lee/Recordly
1
0
Fork 0
mirror of https://github.com/webadderallorg/Recordly.git synced 2026-09-24 14:55:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(macos): reject unreviewed root entitlements

Browse Source
This commit is contained in:
wiiiii123
2026-08-09 01:57:53 +07:00
parent e2df84f5b9
commit b9683c8fbe
2 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/macosDistributionPolicy.test.mjs
+11
View File
@@ -72,6 +72,17 @@ describe("macOS distribution entitlement policy", () => {
"distribution build must not enable com.apple.security.get-task-allow",
]);
});
it("rejects unreviewed root runtime exceptions", () => {
expect(
collectEntitlementErrors({
...validEntitlements,
"com.apple.security.cs.allow-dyld-environment-variables": true,
}),
).toEqual([
"unexpected root application entitlement: com.apple.security.cs.allow-dyld-environment-variables",
]);
});
});
describe("macOS distribution architecture policy", () => {
scripts/macos-distribution-policy.mjs
+16 -2
View File
@@ -8,6 +8,8 @@ export const REQUIRED_MACOS_ENTITLEMENTS = Object.freeze([
"com.apple.security.device.camera",
]);
const ALLOWED_MACOS_ENTITLEMENTS = new Set(REQUIRED_MACOS_ENTITLEMENTS);
function readCodeSignValue(details, key) {
const prefix = `${key}=`;
return details
@@ -66,8 +68,20 @@ export function collectEntitlementErrors(entitlements) {
}
}
if (entitlements["com.apple.security.get-task-allow"] === true) {
errors.push("distribution build must not enable com.apple.security.get-task-allow");
for (const entitlement of Object.keys(entitlements).sort()) {
if (ALLOWED_MACOS_ENTITLEMENTS.has(entitlement)) {
continue;
}
if (
entitlement === "com.apple.security.get-task-allow" &&
entitlements[entitlement] === true
) {
errors.push("distribution build must not enable com.apple.security.get-task-allow");
continue;
}
errors.push(`unexpected root application entitlement: ${entitlement}`);
}
return errors;