latest updates

2026-09-08 20:06:58 +01:00
parent fb05cf71ed
commit 868604b848
53 changed files with 6442 additions and 0 deletions
@@ -0,0 +1,51 @@
+#!/bin/bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PBX="$ROOT/Rsync Studio.xcodeproj/project.pbxproj"
+EXPECTED_BUNDLE_ID="net.absdev.RsyncStudio"
+EXPECTED_VERSION="1.0.0"
+EXPECTED_BUILD="1"
+EXPECTED_MIN_MACOS="14.0"
+
+fail() { echo "ERROR: $*" >&2; exit 1; }
+pass() { echo "OK: $*"; }
+
+[[ -f "$PBX" ]] || fail "Missing Xcode project file"
+
+[[ $(grep -c "PRODUCT_BUNDLE_IDENTIFIER = $EXPECTED_BUNDLE_ID;" "$PBX") -ge 2 ]] || fail "Bundle identifier must remain $EXPECTED_BUNDLE_ID in all app configurations"
+pass "Bundle identifier is $EXPECTED_BUNDLE_ID"
+
+[[ $(grep -c "MARKETING_VERSION = $EXPECTED_VERSION;" "$PBX") -ge 2 ]] || fail "Marketing version must be $EXPECTED_VERSION"
+pass "Marketing version is $EXPECTED_VERSION"
+
+[[ $(grep -c "CURRENT_PROJECT_VERSION = $EXPECTED_BUILD;" "$PBX") -ge 2 ]] || fail "Build number must be $EXPECTED_BUILD"
+pass "Build number is $EXPECTED_BUILD"
+
+[[ $(grep -c 'ENABLE_HARDENED_RUNTIME = YES;' "$PBX") -ge 2 ]] || fail "Hardened Runtime must be enabled"
+pass "Hardened Runtime is enabled"
+
+[[ $(grep -c 'ENABLE_APP_SANDBOX = NO;' "$PBX") -ge 2 ]] || fail "App Sandbox baseline changed unexpectedly"
+pass "App Sandbox remains intentionally disabled for direct distribution"
+
+[[ $(grep -c "MACOSX_DEPLOYMENT_TARGET = $EXPECTED_MIN_MACOS;" "$PBX") -ge 2 ]] || fail "macOS deployment target must remain $EXPECTED_MIN_MACOS"
+pass "Minimum macOS is $EXPECTED_MIN_MACOS"
+
+[[ $(grep -c 'INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";' "$PBX") -ge 2 ]] || fail "Application category is missing"
+pass "Application category is Utilities"
+
+if grep -q 'CODE_SIGN_IDENTITY = "Apple Development"' "$PBX"; then
+  fail "A project-level Apple Development identity is pinned; Release distribution must use Developer ID Application"
+fi
+pass "No development certificate is pinned into the project"
+
+if grep -q 'com.apple.security.get-task-allow' "$ROOT/Rsync Studio"/*.entitlements 2>/dev/null; then
+  fail "get-task-allow must never ship in a commercial Release build"
+fi
+pass "No get-task-allow entitlement is present in source entitlements"
+
+cat <<'MSG'
+
+Release identity baseline passed.
+Before the first commercial archive, select your Apple Developer Team in Xcode and ensure the archived app is signed with a "Developer ID Application" certificate. The exact certificate identity is intentionally not committed to source control.
+MSG