Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

ci: macOS hardened-runtime smoke step fails because the re-signed app's helpers cannot connect (#28)

Aperta
  • Qualcosa non va?
#392 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
macos, typescript
Ambito
ci-cd, desktop

Direzione di ricerca

Start with the “Smoke-test the app under the hardened runtime” step in .github/workflows/ci.yml and the behavior of scripts/smoke-packaged.mjs. Compare the signed and unsigned app copies and inspect helper identifiers and signing requirements, as the issue suggests; also check whether MACH_PORT_RENDEZVOUS_PEER_VALDATION=0 changes the result. Done means the packaged app smoke test passes reliably, or the failing step is made non-blocking or removed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug platform: macos tests

The step "Smoke-test the app under the hardened runtime" (.github/workflows/ci.yml, merged with #374) fails on package (macos-latest) on main.

Observed: a copy of Patch.app re-signed with a throwaway self-signed certificate (also with ad-hoc signing) starts, but Chromium helpers log 'Terminating current process after 15 seconds with no connection' and scripts/smoke-packaged.mjs times out after 120 s. The unhardened control copy fails the same way, so re-signing itself is the cause, not the hardened runtime or build/entitlements.mac.plist. The DMG's app as built starts fine. --disable-features=MachPortRendezvousValidatePeerRequirements changes nothing.

Not yet known (the diagnostic run was cancelled before it finished): whether the unsigned copy out of the DMG starts, and whether MACH_PORT_RENDEZVOUS_PEER_VALDATION=0 helps. Ideas: sign inside-out without --deep and compare helper identifiers and requirements before and after; try another way to give all binaries one team-identified identity.

Until fixed, the step either needs to be made non-blocking or removed so main and later PRs are not red. Needed for #28 (verifying allow-jit alone under the hardened runtime).

Lingua principale
TypeScript
Stelle
2
Fork
2
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PierrunoYT/patch

Tutte le issue di PierrunoYT/patch

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.