CRT/waybetter
1
0
Fork 0
Code Issues Pull requests Releases Packages 2 Activity

Remote builds: the updater tarball carries no account name in its entry headers (owner 0/root); the scan caught it

Browse source
This commit is contained in:
CRTkafa 2026-09-30 23:31:26 +07:00
parent 124ebb3a73
commit cffbe8946f
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
packages/waybetter/cli/remote.mjs
View file

@ -129,7 +129,8 @@ bun "$SRC/waybetter/packages/waybetter/bin/waybetter.mjs" build-env -- bunx taur
BUNDLE="$CARGO_TARGET_DIR/universal-apple-darwin/release/bundle" BUNDLE="$CARGO_TARGET_DIR/universal-apple-darwin/release/bundle"
DMG="$(ls "$BUNDLE"/dmg/*_${version}_universal.dmg | head -1)" DMG="$(ls "$BUNDLE"/dmg/*_${version}_universal.dmg | head -1)"
cp "$DMG" "$OUT/${artifact}_${version}_universal.dmg" cp "$DMG" "$OUT/${artifact}_${version}_universal.dmg"
COPYFILE_DISABLE=1 tar -czf "$OUT/${artifact}_${version}_universal.app.tar.gz" -C "$BUNDLE/macos" ${shq(app)} # Owner 0/root: the archive must not carry the Mac account name in its entry headers.
COPYFILE_DISABLE=1 tar --uid 0 --gid 0 --uname root --gname wheel -czf "$OUT/${artifact}_${version}_universal.app.tar.gz" -C "$BUNDLE/macos" ${shq(app)}
ditto "$BUNDLE/macos/"${shq(app)} "$OUT/"${shq(app)} ditto "$BUNDLE/macos/"${shq(app)} "$OUT/"${shq(app)}
cd "$OUT" cd "$OUT"
set -- *.dmg *.tar.gz set -- *.dmg *.tar.gz

2
packages/waybetter/tests/remote-cli.test.mjs
View file

@ -84,7 +84,7 @@ test('mac script: rustup first, ad-hoc universal build through build-env, update
assert.match(script, /"createUpdaterArtifacts":false/); assert.match(script, /"createUpdaterArtifacts":false/);
assert.match(script, /source-abcdef012345\.tgz/); assert.match(script, /source-abcdef012345\.tgz/);
assert.match(script, /App_1\.2\.3_universal\.dmg/); assert.match(script, /App_1\.2\.3_universal\.dmg/);
assert.match(script, /COPYFILE_DISABLE=1 tar -czf "\$OUT\/App_1\.2\.3_universal\.app\.tar\.gz" -C "\$BUNDLE\/macos" 'My App\.app'/); assert.match(script, /COPYFILE_DISABLE=1 tar --uid 0 --gid 0 --uname root --gname wheel -czf "\$OUT\/App_1\.2\.3_universal\.app\.tar\.gz" -C "\$BUNDLE\/macos" 'My App\.app'/);
assert.ok(script.includes('ditto "$BUNDLE/macos/"\'My App.app\' "$OUT/"\'My App.app\'')); assert.ok(script.includes('ditto "$BUNDLE/macos/"\'My App.app\' "$OUT/"\'My App.app\''));
assert.doesNotMatch(script, /pkill|Applications|osascript/); assert.doesNotMatch(script, /pkill|Applications|osascript/);
assert.doesNotMatch(script, /TAURI_SIGNING_PRIVATE_KEY/); assert.doesNotMatch(script, /TAURI_SIGNING_PRIVATE_KEY/);