Major update for stability

2026-09-08 15:22:19 +01:00
parent 3b95f53a25
commit b2f3c5aef6
24 changed files with 1059 additions and 212 deletions
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PROJECT="$ROOT/RsyncManager.xcodeproj"
+SCHEME="RsyncManager"
+
+if [[ "$(uname -s)" != "Darwin" ]]; then
+  echo "release-preflight.sh must run on macOS with Xcode installed." >&2
+  exit 2
+fi
+
+for tool in xcodebuild plutil codesign spctl; do
+  command -v "$tool" >/dev/null || { echo "Missing required tool: $tool" >&2; exit 2; }
+done
+
+"$SCRIPT_DIR/security-check.sh"
+plutil -lint "$ROOT/RsyncManager/Resources/PrivacyInfo.xcprivacy"
+
+BUILD_DIR="$ROOT/build/preflight"
+rm -rf "$BUILD_DIR"
+
+xcodebuild \
+  -project "$PROJECT" \
+  -scheme "$SCHEME" \
+  -configuration Release \
+  -destination 'platform=macOS' \
+  -derivedDataPath "$BUILD_DIR" \
+  CODE_SIGNING_ALLOWED=NO \
+  clean build
+
+APP="$BUILD_DIR/Build/Products/Release/RsyncManager.app"
+test -d "$APP" || { echo "Release app was not produced at $APP" >&2; exit 1; }
+
+echo "Unsigned Release build passed: $APP"
+echo "Next: Archive with Developer ID, notarise, staple, then run the signed-app checks in Docs/RELEASE.md."
@@ -0,0 +1,31 @@
+#!/bin/bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PROJECT="$ROOT/RsyncManager.xcodeproj"
+
+echo "== Rsync Manager project security checks =="
+grep -q 'ENABLE_HARDENED_RUNTIME = YES' "$PROJECT/project.pbxproj"
+grep -q 'ENABLE_APP_SANDBOX = NO' "$PROJECT/project.pbxproj"
+grep -q 'INFOPLIST_KEY_CFBundleIconName = AppIcon' "$PROJECT/project.pbxproj"
+test -f "$ROOT/RsyncManager/Resources/PrivacyInfo.xcprivacy"
+
+if grep -R --line-number -E 'StrictHostKeyChecking[ =]+no|UserKnownHostsFile[ =]+/dev/null|sshpass' "$ROOT/RsyncManager" --include='*.swift'; then
+    echo "Unsafe SSH configuration detected." >&2
+    exit 1
+fi
+
+grep -q 'BatchMode=yes' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
+grep -q 'allowUnattendedDelete' "$ROOT/RsyncManager/Models/SyncJob.swift"
+grep -q 'RsyncSecurityValidator' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
+grep -q 'isSafeRemotePath' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
+grep -q 'hasBalancedShellSyntax' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
+grep -q -- '--files-from' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
+grep -q -- '--log-file' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
+
+echo "Static policy checks passed."
+echo ""
+echo "After creating a signed Release app, also run:"
+echo "  codesign --verify --deep --strict --verbose=2 /path/to/RsyncManager.app"
+echo "  spctl --assess --type execute --verbose=4 /path/to/RsyncManager.app"
+echo "  xcrun stapler validate /path/to/RsyncManager.app"