vrr/openclaw
2
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-09 15:59:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 22

fix(mac): reject invalid codesign args

Browse source
This commit is contained in:
Vincent Koc 2026-06-20 21:40:44 +02:00
parent aa5fcf70f7
commit e59d0b540e
No known key found for this signature in database
2 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

18
scripts/codesign-mac-app.sh
View file

@ -1,7 +1,7 @@
#!/usr/bin/env bash
set -euo pipefail
APP_BUNDLE="${1:-dist/OpenClaw.app}"
APP_BUNDLE="dist/OpenClaw.app"
IDENTITY="${SIGN_IDENTITY:-}"
TIMESTAMP_MODE="${CODESIGN_TIMESTAMP:-auto}"
DISABLE_LIBRARY_VALIDATION="${DISABLE_LIBRARY_VALIDATION:-0}"
@ -14,7 +14,7 @@ cleanup() {
fi
}
if [[ "${APP_BUNDLE}" == "--help" || "${APP_BUNDLE}" == "-h" ]]; then
if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
cat <<'HELP'
Usage: scripts/codesign-mac-app.sh [app-bundle]
@ -28,6 +28,20 @@ HELP
exit 0
fi
if [[ "${1:-}" == "--" ]]; then
shift
fi
if [[ "$#" -gt 0 ]]; then
case "$1" in
-*) echo "ERROR: Unknown codesign option: $1" >&2; exit 1 ;;
*) APP_BUNDLE="$1"; shift ;;
esac
fi
if [[ "$#" -gt 0 ]]; then
echo "ERROR: Unexpected codesign argument: $1" >&2
exit 1
fi
if [ ! -d "$APP_BUNDLE" ]; then
echo "App bundle not found: $APP_BUNDLE" >&2
exit 1

20
test/scripts/codesign-mac-app.test.ts
View file

@ -118,6 +118,26 @@ describe("codesign-mac-app temp file hygiene", () => {
expect(entitlementTemps(tempRoot)).toEqual([]);
});
it("rejects unknown options before app validation", () => {
const tempRoot = makeTempDir("openclaw-codesign-unknown-");
const result = runCodesign(["--wat"], tempRoot);
expect(result.status).toBe(1);
expect(result.stderr.trim()).toBe("ERROR: Unknown codesign option: --wat");
expect(entitlementTemps(tempRoot)).toEqual([]);
});
it("rejects extra app bundle arguments before signing", () => {
const tempRoot = makeTempDir("openclaw-codesign-extra-");
const app = path.join(tempRoot, "Fake.app");
mkdirSync(path.join(app, "Contents", "MacOS"), { recursive: true });
const result = runCodesign([app, "extra"], tempRoot);
expect(result.status).toBe(1);
expect(result.stderr.trim()).toBe("ERROR: Unexpected codesign argument: extra");
expect(entitlementTemps(tempRoot)).toEqual([]);
});
it("cleans entitlement temp files when signing fails", () => {
const tempRoot = makeTempDir("openclaw-codesign-fail-");
const app = path.join(tempRoot, "Fake.app");