CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

release: privacy scan of signed macOS artifacts leaves out Apple code signatures only (copies with codesign --remove-signature on every Mach-O, the DMG's koly signature blob zeroed); any other hit still fails; tests and docs

Browse source
This commit is contained in:
CRTkafa 2026-10-14 08:21:35 +08:00
parent 3a27c78f49
commit ae681e3ecd
6 changed files with 228 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/desktop-release.md
View file

@ -110,6 +110,13 @@ it, never copy it to a runner. The Forgejo workflow builds unsigned installers,
or 7-Zip) and NSIS (7-Zip).
- **Debug files:** .dSYM, .pdb and source maps fail the scan.
- **Exit codes:** 1 when it finds something, 2 when it cannot open an archive. A term is never printed in full.
- **Signed macOS artifacts are scanned without their code signatures** (`tools/mac-signature-scan.ts`, used by
`desktop-release.ts` for the .app, the DMG and the updater bundle). A Developer ID signature embeds the signing
certificate, and its subject is the developer's legal name, which may be in the terms file. That name may appear
inside Apple code signatures and nowhere else, so the scan reads copies: `codesign --remove-signature` on every
Mach-O file of the copied app (also the app copied out of the mounted DMG and the one unpacked from the updater
bundle), and the DMG's own signature blob (the range the UDIF `koly` trailer names) zeroed in memory. Every other
byte is scanned as it ships; a hit outside a signature still fails the release (tests/mac-signature-scan.test.ts).
**Path-free builds.** `tools/desktop-release.ts` builds with `--remap-path-prefix` and `-ffile-prefix-map`, which
turn home into `~`, the checkout into `/src`, the cargo and rustup homes into `/cargo` and `/rustup`, and