[2106 by GPT-5.6 Sol] Darwin ARM64 packaged reprobe: preserve OS Safe Storage identity across launches - #2108
Conversation
![propr-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…e OS Safe St Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
|
/ultrafix goal=9 max=3 |
|
🔄 Ultrafix loop started (goal: 9/10, max cycles: 3) First action:
|
|
Both native Darwin packaged jobs are now stuck for more than 20 minutes inside the new signing wrapper, versus the prior 1–3 minute complete lanes. This is a merge blocker independent of the Safe Storage objective. Keep this PR and exact transport base; do not merge or touch Linux/Windows/production signing. Add fixed, secret-free setup stage markers before and after every potentially blocking phase: key/certificate generation, keychain creation/selection, trust installation, identity import, partition-list update, application signing, initial signature verification, pair/reprobe journey, stable signature verification, trust removal, keychain restoration/deletion, and temporary-file cleanup. Each marker must contain only an allowlisted stage and STARTED/PASSED/FAILED code. Bound every external security/openssl/codesign/sign/verify operation and the complete wrapper. On macOS do not assume GNU timeout exists; use a tested Node child-process helper or an equivalently robust mechanism that terminates the owned child/process group, drains bounded output, preserves the primary failure, and still runs the EXIT cleanup. Never print command arguments or secret values. Do not merely lengthen the 45-minute job timeout. Diagnose and remove the actual noninteractive hang, especially any trust, keychain ACL/partition, or nested codesign prompt. Preserve the certificate-backed designated requirement and real os-protected two-process Safe Storage proof. Add direct timeout/cleanup/marker tests, rerun focused gates, and publish the correction to this existing PR. The AI label was already present before this comment. |
|
✅ Applied the requested follow-up changes in commit a4988eb Summary of ChangesImplemented the Darwin-only PR correction without touching Linux, Windows, or production signing. Key changes:
Verification:
🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…Linux, Windows, or production signing. Implemented the Darwin-only PR correction without touching Linux, Windows, or production signing. Key changes: - Added allowlisted `STARTED/PASSED/FAILED` markers for all 12 requested phases in [run-packaged-darwin-connect-smoke.sh](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T14-05-12/apps/desktop/scripts/run-packaged-darwin-connect-smoke.sh:29). - Added a Node process-group supervisor with bounded output, TERM/KILL escalation, signal propagation, redacted diagnostics, and cleanup grace in [run-bounded-darwin-command.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T14-05-12/apps/desktop/scripts/run-bounded-darwin-command.mjs:41). - Bounded every setup, signing, verification, journey, and cleanup operation, plus the complete Darwin wrapper. - Removed the signing hot path by enabling inside-out batched `codesign` calls and disabling irrelevant provisioning-profile work in [sign-darwin-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T14-05-12/apps/desktop/scripts/sign-darwin-packaged-connect.mjs:19). - Added per-command verification timeouts in [verify-darwin-packaged-connect-signature.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T14-05-12/apps/desktop/scripts/verify-darwin-packaged-connect-signature.mjs:11). - Preserved the certificate-bound designated requirement and real two-process `os-protected` Safe Storage journey. Verification: - Focused marker/timeout/cleanup/signature tests: 16 passed. - Full desktop suite: 443 tests, 418 passed, 25 platform skips. - Desktop typecheck passed. - Shell syntax and `git diff --check` passed. - No visual preview created because this is CI-only. PR: #2108 Comment by: @integry (ID: 5541584292) Model: gpt-5.6-sol
|
The fresh Darwin ARM64 run now fails deterministically at TRUST_INSTALLATION: security add-trusted-cert -r trustRoot -p codeSign -k DISPOSABLE_KEYCHAIN ROOT_CERT reaches the 30s bound. Cleanup markers all pass, so the hang is isolated and signing is never reached. Please implement the smallest macOS-only correction that removes this blocking trust mutation while preserving the actual goal: a stable, explicit code-signing identity/designated requirement across the pair and fresh reprobe launches so Electron Safe Storage sees the same app identity. Prefer importing and selecting the disposable signing identity without changing trust settings if codesign can use it directly; otherwise use a non-interactive ephemeral signing approach that proves stable identity. Keep the fixed stage markers and bounded commands, keep strict signature/designated-requirement verification before and after the journey, keep all cleanup/restoration guarantees, and do not touch production signing, secrets, Linux behavior, or Windows behavior. Add focused tests for the revised non-interactive path and run the current Darwin ARM64 packaged journey. |
|
🛑 Execution Cancelled The task processing was stopped by user request. You can post a new comment to restart processing. |
|
Independent audit found two additional merge blockers in current head a4988eb. Please incorporate them in this correction (if the current run has already moved past a point where it can consume this, process this as the immediate next follow-up):
Keep output bounded/secret-safe and preserve all other scope constraints from the prior comment. |
|
✅ Applied the requested follow-up changes in commit d585e76 Summary of ChangesImplemented both merge-blocker corrections without committing.
Verification:
The native Darwin packaged journey remains CI-only on this Linux worker. No visual preview was created because the changes are non-visual. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Implemented both merge-blocker corrections without committing. - Process supervision now retains a dedicated group leader through timeout escalation, preventing PGID reuse and ensuring SIGKILL reaches TERM-ignoring descendants. Added a regression test proving descendant termination. - Removed all trust installation/removal mutations. Signing directly selects the imported disposable certificate fingerprint, while verification still enforces the unique certificate, strict deep signature, and stable designated requirement. - Updated fixed stage and cleanup contracts accordingly. Verification: - Focused tests: 17/17 passed - Desktop suite: 420 passed, 25 platform skips - Desktop/UI typechecks passed - ESLint, shell syntax, and `git diff --check` passed The native Darwin packaged journey remains CI-only on this Linux worker. No visual preview was created because the changes are non-visual. PR: #2108 Comment by: @integry (ID: 5541881164) Model: gpt-5.6-sol
|
/merge |
|
🔀 Auto-merged No conflicts were found — the merge was verified by an AI agent. 🤖 Verification Details
System-triggered merge conflict resolution |
… into 2106/gpt-5.6-sol-darwin-arm64-packaged-rep-20260904-1325-wuu
|
Current combined head 3f4424f (and pre-merge d585e76) fails natively on Darwin ARM64 at APPLICATION_SIGNING immediately after identity import and partition ACL succeed. The current PKCS#12 contains only a leaf issued by a generated root; that root is neither imported nor trusted, and osx-sign suppresses the actionable error. The no-trust signing path is therefore not yet valid. Please implement the smallest CI-only non-interactive correction and prove it on native Darwin. First make the disposable signing identity internally complete without trust mutation: prefer the already-investigated one-day self-signed code-signing leaf (private key + codeSigning EKU) imported as PKCS#12 and selected by exact SHA1, or otherwise include the complete chain. If osx-sign remains the obstacle, use a bounded direct codesign path with the explicit keychain, exact identity fingerprint, no timestamp, inside-out/deep handling, and the same certificate-bound designated requirement. Do not restore add-trusted-cert or any user/system trust mutation. If certificate-backed signing truly cannot work without trust, use a CI-only stable ad-hoc signature with an explicit fixed designated requirement only if the real pair plus fresh-reprobe Safe Storage journey proves os-protected continuity on both architectures. Add secret-safe classified diagnostics sufficient to distinguish missing identity/chain, trust rejection, requirements failure, and codesign failure without emitting command output, paths, passwords, fingerprints, or environment values. Preserve strict before/after verification, process-group cleanup guarantees, production signing isolation, and Linux/Windows behavior. Run focused tests and let the native Darwin x64 and ARM64 packaged jobs be authoritative. |
|
✅ Applied the requested follow-up changes in commit 589e10e Summary of ChangesImplemented the CI-only Darwin correction without trust mutation.
Verification:
Native Darwin execution could not run on this Linux x64 worker. The existing Darwin x64 and ARM64 packaged jobs must provide the authoritative native signing and Safe Storage proof. No commit was created. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
|
Independent audit found one remaining process-supervisor cleanup blocker on combined head 3f4424f: the timeout path is fixed, but a nonzero command exit can still strand a TERM-ignoring descendant. Reproduction: command spawns such a descendant with ignored stdio and exits 23; the dedicated guard is released before failure classification, catch sends TERM, then finally clears the SIGKILL escalation timer, leaving the descendant alive. After the active signing correction publishes, fix all non-success exits (nonzero exit, spawn error, and output-limit/error paths as applicable) so the owned group guard remains valid until descendants are terminated and SIGKILL escalation completes. Guard against PGID reuse as on the timeout path. Add a regression for the nonzero-exit TERM-ignoring descendant and prove the PID is gone. Preserve bounded secret-safe behavior and the active signing correction. |
…ation. Implemented the CI-only Darwin correction without trust mutation. - Generates a one-day self-signed code-signing leaf and imports its private key/certificate as PKCS#12 in [run-packaged-darwin-connect-smoke.sh](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T14-50-46/apps/desktop/scripts/run-packaged-darwin-connect-smoke.sh:182). - Replaced `osx-sign` execution with bounded, inside-out direct `codesign` using the explicit keychain, exact SHA1, no timestamp, preserved metadata, certificate-bound requirement, and strict deep verification in [sign-darwin-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T14-50-46/apps/desktop/scripts/sign-darwin-packaged-connect.mjs:120). - Added fixed secret-safe diagnostics for missing identity/chain, trust rejection, requirements failure, and codesign failure. - Preserved strict before/after verification, native-artifact hashes, cleanup, production signing isolation, and existing Linux/Windows behavior. - Retained and re-proved SIGKILL escalation against TERM-ignoring descendants. Verification: - Focused tests: 22 passed - Desktop suite: 444 passed, 25 platform skips - ESLint, shell syntax, and `git diff --check`: passed - No visual preview created; this is CI-only Native Darwin execution could not run on this Linux x64 worker. The existing Darwin x64 and ARM64 packaged jobs must provide the authoritative native signing and Safe Storage proof. No commit was created. PR: #2108 Comment by: @integry (ID: 5542208980) Model: gpt-5.6-sol
|
✅ Applied the requested follow-up changes in commit bd8e61e Summary of ChangesImplemented the process-supervisor cleanup fix.
Changed: Verification:
No preview created because the change is non-visual. No commit was made. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
|
Native Darwin ARM64 job 101070723756 on 589e10e proves APPLICATION_SIGNING passes, including the signers strict deep verification, but INITIAL_SIGNATURE_VERIFICATION then emits CODESIGN_FAILURE. Cleanup passes. This localizes the remaining failure to verifier evidence/command handling, not signing itself. After the active supervisor correction, replace the fragile requirement for an Authority= line from codesign verbose output with an exact certificate-backed proof suitable for an intentionally untrusted self-signed leaf. Prefer bounded codesign certificate extraction into the existing private temporary directory, compute the extracted leaf SHA1, require it to equal the generated expected SHA1, require exactly the expected certificate evidence, reject ad-hoc signatures, retain identifier and certificate-bound designated-requirement checks, and retain strict deep codesign verification before and after the journey. Clean extracted certificate files with the existing temp cleanup. Keep diagnostics fixed/secret-safe; add focused tests for missing, ambiguous/mismatched, ad-hoc, and valid self-signed certificate evidence. Do not weaken the Safe Storage journey, add trust mutation, or touch production/Linux/Windows behavior. Native Darwin x64 and ARM64 must reach and pass PAIR_REPROBE_JOURNEY. |
Implemented the process-supervisor cleanup fix. - Nonzero exits now retain the process-group guard through TERM grace and SIGKILL escalation. - Inner command spawn errors use the same guarded cleanup path. - Unexpected supervisor errors await bounded cleanup before timers are cleared. - Added regression coverage proving a TERM-ignoring descendant exits after its parent returns 23. - Preserved bounded output, secret-safe diagnostics, and the active signing correction. Changed: - [run-bounded-darwin-command.mjs](/home/node/workspace/apps/desktop/scripts/run-bounded-darwin-command.mjs:74) - [run-bounded-darwin-command.test.mjs](/home/node/workspace/apps/desktop/scripts/run-bounded-darwin-command.test.mjs:142) Verification: - Focused supervisor/platform tests: 16 passed - Full desktop suite: 446 passed, 25 skipped - ESLint passed - `git diff --check` passed No preview created because the change is non-visual. No commit was made. PR: #2108 Comment by: @integry (ID: 5542264275) Model: gpt-5.6-sol
|
✅ Applied the requested follow-up changes in commit b9f85d5 Summary of ChangesImplemented the Darwin-only verifier correction.
Validation:
No preview was created because the change is non-visual CI infrastructure. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
|
Documentation follow-up from independent audit: the desktop README still says Darwin cleanup removes temporary trust, but the current implementation deliberately performs no trust mutation. After the active verifier correction, update that wording to describe deletion/restoration of the disposable keychain and temporary signing material without claiming trust installation/removal. Documentation only; preserve current behavior and tests. |
Implemented the Darwin-only verifier correction. - Replaced `Authority=` reliance with bounded `codesign` certificate extraction into the private temp directory. - Requires exactly one extracted X.509 leaf and an exact SHA-1 match. - Preserved ad-hoc rejection, identifier/designated-requirement binding, and strict deep verification before and after the journey. - Added focused valid self-signed, missing, ambiguous, mismatched, and ad-hoc tests. - Existing temp cleanup removes extracted certificates. Key changes: [verifier](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T15-15-03/apps/desktop/scripts/verify-darwin-packaged-connect-signature.mjs:36), [tests](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T15-15-03/apps/desktop/scripts/verify-darwin-packaged-connect-signature.test.mjs:55). Validation: - Desktop suite: 475 tests, 450 passed, 25 platform-specific skipped. - Shell syntax and `git diff --check`: passed. - Native Darwin x64/ARM64 execution requires the CI matrix and wasn’t available on this Linux worker. No preview was created because the change is non-visual CI infrastructure. PR: #2108 Comment by: @integry (ID: 5542459592) Model: gpt-5.6-sol
|
✅ Applied the requested follow-up changes in commit ad8e585 Summary of ChangesUpdated apps/desktop/README.md to describe:
Removed the inaccurate temporary-trust removal claim. No behavior or tests changed. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…es/integry/propr/pr-2108-followup-2026-09-04T15-26-51/apps/desktop/README.md:51) to describe: Updated [apps/desktop/README.md](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T15-26-51/apps/desktop/README.md:51) to describe: - Original keychain configuration restoration - Disposable keychain deletion - Temporary signing-material removal Removed the inaccurate temporary-trust removal claim. No behavior or tests changed. `git diff --check` passes; no visual preview was needed. PR: #2108 Comment by: @integry (ID: 5542577122) Model: gpt-5.6-sol
|
Native ARM64 job 101077614905 on b9f85d5 still signs successfully but fails INITIAL_SIGNATURE_VERIFICATION with CODESIGN_FAILURE. The current verifier passes certificate extraction as one argument --extract-certificates=PREFIX; on the runner this does not produce the expected certificate. Use the supported codesign argument form with --extract-certificates and PREFIX as separate arguments, and verify the generated prefix0 file before parsing. Keep the prefix private/bounded, exact-one-certificate rule, SHA1 match, ad-hoc rejection, strict deep verification, stable designated requirement, cleanup, and fixed diagnostics. Add a focused assertion for the exact spawned argv so this cannot regress, then publish a code commit to trigger the path-filtered packaged-connect workflow. Both native Darwin ARM64 and x64 must pass signing, initial verification, PAIR_REPROBE_JOURNEY, and stable verification. Do not touch trust settings, production signing, Linux, or Windows. |
|
✅ Applied the requested follow-up changes in commit a20bcd0 Summary of ChangesImplemented the Darwin verifier follow-up:
Validation:
Per instruction, I did not commit. The system-generated commit will match the workflow’s 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Implemented the Darwin verifier follow-up: - `codesign` now receives `--extract-certificates` and the prefix as separate argv entries. - Explicitly validates the sole generated `prefix0` regular file before X.509 parsing. - Added exact argv regression assertions and rejected the old `--extract-certificates=...` form. - Preserved SHA1 matching, ad-hoc rejection, deep/strict verification, stable requirements, cleanup, and diagnostics. Validation: - Full desktop suite: 475 tests, 450 passed, 25 platform skips. - `git diff --check` and Node syntax checks passed. - Only three Darwin verifier/test files changed; no trust, production signing, Linux, or Windows behavior changed. - No visual preview created because this is CI-only. Per instruction, I did not commit. The system-generated commit will match the workflow’s `apps/desktop/**` path filter; native Darwin ARM64/x64 results must be confirmed by that workflow run. PR: #2108 Comment by: @integry (ID: 5542782622) Model: gpt-5.6-sol
|
ARM64 job 101080627694 on a20bcd0 still passes APPLICATION_SIGNING but fails INITIAL_SIGNATURE_VERIFICATION with the generic CODESIGN_FAILURE. Do not continue guessing at certificate-extraction syntax. Replace the extraction dependency with a bounded native codesign requirement evaluation that directly verifies the app against an explicit expected requirement containing identifier dev.propr.desktop and certificate leaf = H EXPECTED_SHA1. This must fail for ad-hoc, wrong-leaf, wrong-identifier, or unsigned code. Retain separate display of the embedded designated requirement, require exact stability before/after, and retain ordinary --verify --deep --strict. If extraction is retained at all, it must be supplemental, not the blocker. Wrap each verifier operation/error in fixed secret-safe subcodes so CI distinguishes SIGNATURE_DISPLAY_FAILURE, EXPECTED_REQUIREMENT_FAILURE, EMBEDDED_REQUIREMENT_FAILURE, STRICT_VERIFY_FAILURE, and EVIDENCE_ASSERTION_FAILURE without raw output/paths/fingerprints. Add argv and behavior tests for valid self-signed, ad-hoc, wrong leaf, wrong identifier, missing/ambiguous evidence, and stable requirement. Preserve all cleanup/no-trust/production isolation constraints. Trigger fresh native ARM64/x64; both must reach and pass the real PAIR_REPROBE_JOURNEY and STABLE_SIGNATURE_VERIFICATION. |
|
✅ Applied the requested follow-up changes in commit e9fd5d1 Summary of ChangesImplemented the Darwin verifier follow-up.
Validation:
The system-generated commit will trigger the path-filtered native ARM64/x64 workflow; those real journey results cannot run on this Linux worker. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Implemented the Darwin verifier follow-up. - Replaced certificate extraction with bounded native `codesign --verify --test-requirement` evaluation pinned to `dev.propr.desktop` and the expected leaf SHA-1. - Retained separate embedded-requirement display, byte-exact before/after stability, and ordinary `--verify --deep --strict`. - Added all five fixed secret-safe verifier diagnostics. - Added coverage for exact argv, self-signed signatures, ad-hoc/unsigned code, wrong leaf/identifier, missing/ambiguous evidence, and stability. - Preserved cleanup, no-trust, and production isolation constraints. Validation: - Focused tests: 17 passed. - Full desktop suite: 451 passed, 25 platform skips. - Syntax and `git diff --check`: passed. - Only three Darwin verifier/test files changed. - No visual preview created because this is CI-only. The system-generated commit will trigger the path-filtered native ARM64/x64 workflow; those real journey results cannot run on this Linux worker. PR: #2108 Comment by: @integry (ID: 5542901295) Model: gpt-5.6-sol
|
Native ARM64 job 101085420237 on e9fd5d1 localizes the failure exactly to EXPECTED_REQUIREMENT_FAILURE; signature display and signing pass. Correct the codesign test-requirement argv to the canonical single-option form: use one argument such as -R=identifier "dev.propr.desktop" and certificate leaf = H"EXPECTED_SHA1" (or the equivalent --test-requirement=... form), followed by the app. Do not pass --test-requirement and a second expression argument beginning with =. Preserve exact identifier/leaf binding and all other verification/diagnostic/cleanup constraints. Update the exact argv regression to reject the invalid split form, trigger fresh native x64/ARM64, and require both full pair+fresh-reprobe journeys plus stable signature verification to pass. |
|
✅ Applied the requested follow-up changes in commit 8f1554d Summary of ChangesImplemented the PR #2108 follow-up.
Verification:
No visual preview was created because this is CI-only and not user-visible. No commit was made. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Implemented the PR #2108 follow-up. - Corrected `codesign` argv to `['--verify', '-R=<exact identifier/leaf requirement>', application]` in [verify-darwin-packaged-connect-signature.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T15-56-36/apps/desktop/scripts/verify-darwin-packaged-connect-signature.mjs:120). - Updated the exact argv regression to reject the invalid split form in [verify-darwin-packaged-connect-signature.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T15-56-36/apps/desktop/scripts/verify-darwin-packaged-connect-signature.test.mjs:133). - Strengthened platform contracts for native x64/ARM64, separate pair/reprobe launches, and stable verification afterward in [packaged-connect-platform.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T15-56-36/apps/desktop/scripts/packaged-connect-platform.test.mjs:85). Verification: - Desktop suite: 476 tests, 451 passed, 25 platform-specific skipped, 0 failed. - `git diff --check`: passed. - Native Darwin jobs will trigger when the system commits/publishes these path-filtered changes. No visual preview was created because this is CI-only and not user-visible. No commit was made. PR: #2108 Comment by: @integry (ID: 5543086525) Model: gpt-5.6-sol
|
ARM64 job 101088960185 on 8f1554d still fails EXPECTED_REQUIREMENT_FAILURE with canonical single-argument -R, while signing passes. This is now an ARM/untrusted-certificate requirement-evaluation semantic, not argv syntax. Stop using -R as the leaf proof. Implement separate bounded verifier operations: (1) codesign -d --verbose=4 APP for non-ad-hoc/identifier metadata; (2) a separate codesign -d --extract-certificates PREFIX APP operation, not combined with verbose display; (3) require exactly prefix0 as a regular file, parse it, and match its SHA1 exactly to EXPECTED_SHA1; (4) codesign -d -r- APP and require exact certificate-bound designated requirement plus byte-exact before/after stability; (5) codesign --verify --deep --strict APP. Use a distinct fixed CERTIFICATE_EXTRACTION_FAILURE subcode for the extraction command and preserve existing secret-safe subcodes for other operations. Clean all prefix files in the existing private temp cleanup. Tests must assert the two display/extraction commands are separate, exact argv, exact-one leaf, mismatch/ad-hoc/identifier rejection, and stability. No trust mutation or production/Linux/Windows changes. Fresh Darwin x64/ARM64 must reach and pass PAIR_REPROBE_JOURNEY and STABLE_SIGNATURE_VERIFICATION. |
|
✅ Applied the requested follow-up changes in commit 2da9a0a Summary of ChangesImplemented the Darwin-only verifier follow-up.
Validation:
🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Implemented the Darwin-only verifier follow-up. - Removed `-R` requirement evaluation. - Added separate bounded metadata and certificate-extraction commands with exact argv. - Requires exactly `prefix0` as a regular, parseable certificate and matches its SHA1. - Added `CERTIFICATE_EXTRACTION_FAILURE`. - Enforces exact certificate-bound designated requirements and byte-stable reprobe evidence. - Uses separate private initial/stable prefixes cleaned by existing temp-root cleanup. - Preserved strict deep verification and existing diagnostics. Validation: - Desktop script suite: 222 tests, 198 passed, 24 platform skips, 0 failures. - ESLint passed. - Shell syntax and `git diff --check` passed. - Native Darwin execution remains for x64/ARM64 CI. - No visual preview created because the change is CI-only. PR: #2108 Comment by: @integry (ID: 5543237359) Model: gpt-5.6-sol
|
ARM64 job 101093272023 on 2da9a0a localizes the failure to CERTIFICATE_EXTRACTION_FAILURE; signing and signature display pass. macOS ARM rejects both -R evaluation and codesign extraction for this intentionally untrusted self-signed identity. Stop iterating those operations. Use the portable proof chain: (1) bounded security find-certificate -a -Z against the disposable keychain and require exactly the generated SHA1; (2) separate codesign -d --verbose=4 and require exact Identifier=dev.propr.desktop, reject Signature=adhoc, and require a positive numeric Signature size; (3) codesign -d -r- and require the exact embedded designated requirement containing the expected leaf SHA1, with byte-exact before/after stability; (4) codesign --verify --deep --strict; (5) the real pair plus fresh-reprobe journey must report os-protected and prove credential continuity. Together with the direct signer selecting the same exact SHA1, this proves certificate-backed identity without Authority, -R, extraction, or trust mutation. Remove extraction files/subcodes and stale EXPECTED_REQUIREMENT_FAILURE if now unused. Preserve fixed secret-safe diagnostics for certificate lookup, signature display/evidence, embedded requirement, and strict verification. Add focused tests for duplicate/wrong keychain fingerprint, ad-hoc/zero-or-missing signature size, wrong identifier/leaf, unstable requirement, and strict failure. Native x64/ARM64 must pass the full journey and stable verification. |
|
✅ Applied the requested follow-up changes in commit e4fea05 Summary of ChangesImplemented the PR #2108 follow-up without committing.
Validation passed:
Native macOS x64/ARM64 execution requires the PR’s CI runners and was not available on this Linux host. No preview was created because the changes are CI-only and not visually perceptible. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Implemented the PR #2108 follow-up without committing. - Replaced certificate extraction and `-R` evaluation with bounded keychain SHA-1 lookup, signature metadata validation, exact designated-requirement evidence, and strict verification in [verify-darwin-packaged-connect-signature.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2108-followup-2026-09-04T16-21-41/apps/desktop/scripts/verify-darwin-packaged-connect-signature.mjs:18). - Removed extraction prefixes and obsolete diagnostics from the Darwin wrapper. - Enforced an explicit `os-protected` journey report while retaining fresh-process credential continuity checks. - Added all requested negative tests. Validation passed: - Desktop/UI typechecks - Full desktop suite: 453 passed, 25 platform-specific skipped - Focused suite: 54 passed - Shell syntax and `git diff --check` Native macOS x64/ARM64 execution requires the PR’s CI runners and was not available on this Linux host. No preview was created because the changes are CI-only and not visually perceptible. PR: #2108 Comment by: @integry (ID: 5543406076) Model: gpt-5.6-sol
1 participant
AI Implementation Summary
Closes #2106
Branch:
2106/gpt-5.6-sol-darwin-arm64-packaged-rep-20260904-1325-wuuCommits: ✅ Changes committed (cd85679)
AI Processing Completed
Execution Details:
Summary:
Implemented the Darwin packaged Connect identity fix.
os-protectedstorage.This matches Electron’s documented requirement for a valid, consistent macOS signature for
safeStorage; the generated certificate also meets Apple’s trust-chain and code-signing EKU requirements. Electron documentation, Apple TN3161Verification passed:
The native packaged launch requires the macOS matrix and could not run on this Linux worker. No visual preview was created because the change is CI-only.
Detailed Logs:
01a06c99-9f69-7f22-809f-5b82d915e124Log files stored at:
/tmp/claude-logs/issue-2106-2026-09-04T13-42-07-650Z-conversation.json/tmp/claude-logs/issue-2106-2026-09-04T13-42-07-650Z-output.txtLatest Conversation Messages
This PR was created automatically by ProPR after processing issue #2106.
💡 Need changes?
Comment on this PR to request refinements — the AI agent monitors comments and will update the implementation based on your feedback. Keep iterating until you're satisfied!