umputun / agterm / 31303792118
97%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 92
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 97.878%. Remained the same
31303792118

push

github

web-flow 
fix: add missing TCC resource-access entitlements and usage strings (#398)

* fix: add missing TCC resource-access entitlements and usage strings

agterm is signed with hardened runtime, under which Apple gates seven
resource-access entitlements. Only device.audio-input was present, so
for the other six tccd refuses to prompt and records nothing: a program
run inside a session cannot obtain the permission, and the user cannot
grant it by hand either, because with no TCC record agterm never appears
in the relevant Privacy & Security pane.

Adds the six missing entitlements, plus usage strings for the services
with a real command-line path, worded to match the existing microphone
string. Same mechanism as #142, one layer down.

Fixes #396

* fix: sign agtermctl entitlement-free and cover the split TCC keys

The postBuild re-seal used --deep --entitlements, which re-signs every
nested Mach-O with the app's entitlement set. That stamped the bundled
agtermctl -- a standalone CLI the user puts on their PATH -- with every
TCC entitlement the app declares. Seal inside-out instead, matching what
scripts/release.sh already does for Developer ID builds; the helper keeps
the entitlement-free signature from the line above.

Also add the split-service usage strings macOS documents alongside the
ones already here: EventKit full-access (macOS 14+), the Photos add-only
service, and the always-authorization location key. Drop the deprecated
NSLocationUsageDescription -- unreachable at LSMinimumSystemVersion 14.0
and a byte-for-byte duplicate of the WhenInUse string.

* fix: sign nested dylibs explicitly now that the re-seal is not --deep

Dropping --deep broke a CLEAN build: this phase can run BEFORE Xcode signs
agterm.debug.dylib, so sealing the app without --deep failed with "code
object is not signed at all" on that subcomponent. Incremental builds hid
it, because the dylib was already signed from a previous run.

Sign every nested dylib explicitly before the seal, ... (continued)

7473 of 7635 relevant lines covered (97.88%)

4500531.52 hits per line

Jobs
ID Job ID Ran Files Coverage
1 31303792118.1 92
97.88
 GitHub Action Run
Source Files on build 31303792118