aaronrene / knowtation public
release-macos-layout.test.mjs
85 lines 4.3 KB
Raw
sha256:477fac082ce9f0262d21f05bd473f60061cc1cfffcab1c12afc5ef360bbcf097 fix: escape literal dots in release entitlement verification Human minor ⚠ breaking 25 days ago
1 import assert from 'node:assert/strict';
2 import fs from 'node:fs';
3 import os from 'node:os';
4 import path from 'node:path';
5 import { spawnSync } from 'node:child_process';
6 import test from 'node:test';
7
8 const release = JSON.parse(fs.readFileSync('release/macos/release.json', 'utf8'));
9 const appPlist = fs.readFileSync('release/macos/plists/App-Info.plist', 'utf8');
10 const agentPlist = fs.readFileSync('release/macos/plists/LaunchAgent.plist', 'utf8');
11 const distribution = fs.readFileSync('release/macos/Distribution.xml', 'utf8');
12 const preinstall = fs.readFileSync('release/macos/pkg-scripts/preinstall', 'utf8');
13
14 test('release identity, platform, and installer metadata agree', () => {
15 assert.equal(release.version, '0.1.0');
16 assert.equal(release.build, 100);
17 assert.deepEqual(release.architectures, ['arm64']);
18 assert.equal(release.minimumMacOS, '14.0');
19 assert.equal(release.hosted.origin, 'https://mcp.knowtation.store');
20 assert.equal(release.hosted.nativeOAuthIssuer, `${release.hosted.origin}/api/v1/auth/native`);
21 assert.deepEqual(release.hosted.scopes, ['vault:read', 'vault:write']);
22 assert.deepEqual(
23 release.optionalExternalTools.map((entry) => entry.command),
24 ['git', 'muse'],
25 );
26 assert.ok(release.optionalExternalTools.every((entry) => entry.bundled === false));
27 assert.match(appPlist, /store\.knowtation\.companion/);
28 assert.match(appPlist, /<string>0\.1\.0<\/string>/);
29 assert.match(appPlist, /<string>100<\/string>/);
30 assert.match(agentPlist, /store\.knowtation\.companion\.custody/);
31 assert.match(agentPlist, /<key>MachServices<\/key>/);
32 assert.match(agentPlist, /<key>BundleProgram<\/key>/);
33 assert.match(distribution, /min="14\.0"/);
34 assert.match(distribution, /store\.knowtation\.pkg/);
35 assert.match(distribution, /require-scripts="true"/);
36 assert.match(preinstall, /installed_build > 100/);
37 assert.match(preinstall, /rollback is rejected/);
38 });
39
40 test('release entitlements do not disable library validation or permit debugging', () => {
41 for (const file of [
42 'release/macos/entitlements/app.plist',
43 'release/macos/entitlements/custody.plist',
44 'release/macos/entitlements/launcher.plist',
45 'release/macos/entitlements/runtime.plist',
46 ]) {
47 const text = fs.readFileSync(file, 'utf8');
48 assert.doesNotMatch(text, /get-task-allow/);
49 assert.doesNotMatch(text, /disable-library-validation/);
50 }
51 });
52
53 const custodyIdentifier = 'C72VAF2EM2.store.knowtation.companion.custody';
54 for (const [name, applicationIdentifier, keychainGroup, accepted] of [
55 ['correct application identifier and Keychain group', custodyIdentifier, custodyIdentifier, true],
56 ['missing application identifier', null, custodyIdentifier, false],
57 ['incorrect application identifier', 'wrong.custody', custodyIdentifier, false],
58 ['missing Keychain group', custodyIdentifier, null, false],
59 ['incorrect Keychain group', custodyIdentifier, 'wrong.custody', false],
60 ]) {
61 test(`release custody entitlement checks: ${name}`, { skip: process.platform !== 'darwin' }, () => {
62 // Run the verifier's actual shell checks against the real macOS plutil.
63 const verifier = fs.readFileSync('scripts/release/macos/verify.sh', 'utf8');
64 const checks = verifier.match(/^test "\$\(plutil -extract [\s\S]*?(?=^pkgutil --check-signature)/m)?.[0];
65 assert.ok(checks, 'custody entitlement checks must be present');
66 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'knowtation-entitlements-'));
67 try {
68 const appEntry = applicationIdentifier === null ? '' :
69 `<key>com.apple.application-identifier</key><string>${applicationIdentifier}</string>`;
70 const groupEntry = keychainGroup === null ? '' :
71 `<key>keychain-access-groups</key><array><string>${keychainGroup}</string></array>`;
72 fs.writeFileSync(path.join(root, 'custody-entitlements.plist'),
73 `<?xml version="1.0"?><plist version="1.0"><dict>${appEntry}${groupEntry}</dict></plist>`);
74 const result = spawnSync('/bin/bash', ['-euo', 'pipefail', '-c', checks], {
75 encoding: 'utf8',
76 env: { ...process.env, verification_tmp: root, KNOWTATION_APPLE_TEAM_ID: 'C72VAF2EM2' },
77 });
78 assert.ifError(result.error);
79 assert.equal(result.signal, null);
80 assert.equal(result.status, accepted ? 0 : 1, result.stdout + result.stderr);
81 } finally {
82 fs.rmSync(root, { recursive: true, force: true });
83 }
84 });
85 }
File History 1 commit
sha256:477fac082ce9f0262d21f05bd473f60061cc1cfffcab1c12afc5ef360bbcf097 fix: escape literal dots in release entitlement verification Human minor ⚠ 25 days ago