aaronrene / knowtation public
release-macos-layout.test.mjs
145 lines 7.0 KB
Raw
sha256:c88bf098b52c796e46edc39ec71f9f0627d305439b73972d3fada73cefde0da9 fix: put release binaries before lipo architecture checks Human minor ⚠ breaking 24 days ago
1 import assert from 'node:assert/strict';
2 import fs from 'node:fs';
3 import os from 'node:os';
4 import path from 'node:path';
5 import { spawnSync } from 'node:child_process';
6 import test from 'node:test';
7
8 const release = JSON.parse(fs.readFileSync('release/macos/release.json', 'utf8'));
9 const appPlist = fs.readFileSync('release/macos/plists/App-Info.plist', 'utf8');
10 const agentPlist = fs.readFileSync('release/macos/plists/LaunchAgent.plist', 'utf8');
11 const distribution = fs.readFileSync('release/macos/Distribution.xml', 'utf8');
12 const preinstall = fs.readFileSync('release/macos/pkg-scripts/preinstall', 'utf8');
13
14 test('release identity, platform, and installer metadata agree', () => {
15 assert.equal(release.version, '0.1.0');
16 assert.equal(release.build, 100);
17 assert.deepEqual(release.architectures, ['arm64']);
18 assert.equal(release.minimumMacOS, '14.0');
19 assert.equal(release.hosted.origin, 'https://mcp.knowtation.store');
20 assert.equal(release.hosted.nativeOAuthIssuer, `${release.hosted.origin}/api/v1/auth/native`);
21 assert.deepEqual(release.hosted.scopes, ['vault:read', 'vault:write']);
22 assert.deepEqual(
23 release.optionalExternalTools.map((entry) => entry.command),
24 ['git', 'muse'],
25 );
26 assert.ok(release.optionalExternalTools.every((entry) => entry.bundled === false));
27 assert.match(appPlist, /store\.knowtation\.companion/);
28 assert.match(appPlist, /<string>0\.1\.0<\/string>/);
29 assert.match(appPlist, /<string>100<\/string>/);
30 assert.match(agentPlist, /store\.knowtation\.companion\.custody/);
31 assert.match(agentPlist, /<key>MachServices<\/key>/);
32 assert.match(agentPlist, /<key>BundleProgram<\/key>/);
33 assert.match(distribution, /min="14\.0"/);
34 assert.match(distribution, /store\.knowtation\.pkg/);
35 assert.match(distribution, /require-scripts="true"/);
36 assert.match(preinstall, /installed_build > 100/);
37 assert.match(preinstall, /rollback is rejected/);
38 });
39
40 test('release entitlements do not disable library validation or permit debugging', () => {
41 for (const file of [
42 'release/macos/entitlements/app.plist',
43 'release/macos/entitlements/custody.plist',
44 'release/macos/entitlements/launcher.plist',
45 'release/macos/entitlements/runtime.plist',
46 ]) {
47 const text = fs.readFileSync(file, 'utf8');
48 assert.doesNotMatch(text, /get-task-allow/);
49 assert.doesNotMatch(text, /disable-library-validation/);
50 }
51 });
52
53 const custodyIdentifier = 'C72VAF2EM2.store.knowtation.companion.custody';
54 for (const [name, applicationIdentifier, keychainGroup, accepted] of [
55 ['correct application identifier and Keychain group', custodyIdentifier, custodyIdentifier, true],
56 ['missing application identifier', null, custodyIdentifier, false],
57 ['incorrect application identifier', 'wrong.custody', custodyIdentifier, false],
58 ['missing Keychain group', custodyIdentifier, null, false],
59 ['incorrect Keychain group', custodyIdentifier, 'wrong.custody', false],
60 ]) {
61 test(`release custody entitlement checks: ${name}`, { skip: process.platform !== 'darwin' }, () => {
62 // Run the verifier's actual shell checks against the real macOS plutil.
63 const verifier = fs.readFileSync('scripts/release/macos/verify.sh', 'utf8');
64 const checks = verifier.match(/^test "\$\(plutil -extract [\s\S]*?(?=^pkgutil --check-signature)/m)?.[0];
65 assert.ok(checks, 'custody entitlement checks must be present');
66 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'knowtation-entitlements-'));
67 try {
68 const appEntry = applicationIdentifier === null ? '' :
69 `<key>com.apple.application-identifier</key><string>${applicationIdentifier}</string>`;
70 const groupEntry = keychainGroup === null ? '' :
71 `<key>keychain-access-groups</key><array><string>${keychainGroup}</string></array>`;
72 fs.writeFileSync(path.join(root, 'custody-entitlements.plist'),
73 `<?xml version="1.0"?><plist version="1.0"><dict>${appEntry}${groupEntry}</dict></plist>`);
74 const result = spawnSync('/bin/bash', ['-euo', 'pipefail', '-c', checks], {
75 encoding: 'utf8',
76 env: { ...process.env, verification_tmp: root, KNOWTATION_APPLE_TEAM_ID: 'C72VAF2EM2' },
77 });
78 assert.ifError(result.error);
79 assert.equal(result.signal, null);
80 assert.equal(result.status, accepted ? 0 : 1, result.stdout + result.stderr);
81 } finally {
82 fs.rmSync(root, { recursive: true, force: true });
83 }
84 });
85 }
86
87 const releaseVerifier = fs.readFileSync('scripts/release/macos/verify.sh', 'utf8');
88 const executablePaths = [
89 'Contents/MacOS/Knowtation',
90 'Contents/Helpers/knowtation',
91 'Contents/Helpers/knowtation-mcp',
92 'Contents/Resources/runtime/node/bin/node',
93 ];
94 const architectureChecks = releaseVerifier.match(/^lipo .*$/gm) ?? [];
95
96 test('release executable checks put each input before the lipo architecture list', () => {
97 assert.deepEqual(architectureChecks, executablePaths.map((file) =>
98 `lipo "$app/${file}" -verify_arch arm64`));
99 assert.ok(releaseVerifier.includes("plutil -extract 'com\\.apple\\.application-identifier' raw"));
100 assert.ok(releaseVerifier.includes('plutil -extract keychain-access-groups.0 raw'));
101 });
102
103 test('release executable checks accept arm64 and reject an absent architecture with real lipo', {
104 skip: process.platform === 'darwin' ? false : 'requires macOS lipo and clang',
105 }, () => {
106 assert.equal(architectureChecks.length, executablePaths.length);
107 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'knowtation-lipo-'));
108 try {
109 const fixture = path.join(root, 'arm64.o');
110 const compiled = spawnSync('/usr/bin/xcrun', [
111 'clang', '-arch', 'arm64', '-x', 'c', '-c', '-o', fixture, '-',
112 ], { encoding: 'utf8', input: 'int architecture_fixture(void) { return 0; }\n' });
113 assert.ifError(compiled.error);
114 assert.equal(compiled.signal, null);
115 assert.equal(compiled.status, 0, compiled.stdout + compiled.stderr);
116 const architectures = spawnSync('/usr/bin/lipo', [fixture, '-archs'], { encoding: 'utf8' });
117 assert.ifError(architectures.error);
118 assert.equal(architectures.status, 0, architectures.stdout + architectures.stderr);
119 assert.equal(architectures.stdout.trim(), 'arm64');
120
121 const app = path.join(root, 'Knowtation fixture.app');
122 for (const file of executablePaths) {
123 const target = path.join(app, file);
124 fs.mkdirSync(path.dirname(target), { recursive: true });
125 fs.copyFileSync(fixture, target);
126 }
127 for (const check of architectureChecks) {
128 for (const [command, expectedStatus] of [
129 [check, 0],
130 [check.replace('-verify_arch arm64', '-verify_arch x86_64'), 1],
131 ]) {
132 // Execute the verifier's actual invocation with Apple's lipo, without running the release verifier.
133 const result = spawnSync('/bin/bash', ['-euo', 'pipefail', '-c', command], {
134 encoding: 'utf8',
135 env: { ...process.env, app, PATH: '/usr/bin:/bin:/usr/sbin:/sbin' },
136 });
137 assert.ifError(result.error);
138 assert.equal(result.signal, null);
139 assert.equal(result.status, expectedStatus, `${command}\n${result.stdout}${result.stderr}`);
140 }
141 }
142 } finally {
143 fs.rmSync(root, { recursive: true, force: true });
144 }
145 });
File History 1 commit
sha256:c88bf098b52c796e46edc39ec71f9f0627d305439b73972d3fada73cefde0da9 fix: put release binaries before lipo architecture checks Human minor ⚠ 24 days ago