinaliBQ left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alinaliBQ Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

alinaliBQ commented Oct 29, 2026 •

edited

Loading

alinaliBQ Nov 2, 2026 •

edited

Loading

alinaliBQ left a comment •

edited

Loading

alinaliBQ Nov 2, 2026 •

edited

Loading