rzen
f37892c9a9
Two app targets from one source tree — no build flags, no #if in shared code: an edition difference is a file one target compiles and the other does not. Base keeps everything it had (dev.rzen.indie.Kanban, minimal entitlements, AppIcon); KanbanPro compiles the same sources plus the reserved KanbanPro/ root (Git/, Remote/, Auth/ land with pro-m1 — libgit2 deliberately not added yet), adds network-client and its keychain group, and hand-writes its Info.plist with the UTI block verbatim — base exports the type, Pro imports it, one format either app opens. The unit-test sources compile twice, once per host, with Pro's module aliased so 56 test files keep @testable import Kanban unchanged; scheme Kanban stays the muscle-memory command and LaneworkPro joins it. InertGitTests pins the base posture with bytes and mtimes — a full editing session over boards carrying realistic .git trees at root and nested in a card leaves all twelve entries untouched, and moves and copies carry them verbatim. scripts/verify-editions.sh proves the rest: 26 checks over signatures, symbols, entitlements, identity, and the shared UTI, discounting Xcode's test-host exceptions by name rather than silently. Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY
28 lines
1.3 KiB
XML
28 lines
1.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!-- Base's three, verbatim (Kanban/Kanban.entitlements) — the board experience is identical
|
|
across editions, so its sandbox posture is too. -->
|
|
<key>com.apple.security.app-sandbox</key>
|
|
<true/>
|
|
<key>com.apple.security.files.user-selected.read-write</key>
|
|
<true/>
|
|
<key>com.apple.security.files.bookmarks.app-scope</key>
|
|
<true/>
|
|
<!-- Pro only (12-editions.md ▸ Targets): remotes. Base ships without this key at all, which
|
|
is what makes "base cannot talk to a network" a checkable property of the signed binary
|
|
rather than a promise about the source (scripts/verify-editions.sh). -->
|
|
<key>com.apple.security.network.client</key>
|
|
<true/>
|
|
<!-- Pro only: remote auth credentials (07-sync-collab.md ▸ Auth — Keychain, SSH, TOFU).
|
|
A sandboxed app reaches its own keychain items without this key; the group is declared
|
|
so the credential store has one stable, named home from pro-m2 onward instead of an
|
|
implicit per-signature one that moves when the signing identity does. -->
|
|
<key>keychain-access-groups</key>
|
|
<array>
|
|
<string>$(AppIdentifierPrefix)dev.rzen.indie.KanbanPro</string>
|
|
</array>
|
|
</dict>
|
|
</plist>
|