From a99b4250b58047b36d892557b4ed90b38e84f83b Mon Sep 17 00:00:00 2001 From: Yuchen Lin <381564291@qq.com> Date: Sat, 11 Jul 2026 21:37:06 +0800 Subject: [PATCH] Prevent installer bundle relocation --- .../workflows/cleanzip-liquid-glass-icon.yml | 2 +- README.md | 16 +++++----- work/CleanZipBuild/src/CleanZip-Info.plist | 2 +- .../src/CleanZipService-Info.plist | 2 +- .../CleanZipBuild/src/PackageComponents.plist | 30 +++++++++++++++++++ work/CleanZipBuild/src/package.sh | 16 +++++++++- 6 files changed, 56 insertions(+), 12 deletions(-) create mode 100644 work/CleanZipBuild/src/PackageComponents.plist diff --git a/.github/workflows/cleanzip-liquid-glass-icon.yml b/.github/workflows/cleanzip-liquid-glass-icon.yml index 85c3321..0afcc7d 100644 --- a/.github/workflows/cleanzip-liquid-glass-icon.yml +++ b/.github/workflows/cleanzip-liquid-glass-icon.yml @@ -6,7 +6,7 @@ on: release_tag: description: "Release tag to update" required: true - default: "v2.6.33" + default: "v2.6.34" upload_release: description: "Upload pkg, zip, and checksums to the release" required: true diff --git a/README.md b/README.md index db32c67..5cc83c6 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ · Product page · - CleanZip 2.6.33 + CleanZip 2.6.34 · Build from source

@@ -59,7 +59,7 @@ It is intentionally small: no always-on background app, no history database, no ## Download -Download `CleanZip-2.6.33.pkg` from the [latest release](https://github.com/lyc280705/CleanZip/releases/latest). For most users, the `.pkg` installer is the easiest option. +Download `CleanZip-2.6.34.pkg` from the [latest release](https://github.com/lyc280705/CleanZip/releases/latest). For most users, the `.pkg` installer is the easiest option. The installer places: @@ -70,9 +70,9 @@ CleanZip is ad-hoc signed for open source distribution, but it is not notarized For the `.pkg` installer: -1. In Finder, Control-click `CleanZip-2.6.33.pkg` and choose **Open**. +1. In Finder, Control-click `CleanZip-2.6.34.pkg` and choose **Open**. 2. If the same warning still appears with only **Done** and **Move to Trash**, open **System Settings** -> **Privacy & Security**. -3. At the bottom of Privacy & Security, choose **Open Anyway** for `CleanZip-2.6.33.pkg`, then confirm. +3. At the bottom of Privacy & Security, choose **Open Anyway** for `CleanZip-2.6.34.pkg`, then confirm. After installation, if macOS blocks `CleanZip.app` itself, Control-click `CleanZip.app` in `/Applications` and choose **Open**. If it is still blocked, use **System Settings** -> **Privacy & Security** -> **Open Anyway** for `CleanZip.app`. @@ -81,11 +81,11 @@ After you approve the installer or app once, macOS opens it normally. Advanced terminal alternative for the downloaded package: ```bash -xattr -dr com.apple.quarantine ~/Downloads/CleanZip-2.6.33.pkg -open ~/Downloads/CleanZip-2.6.33.pkg +xattr -dr com.apple.quarantine ~/Downloads/CleanZip-2.6.34.pkg +open ~/Downloads/CleanZip-2.6.34.pkg ``` -Manual installation is also available from `CleanZip-2.6.33.zip`: move `CleanZip.app` to `/Applications` and `CleanZipService.service` to `/Library/Services`. +Manual installation is also available from `CleanZip-2.6.34.zip`: move `CleanZip.app` to `/Applications` and `CleanZipService.service` to `/Library/Services`. ## Compatibility @@ -172,7 +172,7 @@ gh workflow run cleanzip-liquid-glass-icon.yml --repo lyc280705/CleanZip --ref m To rebuild and update an existing GitHub release asset set: ```sh -gh workflow run cleanzip-liquid-glass-icon.yml --repo lyc280705/CleanZip --ref main -f release_tag=v2.6.33 -f upload_release=true +gh workflow run cleanzip-liquid-glass-icon.yml --repo lyc280705/CleanZip --ref main -f release_tag=v2.6.34 -f upload_release=true ``` Lightweight local fallback with Command Line Tools: diff --git a/work/CleanZipBuild/src/CleanZip-Info.plist b/work/CleanZipBuild/src/CleanZip-Info.plist index 5971867..8e03786 100644 --- a/work/CleanZipBuild/src/CleanZip-Info.plist +++ b/work/CleanZipBuild/src/CleanZip-Info.plist @@ -132,7 +132,7 @@ CFBundleShortVersionString 2.6 CFBundleVersion - 33 + 34 LSApplicationCategoryType public.app-category.utilities LSMinimumSystemVersion diff --git a/work/CleanZipBuild/src/CleanZipService-Info.plist b/work/CleanZipBuild/src/CleanZipService-Info.plist index 04d5340..be41eea 100644 --- a/work/CleanZipBuild/src/CleanZipService-Info.plist +++ b/work/CleanZipBuild/src/CleanZipService-Info.plist @@ -37,7 +37,7 @@ CFBundleShortVersionString 2.6 CFBundleVersion - 33 + 34 LSMinimumSystemVersion 14.0 LSUIElement diff --git a/work/CleanZipBuild/src/PackageComponents.plist b/work/CleanZipBuild/src/PackageComponents.plist new file mode 100644 index 0000000..6cfd32b --- /dev/null +++ b/work/CleanZipBuild/src/PackageComponents.plist @@ -0,0 +1,30 @@ + + + + + + BundleHasStrictIdentifier + + BundleIsRelocatable + + BundleIsVersionChecked + + BundleOverwriteAction + upgrade + RootRelativeBundlePath + Applications/CleanZip.app + + + BundleHasStrictIdentifier + + BundleIsRelocatable + + BundleIsVersionChecked + + BundleOverwriteAction + upgrade + RootRelativeBundlePath + Library/Services/CleanZipService.service + + + diff --git a/work/CleanZipBuild/src/package.sh b/work/CleanZipBuild/src/package.sh index 7ec7c57..6347ed0 100755 --- a/work/CleanZipBuild/src/package.sh +++ b/work/CleanZipBuild/src/package.sh @@ -7,10 +7,11 @@ SERVICE="$ROOT/CleanZipService.service" DIST="$ROOT/dist" ROOT_DIR="$DIST/pkgroot" SCRIPTS_DIR="$DIST/scripts" +COMPONENT_PLIST="$ROOT/src/PackageComponents.plist" export COPYFILE_DISABLE=1 -if [[ ! -d "$APP" || ! -d "$SERVICE" ]]; then +if [[ ! -d "$APP" || ! -d "$SERVICE" || ! -f "$COMPONENT_PLIST" ]]; then echo "CleanZip.app or CleanZipService.service is missing. Run src/build_xcode.sh or src/build.sh first." >&2 exit 2 fi @@ -54,12 +55,25 @@ chmod +x "$SCRIPTS_DIR/postinstall" pkgbuild \ --root "$ROOT_DIR" \ + --component-plist "$COMPONENT_PLIST" \ --scripts "$SCRIPTS_DIR" \ --identifier "local.codex.cleanzip.pkg" \ --version "$PACKAGE_VERSION" \ --install-location "/" \ "$DIST/$PKG_NAME" +PACKAGE_VERIFY_DIR="$DIST/pkgverify" +pkgutil --expand "$DIST/$PKG_NAME" "$PACKAGE_VERIFY_DIR" +PACKAGE_INFO="$PACKAGE_VERIFY_DIR/PackageInfo" +RELOCATE_COUNT="$(xmllint --xpath 'count(/pkg-info/relocate/bundle)' "$PACKAGE_INFO")" +APP_BUNDLE_PATH="$(xmllint --xpath 'string(/pkg-info/bundle[@id="local.codex.cleanzip"]/@path)' "$PACKAGE_INFO")" +rm -rf "$PACKAGE_VERIFY_DIR" + +if [[ "$RELOCATE_COUNT" != "0" || "$APP_BUNDLE_PATH" != "./Applications/CleanZip.app" ]]; then + echo "Package validation failed: CleanZip.app must be fixed at /Applications and non-relocatable." >&2 + exit 3 +fi + ZIP_ROOT="$DIST/ziproot/CleanZip" mkdir -p "$ZIP_ROOT" ditto --norsrc "$APP" "$ZIP_ROOT/CleanZip.app"