CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

release: privacy scan of signed macOS artifacts leaves out Apple code signatures only (copies with codesign --remove-signature on every Mach-O, the DMG's koly signature blob zeroed); any other hit still fails; tests and docs

Browse source
This commit is contained in:
CRTkafa 2026-10-14 08:21:35 +08:00
parent 3a27c78f49
commit ae681e3ecd
6 changed files with 228 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
tools/privacy-scan.ts
View file

@ -247,8 +247,11 @@ export function scanPath(path: string, terms: Term[], shown = basename(path), re
return report;
}
/** Every term a scan looks for: the terms file, this machine's names (auto) and scrub's private-name rule. */
export const allTerms = (termsFile: string | null, auto = true): Term[] => [...collectTerms(termsFile, auto), ...scrubTerms()];
export function scan(paths: string[], termsFile: string | null = process.env[TERMS_ENV] ?? DEFAULT_TERMS, auto = true): Report & { terms: number; termsFile: string | null } {
const terms = [...collectTerms(termsFile, auto), ...scrubTerms()];
const terms = allTerms(termsFile, auto);
const report: Report = { files: 0, bytes: 0, hits: [], errors: [] };
for (const p of paths) {
if (!existsSync(p)) { report.errors.push(`${p}: does not exist`); continue; }