fix(macos): sign nested runner code so the host runner app can launch - #1979
Conversation
Size Report
npm unpacked components
Startup median (7 runs, lower is better):
Top changed chunks:
Top changed packed files
|
|
Blocking: do not sign with |
|
Addressed the signing-safety finding in 463643f: embedded Apple test-support items are now signed explicitly bottom-up, the parent app is signed last, and signing-time |
thymikee
added
the
ready-for-human
|
Follow-up |
|
CI diagnosis: Typecheck and FreeRange both fail on the same deterministic Android error from current Focused main hotfix: #1980. Once that lands, re-running/rebasing this PR should clear these unrelated gates. |
macOS runner builds pass CODE_SIGNING_ALLOWED=NO, so Xcode embeds
Testing/XCTest/XCUIAutomation.framework without re-signing them while the
embed step drops their sealed Modules/*.swiftinterface entries. Those three
nested seals are therefore always broken in a fresh macOS build.
repairMacOsRunnerProductsIfNeeded signed only the outer bundle, which leaves
the nested seals untouched. `codesign --verify --deep --strict` kept failing,
macOS refused to launch the app ("AgentDeviceRunnerUITests-Runner.app is
damaged and can't be opened"), and the runner was killed before it could
establish a connection. codesign still exited 0, so the repair reported
success on every attempt while fixing nothing.
Sign with --deep so nested code is re-sealed, and re-verify afterwards so a
repair that repairs nothing raises RUNNER_PRODUCT_REPAIR_FAILED instead of
passing silently. The runner is ad-hoc signed with no entitlements, so --deep
discards nothing.
…ures The suite redirects TMPDIR per run and removes it after every worker, so the hand-rolled afterEach cleanup was redundant. Use mkdtempForTestSync like the sibling runner tests do.
a2963e2 to
7207e96
Compare
|
1 participant
Summary
Repair unsigned macOS runner products by signing their embedded Apple test-support code explicitly, then signing the parent app.
The repair preserves identifiers, entitlements, flags, and hardened-runtime metadata while allowing codesign to regenerate designated requirements for the ad-hoc identity. It avoids deprecated signing-time
--deep; deep traversal remains verification-only.Post-repair strict verification is retained so an invalid cached or freshly built product cannot be reported as repaired.
Validation
--force --deepimplementation, then pass after the repair.pnpm check:affected --run: format, lint, typecheck, layering, fallow, build, and 2,317/2,318 related tests passed; the sole timeout passed in isolation in 126 ms and is unrelated to this two-file change.pnpm build:xcuitest:macosproduct passedcodesign --verify --deep --strict, including its nested.xctestbundle and all embedded test-support items.