test-signed-callers.sh
bash
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700
feat(companion): add production macOS distribution path
Human
minor
⚠ breaking
24 days ago
| 1 | #!/bin/bash |
| 2 | set -euo pipefail |
| 3 | |
| 4 | repo_root="$(cd "$(dirname "$0")/../../.." && pwd)" |
| 5 | app="${1:-/Applications/Knowtation.app}" |
| 6 | [[ "$app" == "/Applications/Knowtation.app" ]] || { |
| 7 | echo "signed-caller test requires the installed production path" >&2; exit 2; |
| 8 | } |
| 9 | [[ -d "$app" && -x /usr/local/bin/knowtation && -x /usr/local/bin/knowtation-mcp ]] || { |
| 10 | echo "signed app, CLI, and MCP installation are required" >&2; exit 2; |
| 11 | } |
| 12 | |
| 13 | /usr/local/bin/knowtation companion status |
| 14 | /usr/local/bin/knowtation companion verify-session |
| 15 | /usr/local/bin/knowtation-mcp companion verify-session |
| 16 | "$app/Contents/Resources/runtime/node/bin/node" \ |
| 17 | "$repo_root/scripts/release/macos/smoke-mcp-client.mjs" \ |
| 18 | --helper /usr/local/bin/knowtation-mcp |
| 19 | |
| 20 | probe_build="$repo_root/build/signed-caller-probe" |
| 21 | env \ |
| 22 | CLANG_MODULE_CACHE_PATH="$probe_build/clang-cache" \ |
| 23 | SWIFTPM_MODULECACHE_OVERRIDE="$probe_build/swiftpm-cache" \ |
| 24 | swift build --disable-sandbox \ |
| 25 | --package-path "$repo_root/companion/macos" \ |
| 26 | --scratch-path "$probe_build" \ |
| 27 | --product KnowtationCallerProbe |
| 28 | probe="$(swift build --disable-sandbox --package-path "$repo_root/companion/macos" \ |
| 29 | --scratch-path "$probe_build" --show-bin-path)/KnowtationCallerProbe" |
| 30 | "$probe" |
| 31 | |
| 32 | tamper_root="$(mktemp -d "${TMPDIR:-/tmp}/knowtation-tamper.XXXXXX")" |
| 33 | trap 'rm -rf "$tamper_root"' EXIT |
| 34 | cp -cR "$app" "$tamper_root/Knowtation.app" |
| 35 | printf '\n// release tamper probe\n' >> \ |
| 36 | "$tamper_root/Knowtation.app/Contents/Resources/runtime/companion/runtime/main.mjs" |
| 37 | if codesign --verify --deep --strict "$tamper_root/Knowtation.app" 2>/dev/null; then |
| 38 | echo "tampered app unexpectedly retained a valid signature" >&2 |
| 39 | exit 1 |
| 40 | fi |
| 41 | if node "$repo_root/scripts/release/macos/verify-runtime-manifest.mjs" \ |
| 42 | --app "$tamper_root/Knowtation.app" --require-committed-source 2>/dev/null; then |
| 43 | echo "tampered runtime unexpectedly matched its manifest" >&2 |
| 44 | exit 1 |
| 45 | fi |
| 46 | |
| 47 | echo "signed caller, CLI/MCP provisioning, unsigned-caller denial, and tamper rejection passed" |
File History
1 commit
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700
feat(companion): add production macOS distribution path
Human
minor
⚠
24 days ago