From fdc5c43b2cf8ebc3d67099cfba9936c838281561 Mon Sep 17 00:00:00 2001
From: Ariver <shanghai3168@gmail.com>
Date: Tue, 30 Jun 2026 03:36:45 +0800
Subject: [PATCH] Add Windows QA evidence verifier

---
 privatevoice.src/scripts/build-macappstore-pkg-macos.sh |   62 ++++++++++++++++++++++++++++++-
 1 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/privatevoice.src/scripts/build-macappstore-pkg-macos.sh b/privatevoice.src/scripts/build-macappstore-pkg-macos.sh
index 888f559..1b3b0d7 100755
--- a/privatevoice.src/scripts/build-macappstore-pkg-macos.sh
+++ b/privatevoice.src/scripts/build-macappstore-pkg-macos.sh
@@ -20,6 +20,7 @@
 # Optional environment:
 #   PRIVATEVOICE_SIGNING_KEYCHAIN
 #   PRIVATEVOICE_APPSTORE_MIN_SYSTEM_VERSION (default: 13.4)
+#   PRIVATEVOICE_MACAPPSTORE_BUILD_ROOT (default: build/macappstore)
 #
 # Usage:
 #   cd privatevoice.src
@@ -39,6 +40,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+MACAPPSTORE_BUILD_ROOT="${PRIVATEVOICE_MACAPPSTORE_BUILD_ROOT:-$PROJECT_DIR/build/macappstore}"
 
 INFO_PLIST="$PROJECT_DIR/build/darwin/Info.plist"
 BASE_ENTITLEMENTS="$PROJECT_DIR/build/darwin/entitlements-appstore.plist"
@@ -94,7 +96,7 @@
       ;;
   esac
 
-  BUILD_DIR="$PROJECT_DIR/build/macappstore/$OUT_ARCH"
+  BUILD_DIR="$MACAPPSTORE_BUILD_ROOT/$OUT_ARCH"
   APP_BUNDLE="$BUILD_DIR/$APP_NAME.app"
   PKG_PATH="$BUILD_DIR/PrivateVoice-Dictation-$VERSION-build$BUILD_ID-$OUT_ARCH-macappstore.pkg"
   SHERPA_LIB_DIR="$GOMODCACHE/github.com/k2-fsa/sherpa-onnx-go-macos@$SHERPA_MACOS_MODULE_VERSION/lib/$SHERPA_ARCH"
@@ -127,6 +129,49 @@
   local value="$3"
   /usr/libexec/PlistBuddy -c "Delete :$key" "$plist" >/dev/null 2>&1 || true
   /usr/libexec/PlistBuddy -c "Add :$key string $value" "$plist"
+}
+
+strip_extended_attributes() {
+  local item="$1"
+  if command -v xattr >/dev/null; then
+    chmod -R u+rwX "$item"
+    xattr -cr "$item"
+  fi
+}
+
+assert_no_quarantine_attributes() {
+  local item="$1"
+  if command -v xattr >/dev/null; then
+    local found
+    found="$(xattr -lr "$item" 2>/dev/null | grep -F "com.apple.quarantine" | head -n 20 || true)"
+    [[ -z "$found" ]] || fail "com.apple.quarantine attributes remain under $item:
+$found"
+  fi
+}
+
+remove_appledouble_files() {
+  local item="$1"
+  find "$item" \( -name '._*' -o -name '.DS_Store' \) -delete
+}
+
+assert_no_appledouble_files() {
+  local item="$1"
+  local found
+  found="$(find "$item" \( -name '._*' -o -name '.DS_Store' \) -print | head -n 20 || true)"
+  [[ -z "$found" ]] || fail "AppleDouble or Finder metadata files remain under $item:
+$found"
+}
+
+assert_pkg_no_quarantine_attributes() {
+  local pkg="$1"
+  local expanded
+  local found
+  expanded="$(mktemp -d)"
+  pkgutil --expand-full "$pkg" "$expanded/pkg" >/dev/null
+  found="$(xattr -lr "$expanded/pkg" 2>/dev/null | grep -F "com.apple.quarantine" | head -n 20 || true)"
+  rm -rf "$expanded"
+  [[ -z "$found" ]] || fail "com.apple.quarantine attributes remain in package:
+$found"
 }
 
 TARGET_ARCH="${1:-$(uname -m)}"
@@ -210,6 +255,12 @@
 cp "$SHERPA_LIB_DIR/libsherpa-onnx-c-api.dylib" "$APP_BUNDLE/Contents/Frameworks/"
 cp "$ONNXRUNTIME_DYLIB" "$APP_BUNDLE/Contents/Frameworks/"
 
+step "Removing extended attributes from app bundle"
+strip_extended_attributes "$APP_BUNDLE"
+remove_appledouble_files "$APP_BUNDLE"
+assert_no_quarantine_attributes "$APP_BUNDLE"
+assert_no_appledouble_files "$APP_BUNDLE"
+
 step "Fixing rpaths"
 install_name_tool -add_rpath @executable_path/../Frameworks \
   "$APP_BUNDLE/Contents/MacOS/$APP_NAME" 2>/dev/null || true
@@ -224,6 +275,12 @@
 sign_sandboxed "$APP_BUNDLE/Contents/MacOS/$APP_NAME"
 sign_sandboxed "$APP_BUNDLE"
 
+step "Removing extended attributes after signing"
+strip_extended_attributes "$APP_BUNDLE"
+remove_appledouble_files "$APP_BUNDLE"
+assert_no_quarantine_attributes "$APP_BUNDLE"
+assert_no_appledouble_files "$APP_BUNDLE"
+
 step "Verifying app signature and entitlements"
 codesign -vvv --deep --strict "$APP_BUNDLE"
 codesign -d --entitlements :- "$APP_BUNDLE"
@@ -235,13 +292,14 @@
   fail "Signed app application-identifier mismatch: signed has $SIGNED_APP_IDENTIFIER, profile has $PROFILE_APP_IDENTIFIER"
 
 step "Creating signed installer package"
-productbuild \
+COPYFILE_DISABLE=1 productbuild \
   --sign "$APPSTORE_INSTALLER_IDENTITY" \
   --component "$APP_BUNDLE" /Applications \
   "$PKG_PATH"
 
 step "Verifying installer package signature"
 pkgutil --check-signature "$PKG_PATH"
+assert_pkg_no_quarantine_attributes "$PKG_PATH"
 
 step "Mac App Store package complete"
 echo "  App: $APP_BUNDLE"

--
Gitblit v1.9.3