From 0ddcc5e935f372dd9e6533f33ce7462ce6e5514a Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Sun, 9 Aug 2026 00:41:53 +0800
Subject: [PATCH] =?UTF-8?q?fix(client/macos):=20CI=20=E9=87=8D=E7=AD=BE=20?=
 =?UTF-8?q?sysext=20entitlements=20=E8=A1=A5=20network.client/server=20+?=
 =?UTF-8?q?=20=E9=97=B8=E6=96=AD=E8=A8=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v1.1.2 事故第二弹:inside-out 重签的 sysext heredoc 漏了
com.apple.security.network.client/server —— 沙箱扩展无权对外建连,
隧道起了也连不上节点(本地 Xcode 直签用仓库 PacketTunnel.entitlements
带这两键,故 local_test 流程正常,唯 CI 包不通)。

- compile-macos.sh / local_test.sh cmd_sign:sysext heredoc 补两键(与仓库源文件对齐)
- 公证前一致性闸扩展:断言 sysext 最终签名 network.client/server=true,重签丢键即 fail
- 已本地验证:对 v1.1.2 发布包用新 entitlements 重签,读回签名两键在位

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD
---
 scripts/ci/compile-macos.sh | 10 ++++++++++
 scripts/local_test.sh       | 11 +++++++++++
 2 files changed, 21 insertions(+)

diff --git a/scripts/ci/compile-macos.sh b/scripts/ci/compile-macos.sh
index c5d276e..75aa601 100755
--- a/scripts/ci/compile-macos.sh
+++ b/scripts/ci/compile-macos.sh
@@ -225,6 +225,10 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连/收发(同仓库 PacketTunnel.entitlements)。
+	     曾漏掉这两键 → 隧道扩展被沙箱拒绝出站,连不上节点(v1.1.2 事故,连上隧道但不通)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -275,6 +279,12 @@ case "$MACH" in
   "${APP_GROUP}"*) ;;
   *) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
 esac
+# 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+SE_NC="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+SE_NS="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+echo "    sysext network.client=${SE_NC:-<missing>} network.server=${SE_NS:-<missing>}"
+[ "$SE_NC" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点" >&2; exit 1; }
+[ "$SE_NS" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.server" >&2; exit 1; }
 echo "    OK: ${APP_GROUP}"
 
 # ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────
diff --git a/scripts/local_test.sh b/scripts/local_test.sh
index dffa965..1f87af1 100755
--- a/scripts/local_test.sh
+++ b/scripts/local_test.sh
@@ -112,6 +112,10 @@ PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连(同仓库 PacketTunnel.entitlements;
+	     v1.1.2 CI 重签漏掉这两键 → 隧道连不上节点)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -142,6 +146,13 @@ verify_app_group(){
     "$APP_GROUP"*) ;;
     *) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;;
   esac
+  # 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+  local se_nc se_ns
+  se_nc="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  se_ns="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  echo "  sysext network.client=${se_nc:-<缺失>} network.server=${se_ns:-<缺失>}"
+  [ "$se_nc" = "true" ] || die "sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点"
+  [ "$se_ns" = "true" ] || die "sysext 缺 com.apple.security.network.server"
   echo "  ✅ 一致($APP_GROUP)"
 }