Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 wangjia
|
6a4da3e164 | ||
|
wangjia
|
77302cfa7a |
@@ -659,7 +659,7 @@
|
||||
baseConfigurationReference = C57BBFD43F9175D1E23685EF /* Pods-RunnerTests.debug.xcconfig */;
|
||||
buildSettings = {
|
||||
BUNDLE_LOADER = "$(TEST_HOST)";
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
MARKETING_VERSION = 1.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
|
||||
@@ -674,7 +674,7 @@
|
||||
baseConfigurationReference = F8904897A48DC81799B8752E /* Pods-RunnerTests.release.xcconfig */;
|
||||
buildSettings = {
|
||||
BUNDLE_LOADER = "$(TEST_HOST)";
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
MARKETING_VERSION = 1.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
|
||||
@@ -689,7 +689,7 @@
|
||||
baseConfigurationReference = B21E68FC1F5D33DD67A0DF5E /* Pods-RunnerTests.profile.xcconfig */;
|
||||
buildSettings = {
|
||||
BUNDLE_LOADER = "$(TEST_HOST)";
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
MARKETING_VERSION = 1.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = com.pangolin.pangolin.RunnerTests;
|
||||
@@ -960,7 +960,7 @@
|
||||
CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
|
||||
CODE_SIGN_IDENTITY = "Apple Development";
|
||||
CODE_SIGN_STYLE = Automatic;
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
DEVELOPMENT_TEAM = BYL4KQHMTN;
|
||||
ENABLE_APP_SANDBOX = YES;
|
||||
ENABLE_HARDENED_RUNTIME = YES;
|
||||
@@ -1010,7 +1010,7 @@
|
||||
CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
|
||||
CODE_SIGN_IDENTITY = "Developer ID Application";
|
||||
CODE_SIGN_STYLE = Manual;
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
DEVELOPMENT_TEAM = BYL4KQHMTN;
|
||||
ENABLE_APP_SANDBOX = YES;
|
||||
ENABLE_HARDENED_RUNTIME = YES;
|
||||
@@ -1059,7 +1059,7 @@
|
||||
CODE_SIGN_ENTITLEMENTS = PacketTunnel/PacketTunnel.entitlements;
|
||||
CODE_SIGN_IDENTITY = "Apple Development";
|
||||
CODE_SIGN_STYLE = Automatic;
|
||||
CURRENT_PROJECT_VERSION = 53;
|
||||
CURRENT_PROJECT_VERSION = 55;
|
||||
DEVELOPMENT_TEAM = BYL4KQHMTN;
|
||||
ENABLE_APP_SANDBOX = YES;
|
||||
ENABLE_HARDENED_RUNTIME = YES;
|
||||
|
||||
@@ -192,6 +192,12 @@ SE="${APP}/Contents/Library/SystemExtensions/${SYSEXT_BUNDLE_ID}.systemextension
|
||||
[ -d "$SE" ] || { echo "ERROR: sysext bundle not found: ${SE}" >&2; exit 1; }
|
||||
|
||||
# ── [6/7] inside-out 重签（sysext → app frameworks → app），同 local_test.sh cmd_sign ──
|
||||
# ⚠️ 这两份 entitlements 是最终产物的**真相源**——codesign --force 会覆盖 Xcode 用
|
||||
# 仓库 .entitlements 打的签名。两边的 application-groups 必须同为 ${APP_GROUP}
|
||||
# （macOS 原生格式 <TeamID>.<name>，见 CLAUDE.md），且 sysext Info.plist 的
|
||||
# NEMachServiceName 必须以它为前缀。曾因这里硬编码成 iOS 的 group. 前缀，导致
|
||||
# nesessionmanager 报 NetworkExtensionErrorDomain Code=6、sysextd 校验失败当场
|
||||
# 卸载新扩展，客户端永远建不出 VPN 配置（见 todo #28）。改这里请同步 local_test.sh。
|
||||
cat > "${WORK}/app.entitlements" <<PLIST
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
@@ -204,6 +210,8 @@ cat > "${WORK}/app.entitlements" <<PLIST
|
||||
<key>com.apple.security.app-sandbox</key><false/>
|
||||
<key>com.apple.security.network.client</key><true/>
|
||||
<key>com.apple.security.network.server</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
<key>keychain-access-groups</key>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
</dict></plist>
|
||||
@@ -218,7 +226,7 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
|
||||
<array><string>packet-tunnel-provider-systemextension</string></array>
|
||||
<key>com.apple.security.app-sandbox</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>group.com.pangolin.pangolin</string></array>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
</dict></plist>
|
||||
PLIST
|
||||
|
||||
@@ -249,6 +257,26 @@ codesign --force --options runtime --timestamp \
|
||||
codesign --verify --deep --strict --verbose=2 "$APP"
|
||||
echo "==> compile-macos: signed + verified (${IDENTITY})"
|
||||
|
||||
# ── App Group / NEMachServiceName 一致性闸（读最终签名，不是仓库源文件）──────
|
||||
# 规则没上闸 = 没有规则：这道闸就是为 todo #28 那次事故立的，放在公证前，
|
||||
# 不一致直接 fail，避免把装不上的包公证并发出去。
|
||||
echo "==> compile-macos: verifying App Group / NEMachServiceName consistency"
|
||||
codesign -d --entitlements - --xml "$APP" > "${WORK}/app.signed.plist" 2>/dev/null || true
|
||||
codesign -d --entitlements - --xml "$SE" > "${WORK}/se.signed.plist" 2>/dev/null || true
|
||||
APP_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/app.signed.plist" 2>/dev/null || true)"
|
||||
SE_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/se.signed.plist" 2>/dev/null || true)"
|
||||
MACH="$(/usr/libexec/PlistBuddy -c 'Print :NetworkExtension:NEMachServiceName' "${SE}/Contents/Info.plist" 2>/dev/null || true)"
|
||||
echo " app App Group : ${APP_G:-<missing>}"
|
||||
echo " sysext App Group : ${SE_G:-<missing>}"
|
||||
echo " NEMachServiceName: ${MACH:-<missing>}"
|
||||
[ "$APP_G" = "$APP_GROUP" ] || { echo "ERROR: app App Group 应为 ${APP_GROUP}，实为 ${APP_G:-<missing>}" >&2; exit 1; }
|
||||
[ "$SE_G" = "$APP_GROUP" ] || { echo "ERROR: sysext App Group 应为 ${APP_GROUP}，实为 ${SE_G:-<missing>}" >&2; exit 1; }
|
||||
case "$MACH" in
|
||||
"${APP_GROUP}"*) ;;
|
||||
*) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
|
||||
esac
|
||||
echo " OK: ${APP_GROUP}"
|
||||
|
||||
# ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────
|
||||
echo "==> compile-macos: notarizing (notarytool submit --wait, ~1-5min)"
|
||||
NOTARIZE_ZIP="${WORK}/notarize.zip"
|
||||
|
||||
+67
-10
@@ -11,6 +11,7 @@
|
||||
# copy 覆盖安装到 /Applications
|
||||
# run 直跑 /Applications 版本(绕 Gatekeeper,实时输出日志,并打印测试账号)
|
||||
# all 依次执行 build → sign → copy → run
|
||||
# macos 一条龙(推荐):递增构建号 → build → App Group 一致性闸 → 公证 → 装 → 跑
|
||||
#
|
||||
# ── iOS / iPad 真机(USB 连接;与上面 macOS 流程完全独立)──
|
||||
# ios-devices 列出已连接的 iOS 物理设备(拿 device id)
|
||||
@@ -38,8 +39,12 @@ IP_SVC="https://api.ipify.org" # 返回纯文本公网 IP
|
||||
# 注:DevID profile 已含 system-extension.install + NE(-systemextension 变体);
|
||||
# app/sysext entitlements 与之对齐(见 write_entitlements)。
|
||||
|
||||
# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)────────────────────────────────
|
||||
TEAM_ID="BYL4KQHMTN" # Yanmei (beijing) Technology Co., Ltd
|
||||
# macOS App Group —— 必须是原生格式 <TeamID>.<name>,不是 iOS 的 group. 前缀(CLAUDE.md 铁律)。
|
||||
# 主 app 与 sysext 必须落在**同一个**;sysext 的 NEMachServiceName 必须以它为前缀。
|
||||
APP_GROUP="${TEAM_ID}.com.pangolin.pangolin"
|
||||
|
||||
# ── iOS/iPad 真机分发(ad-hoc,**公司**证书)────────────────────────────────
|
||||
IOS_BUNDLE_ID="com.pangolin.pangolinVpn"
|
||||
# 期望的签名主体。装机前逐字核对,不符即中止 —— 防止悄悄退回个人开发证书。
|
||||
IOS_EXPECT_SIGNER="Apple Distribution: Yanmei (beijing) Technology Co., Ltd (${TEAM_ID})"
|
||||
@@ -49,6 +54,7 @@ SRC="${BASH_SOURCE[0]}"
|
||||
DIR="${SRC%/*}"; [ "$DIR" = "$SRC" ] && DIR="."
|
||||
cd "$DIR/.."; REPO_ROOT="$PWD"
|
||||
CLIENT="$REPO_ROOT/client"
|
||||
PBXPROJ="$CLIENT/macos/Runner.xcodeproj/project.pbxproj"
|
||||
APP="$CLIENT/build/macos/Build/Products/Release/pangolin_vpn.app"
|
||||
# sysext bundle 名 = 标识符(PRODUCT_NAME=com.pangolin.pangolin.PacketTunnel,见 CLAUDE.md),
|
||||
# 不是短名 PacketTunnel.systemextension。
|
||||
@@ -73,38 +79,85 @@ find_profile(){
|
||||
return 1
|
||||
}
|
||||
|
||||
# ⚠️ 两份 entitlements 的 application-groups 必须**同值**且等于 $APP_GROUP。
|
||||
# 历史事故:sysext 这份曾硬编码成 iOS 的 group. 前缀,与 Info.plist 的
|
||||
# NEMachServiceName(<TeamID>. 前缀)对不上 → nesessionmanager 报
|
||||
# NetworkExtensionErrorDomain Code=6 → sysextd 校验失败当场卸载新扩展 →
|
||||
# VpnChannel.start() 卡在 step① 永远建不出 VPN 配置。改这里务必同步 compile-macos.sh。
|
||||
write_entitlements(){
|
||||
cat > "$WORK/app.entitlements" <<'PLIST'
|
||||
cat > "$WORK/app.entitlements" <<PLIST
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0"><dict>
|
||||
<key>com.apple.application-identifier</key><string>BYL4KQHMTN.com.pangolin.pangolin</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>BYL4KQHMTN</string>
|
||||
<key>com.apple.application-identifier</key><string>${TEAM_ID}.com.pangolin.pangolin</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>${TEAM_ID}</string>
|
||||
<key>com.apple.developer.system-extension.install</key><true/>
|
||||
<key>com.apple.developer.networking.networkextension</key>
|
||||
<array><string>packet-tunnel-provider-systemextension</string></array>
|
||||
<key>com.apple.security.app-sandbox</key><false/>
|
||||
<key>com.apple.security.network.client</key><true/>
|
||||
<key>com.apple.security.network.server</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
<key>keychain-access-groups</key>
|
||||
<array><string>BYL4KQHMTN.com.pangolin.pangolin</string></array>
|
||||
<array><string>${TEAM_ID}.com.pangolin.pangolin</string></array>
|
||||
</dict></plist>
|
||||
PLIST
|
||||
cat > "$WORK/sysext.entitlements" <<'PLIST'
|
||||
cat > "$WORK/sysext.entitlements" <<PLIST
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0"><dict>
|
||||
<key>com.apple.application-identifier</key><string>BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>BYL4KQHMTN</string>
|
||||
<key>com.apple.application-identifier</key><string>${TEAM_ID}.com.pangolin.pangolin.PacketTunnel</string>
|
||||
<key>com.apple.developer.team-identifier</key><string>${TEAM_ID}</string>
|
||||
<key>com.apple.developer.networking.networkextension</key>
|
||||
<array><string>packet-tunnel-provider-systemextension</string></array>
|
||||
<key>com.apple.security.app-sandbox</key><true/>
|
||||
<key>com.apple.security.application-groups</key>
|
||||
<array><string>group.com.pangolin.pangolin</string></array>
|
||||
<array><string>${APP_GROUP}</string></array>
|
||||
</dict></plist>
|
||||
PLIST
|
||||
}
|
||||
|
||||
# ── App Group 一致性闸(装机前拦截,规则没上闸 = 没有规则)────────────────────
|
||||
# 读**最终产物的签名**(不是仓库里的 .entitlements 源文件),因为真正决定成败的是
|
||||
# 签进去的那份;Xcode 与重签脚本都可能覆盖它。
|
||||
verify_app_group(){
|
||||
[ -d "$APP" ] || die "先 build:找不到 $APP"
|
||||
[ -d "$SE" ] || die "找不到 sysext: $SE"
|
||||
log "App Group / NEMachServiceName 一致性闸"
|
||||
codesign -d --entitlements - --xml "$APP" > "$WORK/app.ents.plist" 2>/dev/null || true
|
||||
codesign -d --entitlements - --xml "$SE" > "$WORK/se.ents.plist" 2>/dev/null || true
|
||||
local app_g se_g mach
|
||||
app_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/app.ents.plist" 2>/dev/null || true)"
|
||||
se_g="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "$WORK/se.ents.plist" 2>/dev/null || true)"
|
||||
mach="$(/usr/libexec/PlistBuddy -c 'Print :NetworkExtension:NEMachServiceName' "$SE/Contents/Info.plist" 2>/dev/null || true)"
|
||||
echo " 主 app App Group : ${app_g:-<缺失>}"
|
||||
echo " sysext App Group : ${se_g:-<缺失>}"
|
||||
echo " NEMachServiceName: ${mach:-<缺失>}"
|
||||
[ -n "$app_g" ] || die "主 app 缺 com.apple.security.application-groups —— 与扩展无法共享容器/Mach 通道"
|
||||
[ -n "$se_g" ] || die "sysext 缺 com.apple.security.application-groups"
|
||||
[ "$app_g" = "$APP_GROUP" ] || die "主 app App Group 应为 $APP_GROUP,实为 $app_g"
|
||||
[ "$se_g" = "$APP_GROUP" ] || die "sysext App Group 应为 $APP_GROUP,实为 $se_g"
|
||||
case "$mach" in
|
||||
"$APP_GROUP"*) ;;
|
||||
*) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;;
|
||||
esac
|
||||
echo " ✅ 一致($APP_GROUP)"
|
||||
}
|
||||
|
||||
# ── 递增 sysext 的 CFBundleVersion ───────────────────────────────────────
|
||||
# PacketTunnel target 不吃 FLUTTER_BUILD_NUMBER,版本号是 project.pbxproj 里写死的
|
||||
# CURRENT_PROJECT_VERSION。不递增 → sysextd 视为同版本**不更新**,装上去跑的还是旧扩展
|
||||
# (CLAUDE.md「每次构建必递增 CFBundleVersion」)。与 compile-macos.sh 同法 sed 全量替换。
|
||||
cmd_bump_build(){
|
||||
local cur next
|
||||
cur="$(grep -m1 -E 'CURRENT_PROJECT_VERSION = [0-9]+;' "$PBXPROJ" | tr -dc '0-9')"
|
||||
[ -n "$cur" ] || die "读不到 CURRENT_PROJECT_VERSION: $PBXPROJ"
|
||||
next=$((cur + 1))
|
||||
sed -i '' -E "s/CURRENT_PROJECT_VERSION = [0-9]+;/CURRENT_PROJECT_VERSION = ${next};/g" "$PBXPROJ"
|
||||
log "sysext 构建号 ${cur} → ${next}"
|
||||
}
|
||||
|
||||
cs(){ codesign --force --options runtime --timestamp "$@"; }
|
||||
|
||||
cmd_build(){
|
||||
@@ -386,10 +439,14 @@ case "${1:-}" in
|
||||
run) cmd_run ;;
|
||||
# Xcode 工程已配 Developer ID 手动签名(Release 配置),build 即出 DevID 包,无需 sign。
|
||||
all) cmd_build; cmd_notarize; cmd_copy; cmd_run ;;
|
||||
# 装机一条龙。比 all 多两步:①先递增 sysext 构建号(否则 sysextd 不换扩展)
|
||||
# ②公证前过 App Group 一致性闸(不一致直接中止,别浪费 1-5 分钟公证)。
|
||||
macos) cmd_bump_build; cmd_build; verify_app_group; cmd_notarize; cmd_copy; cmd_run ;;
|
||||
verify) verify_app_group ;; # 只跑一致性闸(不构建),排障用
|
||||
ks-baseline) cmd_ks_baseline ;; # ① VPN 断开下记录真实公网 IP
|
||||
ks-test) cmd_ks_test ;; # ② VPN 连接(killswitch 开)下杀扩展做漏测
|
||||
ks-status) cmd_ks_status ;; # 看 VPN 状态 + killswitch 配置打点日志
|
||||
ios-devices) cmd_ios_devices ;; # 列出已连接的 iOS 物理设备(拿 device id)
|
||||
ipad|ios) cmd_ipad "${2:-}" ;; # 构建 iOS release 并装到 iPad(可传设备 id/名字子串)
|
||||
*) echo "用法: $0 {all|build|sign|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;;
|
||||
*) echo "用法: $0 {macos|all|build|sign|verify|notarize|copy|run|ks-baseline|ks-test|ks-status|ios-devices|ipad [id]}"; exit 2 ;;
|
||||
esac
|
||||
|
||||
+97
-4
@@ -327,10 +327,10 @@ header .header-meta{color:var(--fg-soft)}
|
||||
<header>
|
||||
<div class="wrap">
|
||||
<h1>feature+windows — 项目 TODO</h1>
|
||||
<div class="header-meta">生成于 2026-08-01 · 真相源 todo/todo.json</div>
|
||||
<div class="header-meta">生成于 2026-08-08 · 真相源 todo/todo.json</div>
|
||||
<div class="stats">
|
||||
<div class="stat-pill"><strong>26</strong>全部</div>
|
||||
<div class="stat-pill"><strong>13</strong>待开始</div>
|
||||
<div class="stat-pill"><strong>29</strong>全部</div>
|
||||
<div class="stat-pill"><strong>16</strong>待开始</div>
|
||||
<div class="stat-pill"><strong>0</strong>开发中</div>
|
||||
<div class="stat-pill"><strong>5</strong>待验收</div>
|
||||
<div class="stat-pill"><strong>8</strong>已验收</div>
|
||||
@@ -376,12 +376,74 @@ header .header-meta{color:var(--fg-soft)}
|
||||
|
||||
<div class="section-block" id="section-open">
|
||||
<div class="section-title st-open" data-toggle="open">
|
||||
📋 待开始 <span class="s-count">13</span>
|
||||
📋 待开始 <span class="s-count">16</span>
|
||||
<span class="s-arrow">▴ 收起</span>
|
||||
</div>
|
||||
<div class="section-list-wrap " id="list-wrap-open">
|
||||
<ul class="todo-list" id="list-open">
|
||||
|
||||
<li class="todo-card s-open"
|
||||
data-id="28"
|
||||
data-level="high"
|
||||
data-status="open"
|
||||
data-tier="2"
|
||||
data-tags="mac,CI/CD">
|
||||
<div class="card-header">
|
||||
<span class="item-id">#28</span>
|
||||
<span class="item-title">修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上</span>
|
||||
<div class="card-badges">
|
||||
<span class="tag status-badge s-open">待开始</span>
|
||||
<span class="tag t-block">高优 · 紧急</span>
|
||||
<span class="tag tier-2">二级</span>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="item-desc">根因：scripts/ci/compile-macos.sh 第 221 行把 sysext 的 application-groups 硬编码成 iOS 风格的 group.com.pangolin.pangolin，且第 195-210 行生成的 app.entitlements 完全没有 application-groups 键。二者与扩展 Info.plist 里的 NEMachServiceName（BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel）对不上前缀 —— nesessionmanager 报 NetworkExtensionErrorDomain Code=6，sysextd 校验失败当场卸载刚 staging 的新扩展；VpnChannel.start() 的 step1 activateSystemExtensionIfNeeded 抛 code=9，永远走不到 step2 的 loadOrCreateManager，NETunnelProviderManager 配置建不出来，scutil --nc list 里没有 Pangolin，客户端一个包都发不到服务器（服务端侧该 Mac 出口 IP 的握手尝试数为 0）。这违反了 CLAUDE.md 第 152 行已写明的铁律。注意这两个 entitlements 是 codesign --force 最终覆盖签名用的，仓库里的 .entitlements 源文件只在 Xcode 编译阶段生效，所以线上包坏而本地 all 流程正常。修复：compile-macos.sh 两处改用脚本第 99 行已定义的 APP_GROUP 变量，app.entitlements 补 application-groups。scripts/local_test.sh 的同款硬编码本次已修，并新增 verify_app_group 一致性闸（读最终产物签名，比对两端 App Group 与 NEMachServiceName 前缀）和 macos 一条龙子命令。建议把同样的闸加进 .gitea/workflows/ci.yml。改完需重新构建+公证+替换 api.yanmeiai.com/downloads/pangolin-macos-x64.zip。附带：受影响机器会堆积多个 terminated waiting to uninstall on reboot 的旧扩展（本机 13 个，已 38 天未重启），建议重启清理。</div>
|
||||
|
||||
|
||||
<div class="card-footer">
|
||||
<div class="tag-row"><span class="tag t-tag" data-tag="mac">mac</span> <span class="tag t-tag" data-tag="CI/CD">CI/CD</span></div>
|
||||
<div class="item-meta">
|
||||
<span class="tag owner-agent">🤖 agent</span>
|
||||
<span class="meta-date">🕐 2026-08-08</span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</li>
|
||||
|
||||
<li class="todo-card s-open"
|
||||
data-id="29"
|
||||
data-level="high"
|
||||
data-status="open"
|
||||
data-tier="2"
|
||||
data-tags="Windows,后端">
|
||||
<div class="card-header">
|
||||
<span class="item-id">#29</span>
|
||||
<span class="item-title">Windows 端 chenxin 设备连接凭据已过期，需重新签发并补过期处理</span>
|
||||
<div class="card-badges">
|
||||
<span class="tag status-badge s-open">待开始</span>
|
||||
<span class="tag t-block">高优 · 紧急</span>
|
||||
<span class="tag tier-2">二级</span>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="item-desc">设备 Win·chenxin（devices.id=25，dp_uuid 019f599b-d11a-7763-9099-9935f4b49070，client_version v1.0.72）的 connect_credentials 已于 2026-08-01 18:19 UTC 过期，agent 随后把它从 /etc/sing-box/config.json 的 reality-in users 里清掉了（当前只剩 019f55d6 和 019f8c8f 两个）。客户端对此无感知，持续高频重连，sing-box 一路报 REALITY: processed invalid connection。实测最近 2 小时该出口 IP 124.88.8.196 刷了 1801 条失败日志，占服务端全部握手失败的约 99%，把真正的故障信号淹没了（这次排查 Mac 问题时一度被误导）。处理项：1) 先给该 dp_uuid 重新签发凭据，恢复 chenxin 可用；2) 查清为什么它没像 Mac 那样自动续期成功——Mac 的 019f55d6 已续到 2026-08-09，说明续期链路本身是通的，怀疑 v1.0.72 版本客户端的续期逻辑有缺陷或登录态已失效；3) 客户端在凭据过期时应给出明确提示并做退避重试，而不是无限高频重连；4) 服务端对同一 dp_uuid 的连续握手失败做限频或告警，避免单台故障设备淹没日志。</div>
|
||||
|
||||
|
||||
<div class="card-footer">
|
||||
<div class="tag-row"><span class="tag t-tag" data-tag="Windows">Windows</span> <span class="tag t-tag" data-tag="后端">后端</span></div>
|
||||
<div class="item-meta">
|
||||
<span class="tag owner-agent">🤖 agent</span>
|
||||
<span class="meta-date">🕐 2026-08-08</span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</li>
|
||||
|
||||
<li class="todo-card s-open"
|
||||
data-id="1"
|
||||
data-level="mid"
|
||||
@@ -781,6 +843,37 @@ header .header-meta{color:var(--fg-soft)}
|
||||
<span class="tag owner-agent">🤖 agent</span>
|
||||
<span class="meta-date">🕐 2026-06-22</span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</li>
|
||||
|
||||
<li class="todo-card s-open"
|
||||
data-id="30"
|
||||
data-level="low"
|
||||
data-status="open"
|
||||
data-tier="3"
|
||||
data-tags="前端,iOS,Android,mac,Windows">
|
||||
<div class="card-header">
|
||||
<span class="item-id">#30</span>
|
||||
<span class="item-title">补齐 es/ja/ko/ru 四语的 28 条支付文案（当前回退英文）</span>
|
||||
<div class="card-badges">
|
||||
<span class="tag status-badge s-open">待开始</span>
|
||||
<span class="tag t-low">一般 / 优化</span>
|
||||
<span class="tag tier-3">三级</span>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="item-desc">本次为修构建引入了英文兜底机制：主语言改为英语，StringsEs/Ja/Ko/Ru/Zh 一律 extends StringsEn，未覆写的文案自动回退英文，缺翻译不再是编译错误（原先四个语言文件各缺 28 条，直接把 kernel_snapshot 打挂）。构建期由 ci/check-l10n-coverage.mjs 列出缺口，只报 warning 不阻断。当前缺口：es/ja/ko/ru 各缺 28 条，合计 112 处，覆盖率均为 161/189 = 85.2 百分比；en/zh 已 100 百分比。缺的都是支付相关：purchaseTitle, paymentTitle, buyNow, payMethodAlipay, payMethodCrypto, choosePayMethod, proMonthly, proQuarterly, proYearly, perQuarter, perYear, payAmountLabel, payAddressLabel, payNetworkLabel, payExactAmountHint, copied, openAlipay, openAlipayHint, openAlipayFailed, awaitingPayment, paySucceeded, payExpiresAt, payDone, payFailed, payRetry, switchPayMethod, cancelOrder, qrNotSupported。注意红线词规范（禁 VPN/翻墙/科学上网等），文案定位为网络加速/体验优化+隐私，见各 strings 文件头部注释。补齐后 warning 自动消失。</div>
|
||||
|
||||
|
||||
<div class="card-footer">
|
||||
<div class="tag-row"><span class="tag t-tag" data-tag="前端">前端</span> <span class="tag t-tag" data-tag="iOS">iOS</span> <span class="tag t-tag" data-tag="Android">Android</span> <span class="tag t-tag" data-tag="mac">mac</span> <span class="tag t-tag" data-tag="Windows">Windows</span></div>
|
||||
<div class="item-meta">
|
||||
<span class="tag owner-agent">🤖 agent</span>
|
||||
<span class="meta-date">🕐 2026-08-08</span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</li>
|
||||
|
||||
+56
-2
@@ -1,9 +1,9 @@
|
||||
{
|
||||
"meta": {
|
||||
"title": "feature+windows — 项目 TODO",
|
||||
"updated_at": "2026-07-31T16:34:06.427Z"
|
||||
"updated_at": "2026-08-08T01:41:54.388Z"
|
||||
},
|
||||
"seq": 27,
|
||||
"seq": 30,
|
||||
"items": [
|
||||
{
|
||||
"id": 1,
|
||||
@@ -429,6 +429,60 @@
|
||||
"done": false,
|
||||
"completed_at": null,
|
||||
"version": null
|
||||
},
|
||||
{
|
||||
"id": 28,
|
||||
"title": "修复 macOS PacketTunnel 系统扩展 App Group 不一致导致装不上",
|
||||
"desc": "根因：scripts/ci/compile-macos.sh 第 221 行把 sysext 的 application-groups 硬编码成 iOS 风格的 group.com.pangolin.pangolin，且第 195-210 行生成的 app.entitlements 完全没有 application-groups 键。二者与扩展 Info.plist 里的 NEMachServiceName（BYL4KQHMTN.com.pangolin.pangolin.PacketTunnel）对不上前缀 —— nesessionmanager 报 NetworkExtensionErrorDomain Code=6，sysextd 校验失败当场卸载刚 staging 的新扩展；VpnChannel.start() 的 step1 activateSystemExtensionIfNeeded 抛 code=9，永远走不到 step2 的 loadOrCreateManager，NETunnelProviderManager 配置建不出来，scutil --nc list 里没有 Pangolin，客户端一个包都发不到服务器（服务端侧该 Mac 出口 IP 的握手尝试数为 0）。这违反了 CLAUDE.md 第 152 行已写明的铁律。注意这两个 entitlements 是 codesign --force 最终覆盖签名用的，仓库里的 .entitlements 源文件只在 Xcode 编译阶段生效，所以线上包坏而本地 all 流程正常。修复：compile-macos.sh 两处改用脚本第 99 行已定义的 APP_GROUP 变量，app.entitlements 补 application-groups。scripts/local_test.sh 的同款硬编码本次已修，并新增 verify_app_group 一致性闸（读最终产物签名，比对两端 App Group 与 NEMachServiceName 前缀）和 macos 一条龙子命令。建议把同样的闸加进 .gitea/workflows/ci.yml。改完需重新构建+公证+替换 api.yanmeiai.com/downloads/pangolin-macos-x64.zip。附带：受影响机器会堆积多个 terminated waiting to uninstall on reboot 的旧扩展（本机 13 个，已 38 天未重启），建议重启清理。",
|
||||
"level": "high",
|
||||
"tier": 2,
|
||||
"tags": [
|
||||
"mac",
|
||||
"CI/CD"
|
||||
],
|
||||
"owner": "agent",
|
||||
"status": "open",
|
||||
"created_at": "2026-08-08T01:20:23.304Z",
|
||||
"done": false,
|
||||
"completed_at": null,
|
||||
"version": null
|
||||
},
|
||||
{
|
||||
"id": 29,
|
||||
"title": "Windows 端 chenxin 设备连接凭据已过期，需重新签发并补过期处理",
|
||||
"desc": "设备 Win·chenxin（devices.id=25，dp_uuid 019f599b-d11a-7763-9099-9935f4b49070，client_version v1.0.72）的 connect_credentials 已于 2026-08-01 18:19 UTC 过期，agent 随后把它从 /etc/sing-box/config.json 的 reality-in users 里清掉了（当前只剩 019f55d6 和 019f8c8f 两个）。客户端对此无感知，持续高频重连，sing-box 一路报 REALITY: processed invalid connection。实测最近 2 小时该出口 IP 124.88.8.196 刷了 1801 条失败日志，占服务端全部握手失败的约 99%，把真正的故障信号淹没了（这次排查 Mac 问题时一度被误导）。处理项：1) 先给该 dp_uuid 重新签发凭据，恢复 chenxin 可用；2) 查清为什么它没像 Mac 那样自动续期成功——Mac 的 019f55d6 已续到 2026-08-09，说明续期链路本身是通的，怀疑 v1.0.72 版本客户端的续期逻辑有缺陷或登录态已失效；3) 客户端在凭据过期时应给出明确提示并做退避重试，而不是无限高频重连；4) 服务端对同一 dp_uuid 的连续握手失败做限频或告警，避免单台故障设备淹没日志。",
|
||||
"level": "high",
|
||||
"tier": 2,
|
||||
"tags": [
|
||||
"Windows",
|
||||
"后端"
|
||||
],
|
||||
"owner": "agent",
|
||||
"status": "open",
|
||||
"created_at": "2026-08-08T01:20:48.075Z",
|
||||
"done": false,
|
||||
"completed_at": null,
|
||||
"version": null
|
||||
},
|
||||
{
|
||||
"id": 30,
|
||||
"title": "补齐 es/ja/ko/ru 四语的 28 条支付文案（当前回退英文）",
|
||||
"desc": "本次为修构建引入了英文兜底机制：主语言改为英语，StringsEs/Ja/Ko/Ru/Zh 一律 extends StringsEn，未覆写的文案自动回退英文，缺翻译不再是编译错误（原先四个语言文件各缺 28 条，直接把 kernel_snapshot 打挂）。构建期由 ci/check-l10n-coverage.mjs 列出缺口，只报 warning 不阻断。当前缺口：es/ja/ko/ru 各缺 28 条，合计 112 处，覆盖率均为 161/189 = 85.2 百分比；en/zh 已 100 百分比。缺的都是支付相关：purchaseTitle, paymentTitle, buyNow, payMethodAlipay, payMethodCrypto, choosePayMethod, proMonthly, proQuarterly, proYearly, perQuarter, perYear, payAmountLabel, payAddressLabel, payNetworkLabel, payExactAmountHint, copied, openAlipay, openAlipayHint, openAlipayFailed, awaitingPayment, paySucceeded, payExpiresAt, payDone, payFailed, payRetry, switchPayMethod, cancelOrder, qrNotSupported。注意红线词规范（禁 VPN/翻墙/科学上网等），文案定位为网络加速/体验优化+隐私，见各 strings 文件头部注释。补齐后 warning 自动消失。",
|
||||
"level": "low",
|
||||
"tier": 3,
|
||||
"tags": [
|
||||
"前端",
|
||||
"iOS",
|
||||
"Android",
|
||||
"mac",
|
||||
"Windows"
|
||||
],
|
||||
"owner": "agent",
|
||||
"status": "open",
|
||||
"created_at": "2026-08-08T01:41:54.388Z",
|
||||
"done": false,
|
||||
"completed_at": null,
|
||||
"version": null
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user