fix(client/macos): CI 重签 App Group 修回 macOS 原生格式 + 公证前一致性闸
compile-macos.sh 的 sysext entitlements 曾硬编码 iOS 风格 group. 前缀,且主 app entitlements 缺 application-groups —— 与 NEMachServiceName 前缀对不上, nesessionmanager 报 Code=6,sysextd 当场卸载新扩展,线上包永远建不出 VPN 配置 (本地 Xcode 直签流程正常,故长期未察觉;详见 todo #28)。 - compile-macos.sh: 两处 entitlements 改用 ${APP_GROUP};公证前加一致性闸 (读最终签名核对 app/sysext App Group 与 NEMachServiceName 前缀,不一致即 fail) - local_test.sh: 同款修复 + verify_app_group 闸 + cmd_bump_build 自动递增 sysext 构建号 + macos 一条龙子命令(bump→build→闸→公证→装→跑) - pbxproj: CURRENT_PROJECT_VERSION 53→55(本地已构建两次,保持单调) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD
This commit is contained in:
wangjia
@@ -659,7 +659,7 @@
|
||||
baseConfigurationReference = C57BBFD43F9175D1E23685EF /* Pods-RunnerTests.debug.xcconfig */;
|
||||
buildSettings = {
|
||||
BUNDLE_LOADER = "$(TEST_HOST)";
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
MARKETING_VERSION = 1.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
|
||||
@@ -674,7 +674,7 @@
|
||||
baseConfigurationReference = F8904897A48DC81799B8752E /* Pods-RunnerTests.release.xcconfig */;
|
||||
buildSettings = {
|
||||
BUNDLE_LOADER = "$(TEST_HOST)";
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
MARKETING_VERSION = 1.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
|
||||
@@ -689,7 +689,7 @@
|
||||
baseConfigurationReference = B21E68FC1F5D33DD67A0DF5E /* Pods-RunnerTests.profile.xcconfig */;
|
||||
buildSettings = {
|
||||
BUNDLE_LOADER = "$(TEST_HOST)";
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
MARKETING_VERSION = 1.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
|
||||
@@ -960,7 +960,7 @@
|
||||
CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
|
||||
CODE_SIGN_IDENTITY = "Apple Development";
|
||||
CODE_SIGN_STYLE = Automatic;
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
DEVELOPMENT_TEAM = BYL4KQHMTN;
|
||||
ENABLE_APP_SANDBOX = YES;
|
||||
ENABLE_HARDENED_RUNTIME = YES;
|
||||
@@ -1010,7 +1010,7 @@
|
||||
CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
|
||||
CODE_SIGN_IDENTITY = "Developer ID Application";
|
||||
CODE_SIGN_STYLE = Manual;
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
DEVELOPMENT_TEAM = BYL4KQHMTN;
|
||||
ENABLE_APP_SANDBOX = YES;
|
||||
ENABLE_HARDENED_RUNTIME = YES;
|
||||
@@ -1059,7 +1059,7 @@
|
||||
CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
|
||||
CODE_SIGN_IDENTITY = "Apple Development";
|
||||
CODE_SIGN_STYLE = Automatic;
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
DEVELOPMENT_TEAM = BYL4KQHMTN;
|
||||
ENABLE_APP_SANDBOX = YES;
|
||||
ENABLE_HARDENED_RUNTIME = YES;
|
||||
|
||||
@@ -192,6 +192,12 @@ SE="${APP}/Contents/Library/SystemExtensions/${SYSEXT_BUNDLE_ID}.systemextension
|
||||
[ -d "$SE" ] || { echo "ERROR: sysext bundle not found: ${SE}" >&2; exit 1; }
|
||||
|
||||
# ── [6/7] inside-out 重签（sysext → app frameworks → app），同 local_test.sh cmd_sign ──
|
||||
# ⚠️ 这两份 entitlements 是最终产物的**真相源**——codesign --force 会覆盖 Xcode 用
|
||||
# 仓库 .entitlements 打的签名。两边的 application-groups 必须同为 ${APP_GROUP}
|
||||
# （macOS 原生格式 <TeamID>.<name>，见 CLAUDE.md），且 sysext Info.plist 的
|
||||
# NEMachServiceName 必须以它为前缀。曾因这里硬编码成 iOS 的 group. 前缀，导致
|
||||
# nesessionmanager 报 NetworkExtensionErrorDomain Code=6、sysextd 校验失败当场
|
||||
# 卸载新扩展，客户端永远建不出 VPN 配置（见 todo #28）。改这里请同步 local_test.sh。
|
||||
cat > "${WORK}/app.entitlements" <<PLIST
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
@@ -204,6 +210,8 @@ cat > "${WORK}/app.entitlements" <<PLIST
|
||||
<key>com.apple.security.app-sandbox</key><false/>
|
||||
<key>com.apple.security.network.client</key><true/>
|
||||
<key>com.apple.security.network.server</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
<key>keychain-access-groups</key>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
</dict></plist>
|
||||
@@ -218,7 +226,7 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
|
||||
<array><string>packet-tunnel-provider-systemextension</string></array>
|
||||
<key>com.apple.security.app-sandbox</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>group.com.pangolin.pangolin</string></array>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
</dict></plist>
|
||||
PLIST
|
||||
|
||||
@@ -249,6 +257,26 @@ codesign --force --options runtime --timestamp \
|
||||
codesign --verify --deep --strict --verbose=2 "$APP"
|
||||
echo "==> compile-macos: signed + verified (${IDENTITY})"
|
||||
|
||||
# ── App Group / NEMachServiceName 一致性闸（读最终签名，不是仓库源文件）──────
|
||||
# 规则没上闸 = 没有规则：这道闸就是为 todo #28 那次事故立的，放在公证前，
|
||||
# 不一致直接 fail，避免把装不上的包公证并发出去。
|
||||
echo "==> compile-macos: verifying App Group / NEMachServiceName consistency"
|
||||
codesign -d --entitlements - --xml "$APP" > "${WORK}/app.signed.plist" 2>/dev/null || true
|
||||
codesign -d --entitlements - --xml "$SE" > "${WORK}/se.signed.plist" 2>/dev/null || true
|
||||
APP_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/app.signed.plist" 2>/dev/null || true)"
|
||||
SE_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/se.signed.plist" 2>/dev/null || true)"
|
||||
MACH="$(/usr/libexec/PlistBuddy -c 'Print :NetworkExtension:NEMachServiceName' "${SE}/Contents/Info.plist" 2>/dev/null || true)"
|
||||
echo " app App Group : ${APP_G:-<missing>}"
|
||||
echo " sysext App Group : ${SE_G:-<missing>}"
|
||||
echo " NEMachServiceName: ${MACH:-<missing>}"
|
||||
[ "$APP_G" = "$APP_GROUP" ] || { echo "ERROR: app App Group 应为 ${APP_GROUP}，实为 ${APP_G:-<missing>}" >&2; exit 1; }
|
||||
[ "$SE_G" = "$APP_GROUP" ] || { echo "ERROR: sysext App Group 应为 ${APP_GROUP}，实为 ${SE_G:-<missing>}" >&2; exit 1; }
|
||||
case "$MACH" in
|
||||
"${APP_GROUP}"*) ;;
|
||||
*) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
|
||||
esac
|
||||
echo " OK: ${APP_GROUP}"
|
||||
|
||||
# ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────
|
||||
echo "==> compile-macos: notarizing (notarytool submit --wait, ~1-5min)"
|
||||
NOTARIZE_ZIP="${WORK}/notarize.zip"
|
||||
|
||||
+67
-10
@@ -11,6 +11,7 @@
|
||||
# copy 覆盖安装到 /Applications
|
||||
# run 直跑 /Applications 版本(绕 Gatekeeper,实时输出日志,并打印测试账号)
|
||||
# all 依次执行 build → sign → copy → run
|
||||
# macos 一条龙(推荐):递增构建号 → build → App Group 一致性闸 → 公证 → 装 → 跑
|
||||
#
|
||||
# ── iOS / iPad 真机(USB 连接;与上面 macOS 流程完全独立)──
|
||||
# ios-devices 列出已连接的 iOS 物理设备(拿 device id)
|
||||
@@ -38,8 +39,12 @@ IP_SVC="https://api.ipify.org" # 返回纯文本公网 IP
|
||||
# 注:DevID profile 已含 system-extension.install + NE(-systemextension 变体);
|
||||
# app/sysext entitlements 与之对齐(见 write_entitlements)。
|
||||
|
||||
# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)────────────────────────────────
|
||||
TEAM_ID="BYL4KQHMTN" # Yanmei (beijing) Technology Co., Ltd
|
||||
# macOS App Group —— 必须是原生格式 <TeamID>.<name>,不是 iOS 的 group. 前缀(CLAUDE.md 铁律)。
|
||||
# 主 app 与 sysext 必须落在**同一个**;sysext 的 NEMachServiceName 必须以它为前缀。
|
||||
APP_GROUP="${TEAM_ID}.com.pangolin.pangolin"
|
||||
|
||||
# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)────────────────────────────────
|
||||
IOS_BUNDLE_ID="com.pangolin.pangolinVpn"
|
||||
# 期望的签名主体。装机前逐字核对,不符即中止 —— 防止悄悄退回个人开发证书。
|
||||
IOS_EXPECT_SIGNER="Apple Distribution: Yanmei (beijing) Technology Co., Ltd (${TEAM_ID})"
|
||||
@@ -49,6 +54,7 @@ SRC="${BASH_SOURCE[0]}"
|
||||
DIR="${SRC%/*}"; [ "$DIR" = "$SRC" ] && DIR="."
|
||||
cd "$DIR/.."; REPO_ROOT="$PWD"
|
||||
CLIENT="$REPO_ROOT/client"
|
||||
PBXPROJ="$CLIENT/macos/Runner.xcodeproj/project.pbxproj"
|
||||
APP="$CLIENT/build/macos/Build/Products/Release/pangolin_vpn.app"
|
||||
# sysext bundle 名 = 标识符(PRODUCT_NAME=com.pangolin.pangolin.PacketTunnel,见 CLAUDE.md),
|
||||
# 不是短名 PacketTunnel.systemextension。
|
||||
@@ -73,38 +79,85 @@ find_profile(){
|
||||
return 1
|
||||
}
|
||||
|
||||
# ⚠️ 两份 entitlements 的 application-groups 必须**同值**且等于 $APP_GROUP。
|
||||
# 历史事故:sysext 这份曾硬编码成 iOS 的 group. 前缀,与 Info.plist 的
|
||||
# NEMachServiceName(<TeamID>. 前缀)对不上 → nesessionmanager 报
|
||||
# NetworkExtensionErrorDomain Code=6 → sysextd 校验失败当场卸载新扩展 →
|
||||
# VpnChannel.start() 卡在 step① 永远建不出 VPN 配置。改这里务必同步 compile-macos.sh。
|
||||
write_entitlements(){
|
||||
cat > "$WORK/app.entitlements" <<'PLIST'
|
||||
cat > "$WORK/app.entitlements" <<PLIST
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0"><dict>
|
||||
<key>com.apple.application-identifier</key><string>BYL4KQHMTN.com.pangolin.pangolin</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>BYL4KQHMTN</string>
|
||||
<key>com.apple.application-identifier</key><string>${TEAM_ID}.com.pangolin.pangolin</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>${TEAM_ID}</string>
|
||||
<key>com.apple.developer.system-extension.install</key><true/>
|
||||
<key>com.apple.developer.networking.networkextension</key>
|
||||
<array><string>packet-tunnel-provider-systemextension</string></array>
|
||||
<key>com.apple.security.app-sandbox</key><false/>
|
||||
<key>com.apple.security.network.client</key><true/>
|
||||
<key>com.apple.security.network.server</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
<key>keychain-access-groups</key>
|
||||
<array><string>BYL4KQHMTN.com.pangolin.pangolin</string></array>
|
||||
<array><string>${TEAM_ID}.com.pangolin.pangolin</string></array>
|
||||
</dict></plist>
|
||||
PLIST
|
||||
cat > "$WORK/sysext.entitlements" <<'PLIST'
|
||||
cat > "$WORK/sysext.entitlements" <<PLIST
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0"><dict>
|
||||
<key>com.apple.application-identifier</key><string>BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>BYL4KQHMTN</string>
|
||||
<key>com.apple.application-identifier</key><string>${TEAM_ID}.com.pangolin.pangolin.PacketTunnel</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>${TEAM_ID}</string>
|
||||
<key>com.apple.developer.networking.networkextension</key>
|
||||
<array><string>packet-tunnel-provider-systemextension</string></array>
|
||||
<key>com.apple.security.app-sandbox</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>group.com.pangolin.pangolin</string></array>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
</dict></plist>
|
||||
PLIST
|
||||
}
|
||||
|
||||
# ── App Group 一致性闸(装机前拦截,规则没上闸 = 没有规则)────────────────────
|
||||
# 读**最终产物的签名**(不是仓库里的 .entitlements 源文件),因为真正决定成败的是
|
||||
# 签进去的那份;Xcode 与重签脚本都可能覆盖它。
|
||||
verify_app_group(){
|
||||
[ -d "$APP" ] || die "先 build:找不到 $APP"
|
||||
[ -d "$SE" ] || die "找不到 sysext: $SE"
|
||||
log "App Group / NEMachServiceName 一致性闸"
|
||||
codesign -d --entitlements - --xml "$APP" > "$WORK/app.ents.plist" 2>/dev/null || true
|
||||
codesign -d --entitlements - --xml "$SE" > "$WORK/se.ents.plist" 2>/dev/null || true
|
||||
local app_g se_g mach
|
||||
app_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/app.ents.plist" 2>/dev/null || true)"
|
||||
se_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/se.ents.plist" 2>/dev/null || true)"
|
||||
mach="$(/usr/libexec/PlistBuddy -c 'Print :NetworkExtension:NEMachServiceName' "$SE/Contents/Info.plist" 2>/dev/null || true)"
|
||||
echo " 主 app App Group : ${app_g:-<缺失>}"
|
||||
echo " sysext App Group : ${se_g:-<缺失>}"
|
||||
echo " NEMachServiceName: ${mach:-<缺失>}"
|
||||
[ -n "$app_g" ] || die "主 app 缺 com.apple.security.application-groups —— 与扩展无法共享容器/Mach 通道"
|
||||
[ -n "$se_g" ] || die "sysext 缺 com.apple.security.application-groups"
|
||||
[ "$app_g" = "$APP_GROUP" ] || die "主 app App Group 应为 $APP_GROUP,实为 $app_g"
|
||||
[ "$se_g" = "$APP_GROUP" ] || die "sysext App Group 应为 $APP_GROUP,实为 $se_g"
|
||||
case "$mach" in
|
||||
"$APP_GROUP"*) ;;
|
||||
*) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;;
|
||||
esac
|
||||
echo " ✅ 一致($APP_GROUP)"
|
||||
}
|
||||
|
||||
# ── 递增 sysext 的 CFBundleVersion ───────────────────────────────────────
|
||||
# PacketTunnel target 不吃 FLUTTER_BUILD_NUMBER,版本号是 project.pbxproj 里写死的
|
||||
# CURRENT_PROJECT_VERSION。不递增 → sysextd 视为同版本**不更新**,装上去跑的还是旧扩展
|
||||
# (CLAUDE.md「每次构建必递增 CFBundleVersion」)。与 compile-macos.sh 同法 sed 全量替换。
|
||||
cmd_bump_build(){
|
||||
local cur next
|
||||
cur="$(grep -m1 -E 'CURRENT_PROJECT_VERSION = [0-9]+;' "$PBXPROJ" | tr -dc '0-9')"
|
||||
[ -n "$cur" ] || die "读不到 CURRENT_PROJECT_VERSION: $PBXPROJ"
|
||||
next=$((cur + 1))
|
||||
sed -i '' -E "s/CURRENT_PROJECT_VERSION = [0-9]+;/CURRENT_PROJECT_VERSION = ${next};/g" "$PBXPROJ"
|
||||
log "sysext 构建号 ${cur} → ${next}"
|
||||
}
|
||||
|
||||
cs(){ codesign --force --options runtime --timestamp "$@"; }
|
||||
|
||||
cmd_build(){
|
||||
@@ -386,10 +439,14 @@ case "${1:-}" in
|
||||
run) cmd_run ;;
|
||||
# Xcode 工程已配 Developer ID 手动签名(Release 配置),build 即出 DevID 包,无需 sign。
|
||||
all) cmd_build; cmd_notarize; cmd_copy; cmd_run ;;
|
||||
# 装机一条龙。比 all 多两步:①先递增 sysext 构建号(否则 sysextd 不换扩展)
|
||||
# ②公证前过 App Group 一致性闸(不一致直接中止,别浪费 1-5 分钟公证)。
|
||||
macos) cmd_bump_build; cmd_build; verify_app_group; cmd_notarize; cmd_copy; cmd_run ;;
|
||||
verify) verify_app_group ;; # 只跑一致性闸(不构建),排障用
|
||||
ks-baseline) cmd_ks_baseline ;; # ① VPN 断开下记录真实公网 IP
|
||||
ks-test) cmd_ks_test ;; # ② VPN 连接(killswitch 开)下杀扩展做漏测
|
||||
ks-status) cmd_ks_status ;; # 看 VPN 状态 + killswitch 配置打点日志
|
||||
ios-devices) cmd_ios_devices ;; # 列出已连接的 iOS 物理设备(拿 device id)
|
||||
ipad|ios) cmd_ipad "${2:-}" ;; # 构建 iOS release 并装到 iPad(可传设备 id/名字子串)
|
||||
*) echo "用法: $0 {all|build|sign|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;;
|
||||
*) echo "用法: $0 {macos|all|build|sign|verify|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user