From 77302cfa7a8150f471e59db612e383c524406384 Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Sat, 8 Aug 2026 23:41:36 +0800 Subject: [PATCH] =?UTF-8?q?fix(client/macos):=20CI=20=E9=87=8D=E7=AD=BE=20?= =?UTF-8?q?App=20Group=20=E4=BF=AE=E5=9B=9E=20macOS=20=E5=8E=9F=E7=94=9F?= =?UTF-8?q?=E6=A0=BC=E5=BC=8F=20+=20=E5=85=AC=E8=AF=81=E5=89=8D=E4=B8=80?= =?UTF-8?q?=E8=87=B4=E6=80=A7=E9=97=B8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit compile-macos.sh 的 sysext entitlements 曾硬编码 iOS 风格 group. 前缀,且主 app entitlements 缺 application-groups —— 与 NEMachServiceName 前缀对不上, nesessionmanager 报 Code=6,sysextd 当场卸载新扩展,线上包永远建不出 VPN 配置 (本地 Xcode 直签流程正常,故长期未察觉;详见 todo #28)。 - compile-macos.sh: 两处 entitlements 改用 ${APP_GROUP};公证前加一致性闸 (读最终签名核对 app/sysext App Group 与 NEMachServiceName 前缀,不一致即 fail) - local_test.sh: 同款修复 + verify_app_group 闸 + cmd_bump_build 自动递增 sysext 构建号 + macos 一条龙子命令(bump→build→闸→公证→装→跑) - pbxproj: CURRENT_PROJECT_VERSION 53→55(本地已构建两次,保持单调) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD --- client/macos/Runner.xcodeproj/project.pbxproj | 12 +-- scripts/ci/compile-macos.sh | 30 +++++++- scripts/local_test.sh | 77 ++++++++++++++++--- 3 files changed, 102 insertions(+), 17 deletions(-) diff --git a/client/macos/Runner.xcodeproj/project.pbxproj b/client/macos/Runner.xcodeproj/project.pbxproj index 720fb5c..b2b90ca 100644 --- a/client/macos/Runner.xcodeproj/project.pbxproj +++ b/client/macos/Runner.xcodeproj/project.pbxproj @@ -659,7 +659,7 @@ baseConfigurationReference = C57BBFD43F9175D1E23685EF /* Pods-RunnerTests.debug.xcconfig */; buildSettings = { BUNDLE_LOADER = "$(TEST_HOST)"; - CURRENT_PROJECT_VERSION = 53; + CURRENT_PROJECT_VERSION = 55; GENERATE_INFOPLIST_FILE = YES; MARKETING_VERSION = 1.0; PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests; @@ -674,7 +674,7 @@ baseConfigurationReference = F8904897A48DC81799B8752E /* Pods-RunnerTests.release.xcconfig */; buildSettings = { BUNDLE_LOADER = "$(TEST_HOST)"; - CURRENT_PROJECT_VERSION = 53; + CURRENT_PROJECT_VERSION = 55; GENERATE_INFOPLIST_FILE = YES; MARKETING_VERSION = 1.0; PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests; @@ -689,7 +689,7 @@ baseConfigurationReference = B21E68FC1F5D33DD67A0DF5E /* Pods-RunnerTests.profile.xcconfig */; buildSettings = { BUNDLE_LOADER = "$(TEST_HOST)"; - CURRENT_PROJECT_VERSION = 53; + CURRENT_PROJECT_VERSION = 55; GENERATE_INFOPLIST_FILE = YES; MARKETING_VERSION = 1.0; PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests; @@ -960,7 +960,7 @@ CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements; CODE_SIGN_IDENTITY = "Apple Development"; CODE_SIGN_STYLE = Automatic; - CURRENT_PROJECT_VERSION = 53; + CURRENT_PROJECT_VERSION = 55; DEVELOPMENT_TEAM = BYL4KQHMTN; ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; @@ -1010,7 +1010,7 @@ CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements; CODE_SIGN_IDENTITY = "Developer ID Application"; CODE_SIGN_STYLE = Manual; - CURRENT_PROJECT_VERSION = 53; + CURRENT_PROJECT_VERSION = 55; DEVELOPMENT_TEAM = BYL4KQHMTN; ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; @@ -1059,7 +1059,7 @@ CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements; CODE_SIGN_IDENTITY = "Apple Development"; CODE_SIGN_STYLE = Automatic; - CURRENT_PROJECT_VERSION = 53; + CURRENT_PROJECT_VERSION = 55; DEVELOPMENT_TEAM = BYL4KQHMTN; ENABLE_APP_SANDBOX = YES; ENABLE_HARDENED_RUNTIME = YES; diff --git a/scripts/ci/compile-macos.sh b/scripts/ci/compile-macos.sh index 4d362b1..c5d276e 100755 --- a/scripts/ci/compile-macos.sh +++ b/scripts/ci/compile-macos.sh @@ -192,6 +192,12 @@ SE="${APP}/Contents/Library/SystemExtensions/${SYSEXT_BUNDLE_ID}.systemextension [ -d "$SE" ] || { echo "ERROR: sysext bundle not found: ${SE}" >&2; exit 1; } # ── [6/7] inside-out 重签（sysext → app frameworks → app），同 local_test.sh cmd_sign ── +# ⚠️ 这两份 entitlements 是最终产物的**真相源**——codesign --force 会覆盖 Xcode 用 +# 仓库 .entitlements 打的签名。两边的 application-groups 必须同为 ${APP_GROUP} +# （macOS 原生格式 .，见 CLAUDE.md），且 sysext Info.plist 的 +# NEMachServiceName 必须以它为前缀。曾因这里硬编码成 iOS 的 group. 前缀，导致 +# nesessionmanager 报 NetworkExtensionErrorDomain Code=6、sysextd 校验失败当场 +# 卸载新扩展，客户端永远建不出 VPN 配置（见 todo #28）。改这里请同步 local_test.sh。 cat > "${WORK}/app.entitlements" < @@ -204,6 +210,8 @@ cat > "${WORK}/app.entitlements" <com.apple.security.app-sandbox com.apple.security.network.client com.apple.security.network.server + com.apple.security.application-groups + ${APP_GROUP} keychain-access-groups ${APP_GROUP} @@ -218,7 +226,7 @@ cat > "${WORK}/sysext.entitlements" <packet-tunnel-provider-systemextension com.apple.security.app-sandbox com.apple.security.application-groups - group.com.pangolin.pangolin + ${APP_GROUP} PLIST @@ -249,6 +257,26 @@ codesign --force --options runtime --timestamp \ codesign --verify --deep --strict --verbose=2 "$APP" echo "==> compile-macos: signed + verified (${IDENTITY})" +# ── App Group / NEMachServiceName 一致性闸（读最终签名，不是仓库源文件）────── +# 规则没上闸 = 没有规则：这道闸就是为 todo #28 那次事故立的，放在公证前， +# 不一致直接 fail，避免把装不上的包公证并发出去。 +echo "==> compile-macos: verifying App Group / NEMachServiceName consistency" +codesign -d --entitlements - --xml "$APP" > "${WORK}/app.signed.plist" 2>/dev/null || true +codesign -d --entitlements - --xml "$SE" > "${WORK}/se.signed.plist" 2>/dev/null || true +APP_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/app.signed.plist" 2>/dev/null || true)" +SE_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/se.signed.plist" 2>/dev/null || true)" +MACH="$(/usr/libexec/PlistBuddy -c 'Print :NetworkExtension:NEMachServiceName' "${SE}/Contents/Info.plist" 2>/dev/null || true)" +echo " app App Group : ${APP_G:-}" +echo " sysext App Group : ${SE_G:-}" +echo " NEMachServiceName: ${MACH:-}" +[ "$APP_G" = "$APP_GROUP" ] || { echo "ERROR: app App Group 应为 ${APP_GROUP}，实为 ${APP_G:-}" >&2; exit 1; } +[ "$SE_G" = "$APP_GROUP" ] || { echo "ERROR: sysext App Group 应为 ${APP_GROUP}，实为 ${SE_G:-}" >&2; exit 1; } +case "$MACH" in + "${APP_GROUP}"*) ;; + *) echo "ERROR: NEMachServiceName(${MACH:-}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;; +esac +echo " OK: ${APP_GROUP}" + # ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ────────────────── echo "==> compile-macos: notarizing (notarytool submit --wait, ~1-5min)" NOTARIZE_ZIP="${WORK}/notarize.zip" diff --git a/scripts/local_test.sh b/scripts/local_test.sh index 3f3040a..dffa965 100755 --- a/scripts/local_test.sh +++ b/scripts/local_test.sh @@ -11,6 +11,7 @@ # copy 覆盖安装到 /Applications # run 直跑 /Applications 版本(绕 Gatekeeper,实时输出日志,并打印测试账号) # all 依次执行 build → sign → copy → run +# macos 一条龙(推荐):递增构建号 → build → App Group 一致性闸 → 公证 → 装 → 跑 # # ── iOS / iPad 真机(USB 连接;与上面 macOS 流程完全独立)── # ios-devices 列出已连接的 iOS 物理设备(拿 device id) @@ -38,8 +39,12 @@ IP_SVC="https://api.ipify.org" # 返回纯文本公网 IP # 注:DevID profile 已含 system-extension.install + NE(-systemextension 变体); # app/sysext entitlements 与之对齐(见 write_entitlements)。 -# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)──────────────────────────────── TEAM_ID="BYL4KQHMTN" # Yanmei (beijing) Technology Co., Ltd +# macOS App Group —— 必须是原生格式 .,不是 iOS 的 group. 前缀(CLAUDE.md 铁律)。 +# 主 app 与 sysext 必须落在**同一个**;sysext 的 NEMachServiceName 必须以它为前缀。 +APP_GROUP="${TEAM_ID}.com.pangolin.pangolin" + +# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)──────────────────────────────── IOS_BUNDLE_ID="com.pangolin.pangolinVpn" # 期望的签名主体。装机前逐字核对,不符即中止 —— 防止悄悄退回个人开发证书。 IOS_EXPECT_SIGNER="Apple Distribution: Yanmei (beijing) Technology Co., Ltd (${TEAM_ID})" @@ -49,6 +54,7 @@ SRC="${BASH_SOURCE[0]}" DIR="${SRC%/*}"; [ "$DIR" = "$SRC" ] && DIR="." cd "$DIR/.."; REPO_ROOT="$PWD" CLIENT="$REPO_ROOT/client" +PBXPROJ="$CLIENT/macos/Runner.xcodeproj/project.pbxproj" APP="$CLIENT/build/macos/Build/Products/Release/pangolin_vpn.app" # sysext bundle 名 = 标识符(PRODUCT_NAME=com.pangolin.pangolin.PacketTunnel,见 CLAUDE.md), # 不是短名 PacketTunnel.systemextension。 @@ -73,38 +79,85 @@ find_profile(){ return 1 } +# ⚠️ 两份 entitlements 的 application-groups 必须**同值**且等于 $APP_GROUP。 +# 历史事故:sysext 这份曾硬编码成 iOS 的 group. 前缀,与 Info.plist 的 +# NEMachServiceName(. 前缀)对不上 → nesessionmanager 报 +# NetworkExtensionErrorDomain Code=6 → sysextd 校验失败当场卸载新扩展 → +# VpnChannel.start() 卡在 step① 永远建不出 VPN 配置。改这里务必同步 compile-macos.sh。 write_entitlements(){ - cat > "$WORK/app.entitlements" <<'PLIST' + cat > "$WORK/app.entitlements" < - com.apple.application-identifierBYL4KQHMTN.com.pangolin.pangolin - com.apple.developer.team-identifierBYL4KQHMTN + com.apple.application-identifier${TEAM_ID}.com.pangolin.pangolin + com.apple.developer.team-identifier${TEAM_ID} com.apple.developer.system-extension.install com.apple.developer.networking.networkextension packet-tunnel-provider-systemextension com.apple.security.app-sandbox com.apple.security.network.client com.apple.security.network.server + com.apple.security.application-groups + ${APP_GROUP} keychain-access-groups - BYL4KQHMTN.com.pangolin.pangolin + ${TEAM_ID}.com.pangolin.pangolin PLIST - cat > "$WORK/sysext.entitlements" <<'PLIST' + cat > "$WORK/sysext.entitlements" < - com.apple.application-identifierBYL4KQHMTN.com.pangolin.pangolin.PacketTunnel - com.apple.developer.team-identifierBYL4KQHMTN + com.apple.application-identifier${TEAM_ID}.com.pangolin.pangolin.PacketTunnel + com.apple.developer.team-identifier${TEAM_ID} com.apple.developer.networking.networkextension packet-tunnel-provider-systemextension com.apple.security.app-sandbox com.apple.security.application-groups - group.com.pangolin.pangolin + ${APP_GROUP} PLIST } +# ── App Group 一致性闸(装机前拦截,规则没上闸 = 没有规则)──────────────────── +# 读**最终产物的签名**(不是仓库里的 .entitlements 源文件),因为真正决定成败的是 +# 签进去的那份;Xcode 与重签脚本都可能覆盖它。 +verify_app_group(){ + [ -d "$APP" ] || die "先 build:找不到 $APP" + [ -d "$SE" ] || die "找不到 sysext: $SE" + log "App Group / NEMachServiceName 一致性闸" + codesign -d --entitlements - --xml "$APP" > "$WORK/app.ents.plist" 2>/dev/null || true + codesign -d --entitlements - --xml "$SE" > "$WORK/se.ents.plist" 2>/dev/null || true + local app_g se_g mach + app_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/app.ents.plist" 2>/dev/null || true)" + se_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/se.ents.plist" 2>/dev/null || true)" + mach="$(/usr/libexec/PlistBuddy -c 'Print :NetworkExtension:NEMachServiceName' "$SE/Contents/Info.plist" 2>/dev/null || true)" + echo " 主 app App Group : ${app_g:-<缺失>}" + echo " sysext App Group : ${se_g:-<缺失>}" + echo " NEMachServiceName: ${mach:-<缺失>}" + [ -n "$app_g" ] || die "主 app 缺 com.apple.security.application-groups —— 与扩展无法共享容器/Mach 通道" + [ -n "$se_g" ] || die "sysext 缺 com.apple.security.application-groups" + [ "$app_g" = "$APP_GROUP" ] || die "主 app App Group 应为 $APP_GROUP,实为 $app_g" + [ "$se_g" = "$APP_GROUP" ] || die "sysext App Group 应为 $APP_GROUP,实为 $se_g" + case "$mach" in + "$APP_GROUP"*) ;; + *) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;; + esac + echo " ✅ 一致($APP_GROUP)" +} + +# ── 递增 sysext 的 CFBundleVersion ─────────────────────────────────────── +# PacketTunnel target 不吃 FLUTTER_BUILD_NUMBER,版本号是 project.pbxproj 里写死的 +# CURRENT_PROJECT_VERSION。不递增 → sysextd 视为同版本**不更新**,装上去跑的还是旧扩展 +# (CLAUDE.md「每次构建必递增 CFBundleVersion」)。与 compile-macos.sh 同法 sed 全量替换。 +cmd_bump_build(){ + local cur next + cur="$(grep -m1 -E 'CURRENT_PROJECT_VERSION = [0-9]+;' "$PBXPROJ" | tr -dc '0-9')" + [ -n "$cur" ] || die "读不到 CURRENT_PROJECT_VERSION: $PBXPROJ" + next=$((cur + 1)) + sed -i '' -E "s/CURRENT_PROJECT_VERSION = [0-9]+;/CURRENT_PROJECT_VERSION = ${next};/g" "$PBXPROJ" + log "sysext 构建号 ${cur} → ${next}" +} + cs(){ codesign --force --options runtime --timestamp "$@"; } cmd_build(){ @@ -386,10 +439,14 @@ case "${1:-}" in run) cmd_run ;; # Xcode 工程已配 Developer ID 手动签名(Release 配置),build 即出 DevID 包,无需 sign。 all) cmd_build; cmd_notarize; cmd_copy; cmd_run ;; + # 装机一条龙。比 all 多两步:①先递增 sysext 构建号(否则 sysextd 不换扩展) + # ②公证前过 App Group 一致性闸(不一致直接中止,别浪费 1-5 分钟公证)。 + macos) cmd_bump_build; cmd_build; verify_app_group; cmd_notarize; cmd_copy; cmd_run ;; + verify) verify_app_group ;; # 只跑一致性闸(不构建),排障用 ks-baseline) cmd_ks_baseline ;; # ① VPN 断开下记录真实公网 IP ks-test) cmd_ks_test ;; # ② VPN 连接(killswitch 开)下杀扩展做漏测 ks-status) cmd_ks_status ;; # 看 VPN 状态 + killswitch 配置打点日志 ios-devices) cmd_ios_devices ;; # 列出已连接的 iOS 物理设备(拿 device id) ipad|ios) cmd_ipad "${2:-}" ;; # 构建 iOS release 并装到 iPad(可传设备 id/名字子串) - *) echo "用法: $0 {all|build|sign|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;; + *) echo "用法: $0 {macos|all|build|sign|verify|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;; esac