Skip to content

emrg: guard against plist XML comments breaking codesign#976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
argszero merged 1 commit into from
Aug 25, 2026
Merged

emrg: guard against plist XML comments breaking codesign #976

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Agent.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -118,7 +118,7 @@ Community needs voiced in HN agent-UI discussions map directly to EMRG's design:
pkill -f "emrg.server"; rm -f ~/.emrg/emrgd.token; python -m emrg
```

Python: `uv run pytest tests/ -v` (1061) — import check: `uv run python -c "from emrg.client.app import run_client"`
Python: `uv run pytest tests/ -v` (1062) — import check: `uv run python -c "from emrg.client.app import run_client"`
GUI: `cd emrg/gui && npm test` (259: 45 daemon_client + 20 conn-manager + 22 app-commands + 129 renderer smoke + 15 i18n + 8 integration + 3 commands + 8 build-config + 7 gui-state + 2 tool-group) — syntax: `node --check main.js preload.js daemon_client.js renderer/js/*.js`
CI: `uv run pytest` (ubuntu + **windows-2025 matrix** — Windows pytest 回归在 PR CI 即失败，v0.2.29 教训 #725) + GUI tests + **actionlint workflow lint** (`rhysd/actionlint@v1.7.12` gate, #444 — workflow 解析错误在 PR CI 即失败，如 `if:` secrets 上下文)
Re-trigger: `scripts/re-trigger-ci.sh [branch]` (workflow_dispatch, #527 — 替代空 commit 重触发：Actions outage 会整段丢弃 push 事件，dispatch 走 API 路径不受影响)
Expand Down
24 changes: 24 additions & 0 deletions tests/test_installer_stop.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -468,3 +468,27 @@ def test_classify_locked_files_mixed():
"bin/data.dat",
"lib/websockets/speedups.cp313-win_amd64.pyd",
]


def test_python_entitlements_plist_stays_comment_free():
"""PR #975（2026-08-25）回归守卫：v0.2.78 macOS 公证构建失败根因之一 =
python-entitlements.plist 里 8 行 XML 注释导致 codesign AMFI 报错，修复 =
删注释。plist 是合法 XML，注释极易被后人重新写回（"解释下这权限干嘛的"）
→ 本测试在任意平台 CI 先拦住，不用等 macOS 打包：

1. plist 不得含 XML 注释（<!-- ... -->）；
2. disable-library-validation 权限必须保留（与 make-installer.sh 签名后
fail-loud 检查同一不变式）；
3. 该权限的来龙去脉（rant 2026-08-25 journal R2：scipy ILP 实测阻断、
pip C 扩展 Team ID 不符加载失败）只许写在 make-installer.sh 注释里，
不得迁回 plist —— 两处断言互相锚定。
"""
plist = _read("packaging/assets/python-entitlements.plist")
assert "<!--" not in plist
assert "<key>com.apple.security.cs.disable-library-validation</key>" in plist
assert "<true/>" in plist

script = _read("packaging/make-installer.sh")
# 上下文锚在签名循环注释（line ~66-71）+ fail-loud 检查（line ~78-84）
assert "journal R2" in script and "scipy" in script
assert "missing disable-library-validation entitlement" in script
Loading