fix: pin MACOSX_DEPLOYMENT_TARGET for cargo build (CRAN M1mac WARNING)

[milkway]

Problem

The CRAN M1mac additional check of v0.2.2 reported 1 WARNING (Prof. Brian Ripley, deadline 2026-07-06):

ld: warning: object file (...libpdfsigner.a[...]-curve25519.o) was built for
newer 'macOS' version (26.5) than being linked (26.0)

…repeated for 21 object files — all the C/assembly files from the bundled ring crate (curve25519, aes, montgomery, chacha, ghash, sha, p256…). The 12 main CRAN flavors were OK; only the M1mac check warned.

Root cause

rust-lang/rust#136113: when MACOSX_DEPLOYMENT_TARGET is unset, the macOS deployment target differs between the tools that produce libpdfsigner.a:

• the cc crate (compiles ring's C/asm) defaults to the host SDK version (26.5);
• rustc and R's link step use a lower target (26.0).

So ring's objects are stamped for a newer macOS than R links against → the one-directional "built for newer than being linked" warning.

Fix

Export an explicit MACOSX_DEPLOYMENT_TARGET for the cargo build step on macOS so cc-rs and rustc agree on a target <= R's link target (the warning never fires for older-than-link):

• tools/config.R computes .macos_deployment_target (R's own MACOSX_DEPLOYMENT_TARGET when set, else rustc's per-arch default: 11.0 arm64 / 10.13 x86_64) and substitutes @MACOS_DEPLOYMENT_TARGET@;
• src/Makevars.in prefixes the placeholder onto the cargo build invocation (no-op on non-macOS / Windows).

Verification

• Built libpdfsigner.a with the fix: ring objects now stamp minos 11.0 (was 26.5), confirmed via otool -l on curve25519.o, aes_nohw.o, montgomery.o.
• R CMD check --as-cran on pdfsigner_0.2.4.tar.gz: no ld "newer macOS" warning in the install log. Remaining items are the known local-env messages (checkbashisms / HTML Tidy not installed, installed-size NOTE).

Bumps version to 0.2.4 and updates cran-comments.md for the resubmission.

🤖 Generated with Claude Code