fix-forward #2820 (tsk-27gdvd): add the fenced red run (tests/sparkle_tests.bats + SparkleBridgeTests) to the PR body; no code change #2838
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| ### Fixed | ||
|
|
||
| - Fixed Sparkle framework integration for macOS updater | ||
| - Updated `fetch_sparkle.sh` to properly extract Sparkle 2.6.0 framework from correct archive layout (`Sparkle.xcframework/macos-arm64_x86_64/Sparkle.framework/`) | ||
| - Updated `sparkle_sign.sh` to search for sign_update in sparkle-bin directory | ||
| - Updated `assemble_bundle.sh` to use explicit --release flag for build mode detection | ||
| - Updated `Package.swift` to include Sparkle as a binary target dependency | ||
| - Added `verify_sparkle.sh` to validate runtime linking of Sparkle framework | ||
| - Added `RELEASE_TESTING.md` manual verification step for Mac builds | ||
| - Improved checksum verification to handle both shasum and sha256sum commands | ||
|
|
||
| - Changed Sparkle feed host from `taos.app` to project domain `taos.my` for better security | ||
| - Updated mac/appcast/appcast.xml | ||
| - Updated mac/build/sparkle_sign.sh | ||
| - Updated mac/launcher/Sources/taOSLauncher/Resources/Info.plist.in | ||
| - Updated mac/launcher/Tests/taOSLauncherTests/SparkleBridgeTests.swift | ||
|
|
||
| - Added fetch_sparkle.sh script to fetch and verify Sparkle 2.6.0 framework | ||
|
|
||
| - Modified assemble_bundle.sh to fail when Sparkle.framework is missing in release builds | ||
| - Modified assemble_bundle.sh to fail when ed_public.pem is missing in release builds | ||
|
|
||
| - Added mac/build/checksums/sparkle-2.6.0.sha256 | ||
|
|
||
| - Updated mac/build/build.sh to fetch Sparkle.framework prior to bundling | ||
|
|
||
| S2-23: Mac updater is a no-op - security fixes never reached users | ||
| if feed domain not owned by project |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| ### Fixed | ||
|
|
||
| - Changed Sparkle feed host from `taos.app` to project domain `taos.my` for better security | ||
| - Updated mac/appcast/appcast.xml | ||
| - Updated mac/build/sparkle_sign.sh | ||
| - Updated mac/launcher/Sources/taOSLauncher/Resources/Info.plist.in | ||
| - Added fetch_sparkle.sh script to fetch and verify Sparkle 2.6.0 framework | ||
| - Modified assemble_bundle.sh to fail when Sparkle.framework is missing in release builds | ||
| - Modified assemble_bundle.sh to fail when ed_public.pem is missing in release builds | ||
| - Added mac/build/checksums/sparkle-2.6.0.sha256 | ||
| - Updated mac/build/build.sh to fetch Sparkle.framework prior to bundling | ||
|
|
||
| S2-23: Mac updater is a no-op - security fixes never reached users | ||
| if feed domain not owned by project |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| a5088d48a37ba415081335502e009dece75acae9d130705fee6c6988b90d0877 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| #!/usr/bin/env bash | ||
| # Fetch and verify Sparkle 2.6.0 release tarball for macOS updaters. | ||
| # | ||
| # Args: --output <STAGING_DIR> | ||
| # Output: $STAGING_DIR/Sparkle.framework (directory structure) | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| OUTPUT="" | ||
| while [[ $# -gt 0 ]]; do | ||
| case "$1" in | ||
| --output) OUTPUT="$2"; shift 2 ;; | ||
| *) echo "fetch_sparkle.sh: unknown arg $1" >&2; exit 2 ;; | ||
| esac | ||
| done | ||
|
|
||
| [[ -n "$OUTPUT" ]] || { echo "--output required" >&2; exit 2; } | ||
|
|
||
| REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)" | ||
|
|
||
| # Sparkle 2.6.0 (as per mac/launcher/Package.swift comments) | ||
| TAG="2.6.0" | ||
| CHECKSUM_FILE="$REPO_ROOT/mac/build/checksums/sparkle-${TAG}.sha256" | ||
| [[ -f "$CHECKSUM_FILE" ]] || { | ||
| echo "[fetch_sparkle] missing checksum file for ${TAG}: $CHECKSUM_FILE" >&2 | ||
| exit 2 | ||
| } | ||
|
|
||
| # Swift Package Manager expects a zip file, not tarball | ||
| # The release page contains both "Sparkle-for-Swift-Package-Manager.zip" | ||
| # and "sparkle-${TAG}.tar.gz". We need the zip. | ||
| URL="https://github.com/sparkle-project/Sparkle/releases/download/${TAG}/Sparkle-for-Swift-Package-Manager.zip" | ||
|
|
||
| mkdir -p "$OUTPUT" | ||
| ZIP="$OUTPUT/sparkle-${TAG}.zip" | ||
|
|
||
| echo "[fetch_sparkle] downloading $URL" | ||
| curl -L --fail -o "$ZIP" "$URL" | ||
|
|
||
| EXPECTED_SHA="$(cat "$CHECKSUM_FILE")" | ||
| if command -v shasum >/dev/null 2>&1; then | ||
| ACTUAL_SHA="$(shasum -a 256 "$ZIP" | awk '{print $1}')" | ||
| else | ||
| ACTUAL_SHA="$(sha256sum "$ZIP" | awk '{print $1}')" | ||
| fi | ||
| if [[ "$EXPECTED_SHA" != "$ACTUAL_SHA" ]]; then | ||
| echo "[fetch_sparkle] SHA mismatch: expected $EXPECTED_SHA got $ACTUAL_SHA" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "[fetch_sparkle] extracting" | ||
| TEMP_DIR="$(mktemp -d)" | ||
| trap 'rm -rf "$TEMP_DIR"' EXIT | ||
| unzip -o "$ZIP" -d "$TEMP_DIR" | ||
| rm "$ZIP" | ||
|
|
||
| # Sparkle.xcframework/macos-arm64_x86_64/Sparkle.framework exists per the release notes | ||
| SPARKLE_FRAMEWORK_PATH="$TEMP_DIR/Sparkle.xcframework/macos-arm64_x86_64/Sparkle.framework" | ||
| if [[ -d "$SPARKLE_FRAMEWORK_PATH" ]]; then | ||
| echo "[fetch_sparkle] found Sparkle.framework at $SPARKLE_FRAMEWORK_PATH" | ||
| cp -R "$SPARKLE_FRAMEWORK_PATH" "$OUTPUT/Sparkle.framework" | ||
| else | ||
| echo "[fetch_sparkle] ERROR: Sparkle.framework not found at expected path $SPARKLE_FRAMEWORK_PATH" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Stage bin/sign_update and bin/generate_appcast for sparkle_sign.sh | ||
| if [[ -d "$TEMP_DIR/bin" ]]; then | ||
| echo "[fetch_sparkle] staging sparkle-bin/ directory" | ||
| mkdir -p "$OUTPUT/sparkle-bin" | ||
| cp -R "$TEMP_DIR/bin/"* "$OUTPUT/sparkle-bin/" 2>/dev/null || true | ||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win Fail the fetch when Sparkle tool staging fails. The Sparkle archive provides 🤖 Prompt for AI Agents |
||
| fi | ||
|
|
||
| echo "[fetch_sparkle] done: $OUTPUT/Sparkle.framework" | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| #!/usr/bin/env bash | ||
| # Verify Sparkle.framework is properly linked in the built app. | ||
| # | ||
| # Args: --app <PATH> --version <X.Y.Z> --output <DIR> [--release] | ||
| # --release: Exit 1 if verification fails; otherwise warning only | ||
| # | ||
| # Usage: verify_sparkle.sh --app taOS.app --version 1.2.3 --output dist | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| APP="" | ||
| VERSION="" | ||
| OUTPUT="" | ||
| RELEASE=0 | ||
|
|
||
| while [[ $# -gt 0 ]]; do | ||
| case "$1" in | ||
| --app) APP="$2"; shift 2 ;; | ||
| --version) VERSION="$2"; shift 2 ;; | ||
| --output) OUTPUT="$2"; shift 2 ;; | ||
| --release) RELEASE=1 ;; | ||
| *) echo "verify_sparkle.sh: unknown arg $1" >&2; exit 2 ;; | ||
| esac | ||
| done | ||
|
|
||
| [[ -n "$APP" && -n "$VERSION" && -n "$OUTPUT" ]] || { | ||
| echo "verify_sparkle.sh: --app, --version, and --output are required" >&2 | ||
| exit 2 | ||
| } | ||
|
|
||
| REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)" | ||
| CONTENTS_FRAMEWORKS="$APP/Contents/Frameworks" | ||
|
|
||
| # Check 1: Sparkle.framework exists | ||
| if [[ ! -d "$CONTENTS_FRAMEWORKS/Sparkle.framework" ]]; then | ||
| if [[ $RELEASE -eq 1 ]]; then | ||
| echo "[verify_sparkle] ERROR: $CONTENTS_FRAMEWORKS/Sparkle.framework missing" >&2 | ||
| exit 1 | ||
| else | ||
| echo "[verify_sparkle] WARNING: $CONTENTS_FRAMEWORKS/Sparkle.framework missing" >&2 | ||
| fi | ||
| fi | ||
|
|
||
| # Check 2: Sparkle binary exists within the framework | ||
| SPARKLE_BINARY="$CONTENTS_FRAMEWORKS/Sparkle.framework/Versions/B/Sparkle" | ||
| if [[ ! -f "$SPARKLE_BINARY" ]]; then | ||
| if [[ $RELEASE -eq 1 ]]; then | ||
| echo "[verify_sparkle] ERROR: Sparkle binary not found at $SPARKLE_BINARY" >&2 | ||
| exit 1 | ||
| else | ||
| echo "[verify_sparkle] WARNING: Sparkle binary not found at $SPARKLE_BINARY" >&2 | ||
| fi | ||
| fi | ||
|
|
||
| # Check 3: otool shows correct linking (check if otool is available) | ||
| if command -v otool >/dev/null 2>&1; then | ||
| LAUNCHER_BINARY="$APP/Contents/MacOS/taOSLauncher" | ||
|
There was a problem hiding this comment. CRITICAL: Wrong launcher binary name in verify_sparkle.sh
Reply with |
||
| if [[ -f "$LAUNCHER_BINARY" ]]; then | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🤖 get_repo_knowledge executed:
Length of output: 1253 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- changed hunk ---'
git diff -- mac/build/verify_sparkle.sh
printf '%s\n' '--- script ---'
cat -n mac/build/verify_sparkle.sh
printf '%s\n' '--- related release parser and callers ---'
rg -n -C 8 -- '--release|verify_sparkle|LAUNCHER_BINARY|Sparkle.framework' mac/buildRepository: jaylfc/taOS Length of output: 22264 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- build verification invocation ---'
sed -n '84,125p' mac/build/build.sh
printf '%s\n' '--- bundle launcher destination ---'
sed -n '52,60p' mac/build/assemble_bundle.sh
printf '%s\n' '--- launcher source and app executable names ---'
rg -n -C 3 'CFBundleExecutable|taOSLauncher|Contents/MacOS/taOS' mac/launcher mac/buildRepository: jaylfc/taOS Length of output: 7030 Check the bundled executable in release verification. When 🤖 Prompt for AI Agents |
||
| # Check for @rpath/Sparkle.framework/Versions/B/Sparkle in otool -L | ||
| if ! otool -L "$LAUNCHER_BINARY" | grep -q "@rpath/Sparkle.framework/Versions/B/Sparkle"; then | ||
| if [[ $RELEASE -eq 1 ]]; then | ||
| echo "[verify_sparkle] ERROR: $LAUNCHER_BINARY not linked to Sparkle.framework" >&2 | ||
| exit 1 | ||
| else | ||
| echo "[verify_sparkle] WARNING: $LAUNCHER_BINARY not linked to Sparkle.framework" >&2 | ||
| fi | ||
| fi | ||
|
|
||
| # Check for LC_RPATH @executable_path/../Frameworks in otool -l | ||
| if ! otool -l "$LAUNCHER_BINARY" 2>/dev/null | grep -q "LC_RPATH.*@executable_path/../Frameworks"; then | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🤖 get_repo_knowledge executed:
Length of output: 3802 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- mac/build/verify_sparkle.sh ---'
cat -n mac/build/verify_sparkle.sh
printf '%s\n' '--- related Sparkle build scripts ---'
rg -n -C 4 'verify_sparkle|LAUNCHER_BINARY|LC_RPATH|--release|otool' mac/buildRepository: jaylfc/taOS Length of output: 13680 🌐 Web query:
💡 Result: When you run otool -l on a Mach-O binary and see an LC_RPATH load command with a path such as Citations:
🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
import subprocess
sample = """Load command 12
cmd LC_RPATH
cmdsize 48
path `@executable_path/`../Frameworks (offset 12)
"""
pattern = r"LC_RPATH.*`@executable_path/`../Frameworks"
result = subprocess.run(
["grep", "-q", pattern],
input=sample,
text=True,
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
)
print(f"grep_match_exit={result.returncode}")
print("sample_records:")
print(sample, end="")
PYRepository: jaylfc/taOS Length of output: 296 Parse
🤖 Prompt for AI Agents |
||
| if [[ $RELEASE -eq 1 ]]; then | ||
| echo "[verify_sparkle] ERROR: $LAUNCHER_BINARY missing LC_RPATH @executable_path/../Frameworks" >&2 | ||
| exit 1 | ||
| else | ||
| echo "[verify_sparkle] WARNING: $LAUNCHER_BINARY missing LC_RPATH @executable_path/../Frameworks" >&2 | ||
| fi | ||
| fi | ||
| fi | ||
| else | ||
| if [[ $RELEASE -eq 1 ]]; then | ||
| echo "[verify_sparkle] ERROR: otool not found — cannot verify binary linking" >&2 | ||
| exit 1 | ||
| else | ||
| echo "[verify_sparkle] WARNING: otool not found — skipping binary linking checks" >&2 | ||
| fi | ||
| fi | ||
|
|
||
| echo "[verify_sparkle] verification passed" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🤖 get_repo_knowledge executed:
get_repo_knowledge jaylfc/taOS /tmp/coderabbit-repo-knowledge/jaylfc-taos-a13cd95b/learningsLength of output: 3802
🏁 Script executed:
Repository: jaylfc/taOS
Length of output: 6015
Consume
--releasein both argument parsers.Both scripts set
RELEASE=1without advancing past--release. The parser can therefore process the same argument indefinitely. Addshiftafter settingRELEASE=1in both files.📍 Affects 2 files
mac/build/assemble_bundle.sh#L20-L20(this comment)mac/build/verify_sparkle.sh#L21-L21🤖 Prompt for AI Agents