#!/usr/bin/env bash
|
set -euo pipefail
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
APP_BUNDLE="${1:-$ROOT_DIR/build/TagLauncher.app}"
|
EXPECTED_MINIMUM_SYSTEM="${MACOS_DEPLOYMENT_TARGET:-14.0}"
|
EXPECTED_ARCHES_RAW="${EXPECTED_ARCHES:-arm64}"
|
INFO_PLIST="$APP_BUNDLE/Contents/Info.plist"
|
EXECUTABLE="$APP_BUNDLE/Contents/MacOS/TagLauncher"
|
|
fail() {
|
echo "FAIL: $*" >&2
|
exit 1
|
}
|
|
[[ -d "$APP_BUNDLE" ]] || fail "app bundle not found: $APP_BUNDLE"
|
[[ -f "$INFO_PLIST" ]] || fail "Info.plist not found: $INFO_PLIST"
|
[[ -x "$EXECUTABLE" ]] || fail "executable not found or not executable: $EXECUTABLE"
|
|
unreadable_dirs="$(find "$APP_BUNDLE" -type d ! -perm -005 -print | head -20)"
|
if [[ -n "$unreadable_dirs" ]]; then
|
fail "app bundle contains directories not readable/searchable by non-root users: $unreadable_dirs"
|
fi
|
|
unreadable_files="$(find "$APP_BUNDLE" -type f ! -perm -004 -print | head -20)"
|
if [[ -n "$unreadable_files" ]]; then
|
fail "app bundle contains files not readable by non-root users: $unreadable_files"
|
fi
|
|
if find "$EXECUTABLE" -type f ! -perm -005 -print | grep -q .; then
|
fail "main executable is not readable/executable by non-root users: $EXECUTABLE"
|
fi
|
|
SIGNED_ENTITLEMENTS="$(mktemp -t taglauncher-signed-entitlements.XXXXXX)"
|
PROFILE_PLIST="$(mktemp -t taglauncher-profile.XXXXXX)"
|
cleanup() {
|
rm -f "$SIGNED_ENTITLEMENTS" "$PROFILE_PLIST"
|
}
|
trap cleanup EXIT
|
|
codesign -d --entitlements :- "$APP_BUNDLE" > "$SIGNED_ENTITLEMENTS" 2>/dev/null || fail "unable to read signed entitlements from $APP_BUNDLE"
|
if [[ -f "$APP_BUNDLE/Contents/embedded.provisionprofile" ]]; then
|
security cms -D -i "$APP_BUNDLE/Contents/embedded.provisionprofile" > "$PROFILE_PLIST"
|
profile_application_identifier="$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.application-identifier' "$PROFILE_PLIST" 2>/dev/null || true)"
|
if [[ -n "$profile_application_identifier" ]]; then
|
signed_application_identifier="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.application-identifier' "$SIGNED_ENTITLEMENTS" 2>/dev/null || true)"
|
[[ "$signed_application_identifier" == "$profile_application_identifier" ]] || fail "signed application identifier '$signed_application_identifier' does not match provisioning profile '$profile_application_identifier'"
|
fi
|
fi
|
|
actual_minimum_system="$(/usr/libexec/PlistBuddy -c 'Print :LSMinimumSystemVersion' "$INFO_PLIST")"
|
if [[ "$actual_minimum_system" != "$EXPECTED_MINIMUM_SYSTEM" ]]; then
|
fail "LSMinimumSystemVersion expected $EXPECTED_MINIMUM_SYSTEM, got $actual_minimum_system"
|
fi
|
|
EXPECTED_ARCHES=()
|
while IFS= read -r arch; do
|
[[ -n "$arch" ]] && EXPECTED_ARCHES+=("$arch")
|
done < <(tr ',' '\n' <<<"$EXPECTED_ARCHES_RAW" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
|
|
[[ "${#EXPECTED_ARCHES[@]}" -gt 0 ]] || fail "no EXPECTED_ARCHES configured"
|
|
actual_arches="$(lipo -archs "$EXECUTABLE")"
|
for expected_arch in "${EXPECTED_ARCHES[@]}"; do
|
case "$expected_arch" in
|
arm64|x86_64) ;;
|
*) fail "unsupported expected arch: $expected_arch" ;;
|
esac
|
if ! grep -Eq "(^|[[:space:]])${expected_arch}($|[[:space:]])" <<<"$actual_arches"; then
|
fail "missing architecture $expected_arch; actual arches: $actual_arches"
|
fi
|
done
|
|
for actual_arch in $actual_arches; do
|
matched=false
|
for expected_arch in "${EXPECTED_ARCHES[@]}"; do
|
if [[ "$actual_arch" == "$expected_arch" ]]; then
|
matched=true
|
break
|
fi
|
done
|
[[ "$matched" == true ]] || fail "unexpected architecture $actual_arch; expected: ${EXPECTED_ARCHES[*]}"
|
done
|
|
for arch in "${EXPECTED_ARCHES[@]}"; do
|
build_info="$(vtool -arch "$arch" -show-build "$EXECUTABLE")"
|
minos="$(awk '/minos/{print $2; exit}' <<<"$build_info")"
|
[[ "$minos" == "$EXPECTED_MINIMUM_SYSTEM" ]] || fail "$arch LC_BUILD_VERSION minos expected $EXPECTED_MINIMUM_SYSTEM, got $minos"
|
done
|
|
codesign --verify --deep --strict "$APP_BUNDLE"
|
|
echo "PASS build metadata: LSMinimumSystemVersion=$actual_minimum_system minos=$EXPECTED_MINIMUM_SYSTEM arches=$actual_arches"
|
