Split the project into Lanework and Lanework Pro targets
Two app targets from one source tree — no build flags, no #if in shared code: an edition difference is a file one target compiles and the other does not. Base keeps everything it had (dev.rzen.indie.Kanban, minimal entitlements, AppIcon); KanbanPro compiles the same sources plus the reserved KanbanPro/ root (Git/, Remote/, Auth/ land with pro-m1 — libgit2 deliberately not added yet), adds network-client and its keychain group, and hand-writes its Info.plist with the UTI block verbatim — base exports the type, Pro imports it, one format either app opens. The unit-test sources compile twice, once per host, with Pro's module aliased so 56 test files keep @testable import Kanban unchanged; scheme Kanban stays the muscle-memory command and LaneworkPro joins it. InertGitTests pins the base posture with bytes and mtimes — a full editing session over boards carrying realistic .git trees at root and nested in a card leaves all twelve entries untouched, and moves and copies carry them verbatim. scripts/verify-editions.sh proves the rest: 26 checks over signatures, symbols, entitlements, identity, and the shared UTI, discounting Xcode's test-host exceptions by name rather than silently. Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY
This commit is contained in:
Executable
+282
@@ -0,0 +1,282 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# verify-editions.sh — the edition split, checked against the *built binaries*.
|
||||
#
|
||||
# 12-editions.md ▸ Distribution: "the editions differ at the binary level — base ships without
|
||||
# libgit2 and without the network-client entitlement". That is a claim about a signed app bundle,
|
||||
# so it cannot be a unit test: a test runs inside the app and can only report what the app's own
|
||||
# code believes. This script reads the products instead — the signature's entitlements, the Mach-O
|
||||
# load commands and symbol table, and the bundled Info.plist — and is the check the release
|
||||
# pipeline should run before either edition is submitted.
|
||||
#
|
||||
# Usage:
|
||||
# scripts/verify-editions.sh # resolves the Debug products via xcodebuild
|
||||
# scripts/verify-editions.sh <base.app> <pro.app>
|
||||
# CONFIGURATION=Release scripts/verify-editions.sh
|
||||
#
|
||||
# Exits non-zero if any check fails.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
CONFIGURATION="${CONFIGURATION:-Debug}"
|
||||
|
||||
failures=0
|
||||
checks=0
|
||||
|
||||
pass() { checks=$((checks + 1)); printf ' ok %s\n' "$1"; }
|
||||
fail() { checks=$((checks + 1)); failures=$((failures + 1)); printf ' FAIL %s\n' "$1"; }
|
||||
note() { printf ' %s\n' "$1"; }
|
||||
head2() { printf '\n%s\n' "$1"; }
|
||||
|
||||
# ---------------------------------------------------------------------------- locating the apps
|
||||
|
||||
if [ "$#" -ge 2 ]; then
|
||||
BASE_APP="$1"
|
||||
PRO_APP="$2"
|
||||
else
|
||||
products_dir="$(
|
||||
xcodebuild -project "$PROJECT_DIR/Kanban.xcodeproj" -scheme Kanban \
|
||||
-configuration "$CONFIGURATION" -destination 'platform=macOS' \
|
||||
-showBuildSettings 2>/dev/null |
|
||||
awk -F' = ' '/ BUILT_PRODUCTS_DIR = /{print $2; exit}'
|
||||
)"
|
||||
if [ -z "${products_dir:-}" ]; then
|
||||
echo "could not resolve BUILT_PRODUCTS_DIR — build first, or pass the two .app paths" >&2
|
||||
exit 2
|
||||
fi
|
||||
BASE_APP="$products_dir/Kanban.app"
|
||||
PRO_APP="$products_dir/KanbanPro.app"
|
||||
fi
|
||||
|
||||
for app in "$BASE_APP" "$PRO_APP"; do
|
||||
if [ ! -d "$app" ]; then
|
||||
echo "no app bundle at $app — build both schemes first (Kanban, LaneworkPro)" >&2
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
|
||||
BASE_BIN="$BASE_APP/Contents/MacOS/$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$BASE_APP/Contents/Info.plist")"
|
||||
PRO_BIN="$PRO_APP/Contents/MacOS/$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$PRO_APP/Contents/Info.plist")"
|
||||
|
||||
echo "Lanework edition verification ($CONFIGURATION)"
|
||||
note "base: $BASE_APP"
|
||||
note "pro: $PRO_APP"
|
||||
|
||||
# ------------------------------------------------------------------------------------ helpers
|
||||
|
||||
# The signature's entitlements as an XML plist. Reads the *signature*, not the source
|
||||
# `.entitlements` file — the whole point is that the shipped binary is what gets checked.
|
||||
entitlements_of() {
|
||||
codesign -d --entitlements - --xml "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
# The entitlement *keys* the signature actually carries, one per line. Extracted from the XML
|
||||
# rather than queried with PlistBuddy because PlistBuddy needs a seekable file, and writing the
|
||||
# signature out to a temp file only to read one key back is a step this does not need.
|
||||
entitlement_keys() {
|
||||
entitlements_of "$1" | grep -o '<key>[^<]*</key>' | sed 's/<[^>]*>//g'
|
||||
}
|
||||
|
||||
has_entitlement() {
|
||||
entitlement_keys "$1" | grep -qxF "$2"
|
||||
}
|
||||
|
||||
plist_value() {
|
||||
/usr/libexec/PlistBuddy -c "Print :$2" "$1/Contents/Info.plist" 2>/dev/null
|
||||
}
|
||||
|
||||
# Every dylib the binary and its embedded frameworks link, plus every undefined symbol — the two
|
||||
# places a libgit2 dependency can hide (dynamically linked, or statically linked and visible only
|
||||
# as defined symbols).
|
||||
linked_libraries() {
|
||||
local app="$1"
|
||||
find "$app/Contents/MacOS" "$app/Contents/Frameworks" -type f -perm -u+x 2>/dev/null |
|
||||
while read -r file; do otool -L "$file" 2>/dev/null; done
|
||||
}
|
||||
|
||||
git_symbols() {
|
||||
local bin="$1"
|
||||
# `git_` is libgit2's exported prefix (git_repository_open, git_commit_create, …). Anchored so
|
||||
# ordinary Swift symbols with "git" inside a longer name do not register.
|
||||
nm -a "$bin" 2>/dev/null | awk '{print $NF}' | grep -E '^_?git_[a-z_]+$' | sort -u
|
||||
}
|
||||
|
||||
# ------------------------------------------------------- base: no libgit2, no network, no keychain
|
||||
|
||||
head2 "Base — no git machinery"
|
||||
|
||||
base_libs="$(linked_libraries "$BASE_APP")"
|
||||
if printf '%s' "$base_libs" | grep -qiE 'git2|libgit'; then
|
||||
fail "base links a libgit2 dylib"
|
||||
printf '%s' "$base_libs" | grep -iE 'git2|libgit' | sed 's/^/ /'
|
||||
else
|
||||
pass "base links no libgit2 dylib (otool -L over the executable and embedded frameworks)"
|
||||
fi
|
||||
|
||||
base_git_syms="$(git_symbols "$BASE_BIN")"
|
||||
if [ -n "$base_git_syms" ]; then
|
||||
fail "base's symbol table contains libgit2 symbols"
|
||||
printf '%s\n' "$base_git_syms" | sed 's/^/ /'
|
||||
else
|
||||
pass "base's symbol table contains no libgit2 symbols (nm -a, /^_?git_[a-z_]+\$/)"
|
||||
fi
|
||||
|
||||
head2 "Base — entitlements"
|
||||
|
||||
if entitlements_of "$BASE_APP" | grep -q '<key>'; then
|
||||
pass "base is signed with an entitlements dictionary"
|
||||
else
|
||||
fail "base has no readable entitlements — is it signed?"
|
||||
fi
|
||||
|
||||
if has_entitlement "$BASE_APP" "com.apple.security.network.client"; then
|
||||
fail "base carries com.apple.security.network.client"
|
||||
else
|
||||
pass "base does not carry com.apple.security.network.client"
|
||||
fi
|
||||
|
||||
if has_entitlement "$BASE_APP" "keychain-access-groups"; then
|
||||
fail "base carries keychain-access-groups"
|
||||
else
|
||||
pass "base does not carry keychain-access-groups"
|
||||
fi
|
||||
|
||||
for key in com.apple.security.app-sandbox \
|
||||
com.apple.security.files.user-selected.read-write \
|
||||
com.apple.security.files.bookmarks.app-scope; do
|
||||
if has_entitlement "$BASE_APP" "$key"; then
|
||||
pass "base carries $key"
|
||||
else
|
||||
fail "base is missing $key"
|
||||
fi
|
||||
done
|
||||
|
||||
# Anything beyond the three above would be entitlement creep — base's posture is "current minimal
|
||||
# entitlements exactly" (12 ▸ Targets). Four families of key are the toolchain's, not the app's,
|
||||
# and are discounted rather than counted:
|
||||
#
|
||||
# get-task-allow Debug builds, so the debugger can attach.
|
||||
# application-identifier injected by signing when a profile is involved.
|
||||
# developer.team-identifier likewise.
|
||||
# temporary-exception.{files,mach} injected into a *test host* so the sandboxed app can load
|
||||
# XCTest. Present after `xcodebuild test`, absent from an
|
||||
# archive — which is why they are named out loud below rather
|
||||
# than quietly filtered.
|
||||
toolchain_injected='^(com\.apple\.security\.get-task-allow|com\.apple\.application-identifier|com\.apple\.developer\.team-identifier|com\.apple\.security\.temporary-exception\.[a-z.-]*)$'
|
||||
settled_minimum='^(com\.apple\.security\.app-sandbox|com\.apple\.security\.files\.user-selected\.read-write|com\.apple\.security\.files\.bookmarks\.app-scope)$'
|
||||
|
||||
base_extra="$(entitlement_keys "$BASE_APP" | grep -vE "$settled_minimum" | grep -vE "$toolchain_injected")"
|
||||
if [ -n "$base_extra" ]; then
|
||||
fail "base carries entitlements beyond the settled minimum"
|
||||
printf '%s\n' "$base_extra" | sed 's/^/ /'
|
||||
else
|
||||
pass "base carries no entitlements beyond the settled minimum"
|
||||
fi
|
||||
|
||||
base_test_exceptions="$(entitlement_keys "$BASE_APP" | grep -E '^com\.apple\.security\.temporary-exception\.')"
|
||||
if [ -n "$base_test_exceptions" ]; then
|
||||
note "(built for testing — Xcode's own test-host exceptions are present and discounted:)"
|
||||
printf '%s\n' "$base_test_exceptions" | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------- pro: the added grants
|
||||
|
||||
head2 "Pro — entitlements"
|
||||
|
||||
for key in com.apple.security.app-sandbox \
|
||||
com.apple.security.files.user-selected.read-write \
|
||||
com.apple.security.files.bookmarks.app-scope \
|
||||
com.apple.security.network.client \
|
||||
keychain-access-groups; do
|
||||
if has_entitlement "$PRO_APP" "$key"; then
|
||||
pass "pro carries $key"
|
||||
else
|
||||
fail "pro is missing $key"
|
||||
fi
|
||||
done
|
||||
|
||||
# ------------------------------------------------------------------------------ bundle identity
|
||||
|
||||
head2 "Bundle identity"
|
||||
|
||||
check_value() {
|
||||
local label="$1" actual="$2" expected="$3"
|
||||
if [ "$actual" = "$expected" ]; then
|
||||
pass "$label = $expected"
|
||||
else
|
||||
fail "$label = '$actual', expected '$expected'"
|
||||
fi
|
||||
}
|
||||
|
||||
check_value "base CFBundleIdentifier" "$(plist_value "$BASE_APP" CFBundleIdentifier)" "dev.rzen.indie.Kanban"
|
||||
check_value "pro CFBundleIdentifier" "$(plist_value "$PRO_APP" CFBundleIdentifier)" "dev.rzen.indie.KanbanPro"
|
||||
check_value "base CFBundleDisplayName" "$(plist_value "$BASE_APP" CFBundleDisplayName)" "Lanework"
|
||||
check_value "pro CFBundleDisplayName" "$(plist_value "$PRO_APP" CFBundleDisplayName)" "Lanework Pro"
|
||||
check_value "base CFBundleShortVersionString" "$(plist_value "$BASE_APP" CFBundleShortVersionString)" "2.0"
|
||||
check_value "pro CFBundleShortVersionString" "$(plist_value "$PRO_APP" CFBundleShortVersionString)" "2.0"
|
||||
|
||||
base_icon="$(plist_value "$BASE_APP" CFBundleIconName)"
|
||||
pro_icon="$(plist_value "$PRO_APP" CFBundleIconName)"
|
||||
if [ -n "$base_icon" ] && [ -n "$pro_icon" ] && [ "$base_icon" != "$pro_icon" ]; then
|
||||
pass "distinct app icon assets ($base_icon / $pro_icon)"
|
||||
else
|
||||
fail "app icon assets are not distinct (base '$base_icon', pro '$pro_icon')"
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------ the shared UTI
|
||||
|
||||
head2 "The board UTI — one format, either app"
|
||||
|
||||
# Base exports `dev.rzen.indie.kanban-board`, Pro imports the identical declaration (12 ▸
|
||||
# Distribution: "both editions declare the same .kanban package UTI verbatim … base remains the
|
||||
# exporter"). Compared as normalized plist fragments so a drifted conformance list or tag spec
|
||||
# fails here rather than in the field, where it would show up as a board that opens in one app and
|
||||
# not the other.
|
||||
uti_declaration() {
|
||||
local app="$1" key="$2"
|
||||
/usr/libexec/PlistBuddy -x -c "Print :$key" "$app/Contents/Info.plist" 2>/dev/null |
|
||||
tr -d ' \t' | grep -v '^$'
|
||||
}
|
||||
|
||||
base_uti="$(uti_declaration "$BASE_APP" UTExportedTypeDeclarations)"
|
||||
pro_uti="$(uti_declaration "$PRO_APP" UTImportedTypeDeclarations)"
|
||||
|
||||
if [ -n "$base_uti" ]; then
|
||||
pass "base exports its type declarations"
|
||||
else
|
||||
fail "base has no UTExportedTypeDeclarations"
|
||||
fi
|
||||
|
||||
if [ -n "$pro_uti" ]; then
|
||||
pass "pro imports its type declarations"
|
||||
else
|
||||
fail "pro has no UTImportedTypeDeclarations"
|
||||
fi
|
||||
|
||||
if [ "$base_uti" = "$pro_uti" ]; then
|
||||
pass "the two declarations are verbatim identical"
|
||||
else
|
||||
fail "the two declarations differ"
|
||||
diff <(printf '%s\n' "$base_uti") <(printf '%s\n' "$pro_uti") | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
for app_label in "base:$BASE_APP" "pro:$PRO_APP"; do
|
||||
label="${app_label%%:*}"
|
||||
app="${app_label#*:}"
|
||||
if /usr/libexec/PlistBuddy -c 'Print :CFBundleDocumentTypes:0:LSItemContentTypes:0' "$app/Contents/Info.plist" 2>/dev/null |
|
||||
grep -q '^dev\.rzen\.indie\.kanban-board$'; then
|
||||
pass "$label opens dev.rzen.indie.kanban-board"
|
||||
else
|
||||
fail "$label does not claim dev.rzen.indie.kanban-board as a document type"
|
||||
fi
|
||||
done
|
||||
|
||||
# ------------------------------------------------------------------------------------- verdict
|
||||
|
||||
head2 "$((checks - failures))/$checks checks passed"
|
||||
if [ "$failures" -gt 0 ]; then
|
||||
echo "EDITION VERIFICATION FAILED"
|
||||
exit 1
|
||||
fi
|
||||
echo "EDITION VERIFICATION PASSED"
|
||||
Reference in New Issue
Block a user