Commit 825d4f9
Remove per-PR dev builds; split debug/release bundle IDs (#136)
* Fix dev build stranding the wizard on Accessibility
Installing a local dev build over a released Blurt left the Accessibility
step unpassable: the row stayed switched on in System Settings while
AXIsProcessTrusted() kept returning false, so there was no way forward.
TCC pins an Accessibility grant to the app's designated requirement. A
release carries codesign's default Developer ID requirement (leaf CN plus
the Developer ID marker OIDs); dev-build.sh signs with Apple Development
and the project.yml install stamps an explicit team-based requirement. The
two share a bundle id, an install path and a signing team, and still pin
different requirements — so the release's grant is orphaned the moment a
dev build replaces it.
The self-heal that exists for exactly this (runAccessibilityGrantMigration)
never fired, because it recorded the Team ID as the identity and the team
is the one thing that does not change here. Record the designated
requirement itself instead, serialized and namespaced as "dr:<requirement>":
it is what tccd stores and re-checks, so it moves when and only when the
stored copy stops matching. That subsumes the cases the Team ID and cdhash
shapes covered (successive ad-hoc per-PR builds, a switched team) and adds
the two they missed: certificate kind, and a rotated Developer ID cert
orphaning every installed user's grant.
Read through SecCodeCopyDesignatedRequirement rather than the signing-info
dictionary's kSecCodeInfoDesignatedRequirement key, which would need a cast
from Any back to a CoreFoundation type. The team identifier stays as the
probe for "is this signature ad-hoc" — the UI-test carve-out — but is no
longer the recorded value.
The recorded value's shape changes, which re-reads as one identity change
per install. That is safe by construction: decide() only resets when the
app is untrusted, so a working grant is merely re-recorded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016qVXH7zUbK1TTEZWmEAEXS
* Give dev builds their own bundle id; drop the per-PR dev build
Two changes that reinforce each other, plus what they make dead.
**Separate identities.** Every debug configuration now builds as
dev.alex.blurt.dev / "Blurt Dev" and installs to /Applications/Blurt
Dev.app; only Release is dev.alex.blurt / "Blurt". A dev build therefore
sits beside a released Blurt instead of replacing it — two sets of Privacy
& Security rows, two defaults domains, either one runnable. That removes
the collision at the source rather than healing it after the fact: TCC keys
a permission on bundle id plus designated requirement, and the two builds
can never pin the same requirement (Developer ID's default names the leaf
cert; the dev install stamps an explicit team-based one), so sharing an id
meant inheriting rows the new binary could not satisfy.
PRODUCT_NAME stays Blurt in both — it names the executable and the built
product, which every script and DerivedData path is written against. The
debug id is the default and Release opts in to the shipping one, so a
configuration added later cannot accidentally ship under it.
The in-app tccutil reset now targets Bundle.main.bundleIdentifier rather
than BlurtIdentity.subsystem, which would have had a dev build clearing the
released app's grant.
**No per-PR dev build.** Removed the dev-build and dev-build-link jobs,
pr-dev-build.yml, and pr-dev-build-comment.sh. A hosted PR runner can reach
no signing key — the Apple Development cert is per-developer and the
Developer ID key is scoped to release.yml's protected environment — so the
artifact was ad-hoc signed, which pins the cdhash and makes every rebuild a
different app to tccd. Reviewers landed on a Blurt row switched on and
still denied. Reviewers build locally instead.
**Dead code that follows.** With the ad-hoc artifact gone, an ad-hoc
signature is no longer an identity worth recording, so
SigningIdentity.current() drops its includingAdHoc parameter and answers
nil for ad-hoc and unsigned code. That deletes AppDelegate's
adHocCountsAsIdentity and its #if UITEST_HOOKS: the property that kept
uitest.sh and check.sh from wiping the developer's own grant is now
structural rather than a flag the call site had to pass correctly. The
migration's remaining job is the one nothing else can cover — a re-issued
Developer ID certificate orphaning every installed user's grant at once —
and the tests say so.
Signing's Security handshake is now covered against /bin/ls, whose
designated requirement is known and readable on any Mac; the test host's
own signature varies by how the suite was launched and could not assert it.
NOTE: Blurt.xcodeproj/project.pbxproj still needs `xcodegen generate` on a
Mac — the generator does not run on Linux, and check.sh's drift check will
fail until the regenerated project is committed. Info.plist's two changed
values are written here by hand to match what the generator emits.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016qVXH7zUbK1TTEZWmEAEXS
* Narrow reset-install's LaunchServices sweep to Blurt's own bundles
The widened `Blurt[^/]*\.app` pattern matched BlurtUITests-Runner.app too,
so a reset unregistered the XCUITest runner — a bundle this script does not
own and does not re-register afterwards. Match exactly "Blurt.app" and
"Blurt Dev.app" via an optional " Dev" group, spelled as a POSIX BRE
interval so BSD and GNU sed read it the same way.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016qVXH7zUbK1TTEZWmEAEXS
* Regenerate project.pbxproj for the dev bundle-id split
d3fd355 changed project.yml (separate dev bundle id, BLURT_APP_NAME, the
"Blurt Dev.app" install destination) but left the checked-in pbxproj
stale, so check.sh's xcodegen-drift step would fail and an Xcode-driven
build would still install over /Applications/Blurt.app under the release
bundle id. Purely generated output — `xcodegen generate` reproduces this
file exactly.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Alex Kroman <alex@assemblyai.com>1 parent d8491e2 commit 825d4f9
18 files changed
Lines changed: 387 additions & 585 deletions
File tree
- .github/workflows
- App/Blurt
- Blurt.xcodeproj
- Blurt
- Sources/BlurtEngine
- Permissions
- Tests/BlurtEngineTests
- scripts
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
213 | 213 | | |
214 | 214 | | |
215 | 215 | | |
216 | | - | |
217 | | - | |
218 | | - | |
219 | | - | |
220 | | - | |
221 | | - | |
222 | | - | |
223 | | - | |
224 | | - | |
225 | | - | |
226 | | - | |
227 | | - | |
228 | | - | |
229 | | - | |
230 | | - | |
231 | | - | |
232 | | - | |
233 | | - | |
234 | | - | |
235 | | - | |
236 | | - | |
237 | | - | |
238 | | - | |
239 | | - | |
240 | | - | |
241 | | - | |
242 | | - | |
243 | | - | |
244 | | - | |
245 | | - | |
246 | | - | |
247 | | - | |
248 | | - | |
249 | | - | |
250 | | - | |
251 | | - | |
252 | | - | |
253 | | - | |
254 | | - | |
255 | | - | |
256 | | - | |
257 | | - | |
258 | | - | |
259 | | - | |
260 | | - | |
261 | | - | |
262 | | - | |
263 | | - | |
264 | | - | |
265 | | - | |
266 | | - | |
267 | | - | |
268 | | - | |
269 | | - | |
270 | | - | |
271 | | - | |
272 | | - | |
273 | | - | |
274 | | - | |
275 | | - | |
276 | | - | |
277 | | - | |
278 | | - | |
279 | | - | |
280 | | - | |
281 | | - | |
282 | | - | |
283 | | - | |
284 | | - | |
285 | | - | |
286 | | - | |
287 | | - | |
288 | | - | |
289 | | - | |
290 | | - | |
291 | | - | |
292 | | - | |
293 | | - | |
294 | | - | |
295 | | - | |
296 | | - | |
297 | | - | |
298 | | - | |
299 | | - | |
300 | | - | |
301 | | - | |
302 | | - | |
303 | | - | |
304 | | - | |
305 | | - | |
306 | | - | |
307 | | - | |
308 | | - | |
309 | | - | |
310 | | - | |
311 | | - | |
312 | | - | |
313 | | - | |
314 | | - | |
315 | | - | |
316 | | - | |
317 | | - | |
318 | | - | |
319 | | - | |
320 | | - | |
321 | | - | |
322 | | - | |
323 | | - | |
324 | | - | |
325 | | - | |
326 | | - | |
327 | | - | |
328 | | - | |
329 | | - | |
330 | | - | |
331 | | - | |
332 | | - | |
333 | 216 | | |
334 | 217 | | |
335 | 218 | | |
| |||
This file was deleted.
0 commit comments