Collapse the edition split — one target, twins merged, verify-editions retired
Phase 1 of the 2026-07-30 one-app pivot (DESIGN 0bec9a6, card c3a3ddd5):
the KanbanPro target, LaneworkPro scheme, KanbanProTests module-alias
bundle, KanbanPro/ source root and scripts/verify-editions.sh retire
wholesale. project.yml reads as a single-target file again (anchors
inlined, header rewritten in tier vocabulary).
The edition twins merge: EditionTypes -> PasteboardTypes (one
UTType(exportedAs:) home — the one app owns the family types),
EditionAbout -> AboutBox (the quiet Pro signpost survives as the About
box's one line; "…in Settings" deferred until the StoreKit phase gives
it somewhere to point). InertGitTests drops its Base prefix — the
inert-.git posture is unconditional app behavior, unsubscribed and
lapsed being one state.
Entitlements gain com.apple.security.network.client, declared now and
dormant until Pro's remotes use it; no keychain access group. The App
Group key deliberately stays — it goes with AppGroup.swift in phase 2,
since pulling it first would silently drop the app into the fallback
container. README/RELEASE.md build-and-pipeline prose updated to the
one-record world; the subscription story lands with phase 3.
1893 tests in 322 suites green.
Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY
This commit is contained in:
@@ -1,323 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# verify-editions.sh — the edition split, checked against the *built binaries*.
|
||||
#
|
||||
# 12-editions.md ▸ Distribution: "the editions differ at the binary level — base ships without
|
||||
# libgit2 and without the network-client entitlement". That is a claim about a signed app bundle,
|
||||
# so it cannot be a unit test: a test runs inside the app and can only report what the app's own
|
||||
# code believes. This script reads the products instead — the signature's entitlements, the Mach-O
|
||||
# load commands and symbol table, and the bundled Info.plist — and is the check the release
|
||||
# pipeline should run before either edition is submitted.
|
||||
#
|
||||
# Usage:
|
||||
# scripts/verify-editions.sh # resolves the Debug products via xcodebuild
|
||||
# scripts/verify-editions.sh <base.app> <pro.app>
|
||||
# CONFIGURATION=Release scripts/verify-editions.sh
|
||||
#
|
||||
# Exits non-zero if any check fails.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
CONFIGURATION="${CONFIGURATION:-Debug}"
|
||||
|
||||
failures=0
|
||||
checks=0
|
||||
|
||||
pass() { checks=$((checks + 1)); printf ' ok %s\n' "$1"; }
|
||||
fail() { checks=$((checks + 1)); failures=$((failures + 1)); printf ' FAIL %s\n' "$1"; }
|
||||
note() { printf ' %s\n' "$1"; }
|
||||
head2() { printf '\n%s\n' "$1"; }
|
||||
|
||||
# ---------------------------------------------------------------------------- locating the apps
|
||||
|
||||
if [ "$#" -ge 2 ]; then
|
||||
BASE_APP="$1"
|
||||
PRO_APP="$2"
|
||||
else
|
||||
products_dir="$(
|
||||
xcodebuild -project "$PROJECT_DIR/Kanban.xcodeproj" -scheme Kanban \
|
||||
-configuration "$CONFIGURATION" -destination 'platform=macOS' \
|
||||
-showBuildSettings 2>/dev/null |
|
||||
awk -F' = ' '/ BUILT_PRODUCTS_DIR = /{print $2; exit}'
|
||||
)"
|
||||
if [ -z "${products_dir:-}" ]; then
|
||||
echo "could not resolve BUILT_PRODUCTS_DIR — build first, or pass the two .app paths" >&2
|
||||
exit 2
|
||||
fi
|
||||
BASE_APP="$products_dir/Kanban.app"
|
||||
PRO_APP="$products_dir/KanbanPro.app"
|
||||
fi
|
||||
|
||||
for app in "$BASE_APP" "$PRO_APP"; do
|
||||
if [ ! -d "$app" ]; then
|
||||
echo "no app bundle at $app — build both schemes first (Kanban, LaneworkPro)" >&2
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
|
||||
BASE_BIN="$BASE_APP/Contents/MacOS/$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$BASE_APP/Contents/Info.plist")"
|
||||
PRO_BIN="$PRO_APP/Contents/MacOS/$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$PRO_APP/Contents/Info.plist")"
|
||||
|
||||
echo "Lanework edition verification ($CONFIGURATION)"
|
||||
note "base: $BASE_APP"
|
||||
note "pro: $PRO_APP"
|
||||
|
||||
# ------------------------------------------------------------------------------------ helpers
|
||||
|
||||
# The signature's entitlements as an XML plist. Reads the *signature*, not the source
|
||||
# `.entitlements` file — the whole point is that the shipped binary is what gets checked.
|
||||
entitlements_of() {
|
||||
codesign -d --entitlements - --xml "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
# The entitlement *keys* the signature actually carries, one per line. Extracted from the XML
|
||||
# rather than queried with PlistBuddy because PlistBuddy needs a seekable file, and writing the
|
||||
# signature out to a temp file only to read one key back is a step this does not need.
|
||||
entitlement_keys() {
|
||||
entitlements_of "$1" | grep -o '<key>[^<]*</key>' | sed 's/<[^>]*>//g'
|
||||
}
|
||||
|
||||
has_entitlement() {
|
||||
entitlement_keys "$1" | grep -qxF "$2"
|
||||
}
|
||||
|
||||
plist_value() {
|
||||
/usr/libexec/PlistBuddy -c "Print :$2" "$1/Contents/Info.plist" 2>/dev/null
|
||||
}
|
||||
|
||||
# Every dylib the binary and its embedded frameworks link, plus every undefined symbol — the two
|
||||
# places a libgit2 dependency can hide (dynamically linked, or statically linked and visible only
|
||||
# as defined symbols).
|
||||
linked_libraries() {
|
||||
local app="$1"
|
||||
find "$app/Contents/MacOS" "$app/Contents/Frameworks" -type f -perm -u+x 2>/dev/null |
|
||||
while read -r file; do otool -L "$file" 2>/dev/null; done
|
||||
}
|
||||
|
||||
git_symbols() {
|
||||
local bin="$1"
|
||||
# `git_` is libgit2's exported prefix (git_repository_open, git_commit_create, …). Anchored so
|
||||
# ordinary Swift symbols with "git" inside a longer name do not register.
|
||||
nm -a "$bin" 2>/dev/null | awk '{print $NF}' | grep -E '^_?git_[a-z_]+$' | sort -u
|
||||
}
|
||||
|
||||
# ------------------------------------------------------- base: no libgit2, no network, no keychain
|
||||
|
||||
head2 "Base — no git machinery"
|
||||
|
||||
base_libs="$(linked_libraries "$BASE_APP")"
|
||||
if printf '%s' "$base_libs" | grep -qiE 'git2|libgit'; then
|
||||
fail "base links a libgit2 dylib"
|
||||
printf '%s' "$base_libs" | grep -iE 'git2|libgit' | sed 's/^/ /'
|
||||
else
|
||||
pass "base links no libgit2 dylib (otool -L over the executable and embedded frameworks)"
|
||||
fi
|
||||
|
||||
base_git_syms="$(git_symbols "$BASE_BIN")"
|
||||
if [ -n "$base_git_syms" ]; then
|
||||
fail "base's symbol table contains libgit2 symbols"
|
||||
printf '%s\n' "$base_git_syms" | sed 's/^/ /'
|
||||
else
|
||||
pass "base's symbol table contains no libgit2 symbols (nm -a, /^_?git_[a-z_]+\$/)"
|
||||
fi
|
||||
|
||||
head2 "Base — entitlements"
|
||||
|
||||
if entitlements_of "$BASE_APP" | grep -q '<key>'; then
|
||||
pass "base is signed with an entitlements dictionary"
|
||||
else
|
||||
fail "base has no readable entitlements — is it signed?"
|
||||
fi
|
||||
|
||||
if has_entitlement "$BASE_APP" "com.apple.security.network.client"; then
|
||||
fail "base carries com.apple.security.network.client"
|
||||
else
|
||||
pass "base does not carry com.apple.security.network.client"
|
||||
fi
|
||||
|
||||
if has_entitlement "$BASE_APP" "keychain-access-groups"; then
|
||||
fail "base carries keychain-access-groups"
|
||||
else
|
||||
pass "base does not carry keychain-access-groups"
|
||||
fi
|
||||
|
||||
for key in com.apple.security.app-sandbox \
|
||||
com.apple.security.files.user-selected.read-write \
|
||||
com.apple.security.files.bookmarks.app-scope \
|
||||
com.apple.security.application-groups; do
|
||||
if has_entitlement "$BASE_APP" "$key"; then
|
||||
pass "base carries $key"
|
||||
else
|
||||
fail "base is missing $key"
|
||||
fi
|
||||
done
|
||||
|
||||
# Anything beyond the three above would be entitlement creep — base's posture is "current minimal
|
||||
# entitlements exactly" (12 ▸ Targets). Four families of key are the toolchain's, not the app's,
|
||||
# and are discounted rather than counted:
|
||||
#
|
||||
# get-task-allow Debug builds, so the debugger can attach.
|
||||
# application-identifier injected by signing when a profile is involved.
|
||||
# developer.team-identifier likewise.
|
||||
# temporary-exception.{files,mach} injected into a *test host* so the sandboxed app can load
|
||||
# XCTest. Present after `xcodebuild test`, absent from an
|
||||
# archive — which is why they are named out loud below rather
|
||||
# than quietly filtered.
|
||||
toolchain_injected='^(com\.apple\.security\.get-task-allow|com\.apple\.application-identifier|com\.apple\.developer\.team-identifier|com\.apple\.security\.temporary-exception\.[a-z.-]*)$'
|
||||
settled_minimum='^(com\.apple\.security\.app-sandbox|com\.apple\.security\.files\.user-selected\.read-write|com\.apple\.security\.files\.bookmarks\.app-scope|com\.apple\.security\.application-groups)$'
|
||||
|
||||
base_extra="$(entitlement_keys "$BASE_APP" | grep -vE "$settled_minimum" | grep -vE "$toolchain_injected")"
|
||||
if [ -n "$base_extra" ]; then
|
||||
fail "base carries entitlements beyond the settled minimum"
|
||||
printf '%s\n' "$base_extra" | sed 's/^/ /'
|
||||
else
|
||||
pass "base carries no entitlements beyond the settled minimum"
|
||||
fi
|
||||
|
||||
base_test_exceptions="$(entitlement_keys "$BASE_APP" | grep -E '^com\.apple\.security\.temporary-exception\.')"
|
||||
if [ -n "$base_test_exceptions" ]; then
|
||||
note "(built for testing — Xcode's own test-host exceptions are present and discounted:)"
|
||||
printf '%s\n' "$base_test_exceptions" | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------- pro: the added grants
|
||||
|
||||
head2 "Pro — entitlements"
|
||||
|
||||
for key in com.apple.security.app-sandbox \
|
||||
com.apple.security.files.user-selected.read-write \
|
||||
com.apple.security.files.bookmarks.app-scope \
|
||||
com.apple.security.application-groups \
|
||||
com.apple.security.network.client \
|
||||
keychain-access-groups; do
|
||||
if has_entitlement "$PRO_APP" "$key"; then
|
||||
pass "pro carries $key"
|
||||
else
|
||||
fail "pro is missing $key"
|
||||
fi
|
||||
done
|
||||
|
||||
# ------------------------------------------------------------------------------ the App Group
|
||||
#
|
||||
# 12-editions.md ▸ Distribution (ruled 2026-07-29): "every edition declares the family group —
|
||||
# `group.dev.rzen.indie.Kanban` — and the board registry with its Application Support peers homes in
|
||||
# the group container **from day one**". The upgrade story is exactly this string matching across the
|
||||
# two signatures: an edition declaring a group of its own would share nothing while looking as though
|
||||
# it did, and nothing in the app could detect the difference — the container would simply be empty.
|
||||
|
||||
head2 "The App Group — one container, either app"
|
||||
|
||||
# The group ids the signature declares, one per line. Read from the signature rather than the source
|
||||
# `.entitlements` for the reason every check here does: the shipped binary is the claim.
|
||||
#
|
||||
# `sed` over the whole stream rather than a line-oriented pass, because `codesign --xml` emits the
|
||||
# entire plist on **one line** — which is also why `entitlement_keys` above reaches for `grep -o`
|
||||
# instead of PlistBuddy. The two substitutions trim everything before this key's `<array>` and
|
||||
# everything after its close, leaving only its own `<string>`s to unwrap.
|
||||
app_groups() {
|
||||
entitlements_of "$1" |
|
||||
sed -e 's/.*<key>com\.apple\.security\.application-groups<\/key><array>//' \
|
||||
-e 's/<\/array>.*//' |
|
||||
grep -o '<string>[^<]*</string>' |
|
||||
sed 's/<[^>]*>//g'
|
||||
}
|
||||
|
||||
expected_group="group.dev.rzen.indie.Kanban"
|
||||
base_groups="$(app_groups "$BASE_APP")"
|
||||
pro_groups="$(app_groups "$PRO_APP")"
|
||||
|
||||
for app_label in "base:$base_groups" "pro:$pro_groups"; do
|
||||
label="${app_label%%:*}"
|
||||
groups="${app_label#*:}"
|
||||
if [ "$groups" = "$expected_group" ]; then
|
||||
pass "$label declares exactly $expected_group"
|
||||
else
|
||||
fail "$label declares '$groups', expected '$expected_group'"
|
||||
fi
|
||||
done
|
||||
|
||||
# ------------------------------------------------------------------------------ bundle identity
|
||||
|
||||
head2 "Bundle identity"
|
||||
|
||||
check_value() {
|
||||
local label="$1" actual="$2" expected="$3"
|
||||
if [ "$actual" = "$expected" ]; then
|
||||
pass "$label = $expected"
|
||||
else
|
||||
fail "$label = '$actual', expected '$expected'"
|
||||
fi
|
||||
}
|
||||
|
||||
check_value "base CFBundleIdentifier" "$(plist_value "$BASE_APP" CFBundleIdentifier)" "dev.rzen.indie.Kanban"
|
||||
check_value "pro CFBundleIdentifier" "$(plist_value "$PRO_APP" CFBundleIdentifier)" "dev.rzen.indie.KanbanPro"
|
||||
check_value "base CFBundleDisplayName" "$(plist_value "$BASE_APP" CFBundleDisplayName)" "Lanework"
|
||||
check_value "pro CFBundleDisplayName" "$(plist_value "$PRO_APP" CFBundleDisplayName)" "Lanework Pro"
|
||||
check_value "base CFBundleShortVersionString" "$(plist_value "$BASE_APP" CFBundleShortVersionString)" "2.0"
|
||||
check_value "pro CFBundleShortVersionString" "$(plist_value "$PRO_APP" CFBundleShortVersionString)" "2.0"
|
||||
|
||||
base_icon="$(plist_value "$BASE_APP" CFBundleIconName)"
|
||||
pro_icon="$(plist_value "$PRO_APP" CFBundleIconName)"
|
||||
if [ -n "$base_icon" ] && [ -n "$pro_icon" ] && [ "$base_icon" != "$pro_icon" ]; then
|
||||
pass "distinct app icon assets ($base_icon / $pro_icon)"
|
||||
else
|
||||
fail "app icon assets are not distinct (base '$base_icon', pro '$pro_icon')"
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------ the shared UTI
|
||||
|
||||
head2 "The board UTI — one format, either app"
|
||||
|
||||
# Base exports `dev.rzen.indie.kanban-board`, Pro imports the identical declaration (12 ▸
|
||||
# Distribution: "both editions declare the same .kanban package UTI verbatim … base remains the
|
||||
# exporter"). Compared as normalized plist fragments so a drifted conformance list or tag spec
|
||||
# fails here rather than in the field, where it would show up as a board that opens in one app and
|
||||
# not the other.
|
||||
uti_declaration() {
|
||||
local app="$1" key="$2"
|
||||
/usr/libexec/PlistBuddy -x -c "Print :$key" "$app/Contents/Info.plist" 2>/dev/null |
|
||||
tr -d ' \t' | grep -v '^$'
|
||||
}
|
||||
|
||||
base_uti="$(uti_declaration "$BASE_APP" UTExportedTypeDeclarations)"
|
||||
pro_uti="$(uti_declaration "$PRO_APP" UTImportedTypeDeclarations)"
|
||||
|
||||
if [ -n "$base_uti" ]; then
|
||||
pass "base exports its type declarations"
|
||||
else
|
||||
fail "base has no UTExportedTypeDeclarations"
|
||||
fi
|
||||
|
||||
if [ -n "$pro_uti" ]; then
|
||||
pass "pro imports its type declarations"
|
||||
else
|
||||
fail "pro has no UTImportedTypeDeclarations"
|
||||
fi
|
||||
|
||||
if [ "$base_uti" = "$pro_uti" ]; then
|
||||
pass "the two declarations are verbatim identical"
|
||||
else
|
||||
fail "the two declarations differ"
|
||||
diff <(printf '%s\n' "$base_uti") <(printf '%s\n' "$pro_uti") | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
for app_label in "base:$BASE_APP" "pro:$PRO_APP"; do
|
||||
label="${app_label%%:*}"
|
||||
app="${app_label#*:}"
|
||||
if /usr/libexec/PlistBuddy -c 'Print :CFBundleDocumentTypes:0:LSItemContentTypes:0' "$app/Contents/Info.plist" 2>/dev/null |
|
||||
grep -q '^dev\.rzen\.indie\.kanban-board$'; then
|
||||
pass "$label opens dev.rzen.indie.kanban-board"
|
||||
else
|
||||
fail "$label does not claim dev.rzen.indie.kanban-board as a document type"
|
||||
fi
|
||||
done
|
||||
|
||||
# ------------------------------------------------------------------------------------- verdict
|
||||
|
||||
head2 "$((checks - failures))/$checks checks passed"
|
||||
if [ "$failures" -gt 0 ]; then
|
||||
echo "EDITION VERIFICATION FAILED"
|
||||
exit 1
|
||||
fi
|
||||
echo "EDITION VERIFICATION PASSED"
|
||||
Reference in New Issue
Block a user