Prevent installer bundle relocation

.github/workflows/cleanzip-liquid-glass-icon.yml

@@ -6,7 +6,7 @@ on:
       release_tag:
         description: "Release tag to update"
         required: true
-        default: "v2.6.33"
+        default: "v2.6.34"
       upload_release:
         description: "Upload pkg, zip, and checksums to the release"
         required: true

README.md

@@ -13,7 +13,7 @@
   ·
   <a href="https://lyc280705.github.io/CleanZip/">Product page</a>
   ·
-  <a href="https://github.com/lyc280705/CleanZip/releases/tag/v2.6.33">CleanZip 2.6.33</a>
+  <a href="https://github.com/lyc280705/CleanZip/releases/tag/v2.6.34">CleanZip 2.6.34</a>
   ·
   <a href="#build-from-source">Build from source</a>
 </p>
@@ -59,7 +59,7 @@ It is intentionally small: no always-on background app, no history database, no
 
 ## Download
 
-Download `CleanZip-2.6.33.pkg` from the [latest release](https://github.com/lyc280705/CleanZip/releases/latest). For most users, the `.pkg` installer is the easiest option.
+Download `CleanZip-2.6.34.pkg` from the [latest release](https://github.com/lyc280705/CleanZip/releases/latest). For most users, the `.pkg` installer is the easiest option.
 
 The installer places:
 
@@ -70,9 +70,9 @@ CleanZip is ad-hoc signed for open source distribution, but it is not notarized
 
 For the `.pkg` installer:
 
-1. In Finder, Control-click `CleanZip-2.6.33.pkg` and choose **Open**.
+1. In Finder, Control-click `CleanZip-2.6.34.pkg` and choose **Open**.
 2. If the same warning still appears with only **Done** and **Move to Trash**, open **System Settings** -> **Privacy & Security**.
-3. At the bottom of Privacy & Security, choose **Open Anyway** for `CleanZip-2.6.33.pkg`, then confirm.
+3. At the bottom of Privacy & Security, choose **Open Anyway** for `CleanZip-2.6.34.pkg`, then confirm.
 
 After installation, if macOS blocks `CleanZip.app` itself, Control-click `CleanZip.app` in `/Applications` and choose **Open**. If it is still blocked, use **System Settings** -> **Privacy & Security** -> **Open Anyway** for `CleanZip.app`.
 
@@ -81,11 +81,11 @@ After you approve the installer or app once, macOS opens it normally.
 Advanced terminal alternative for the downloaded package:
 
 ```bash
-xattr -dr com.apple.quarantine ~/Downloads/CleanZip-2.6.33.pkg
-open ~/Downloads/CleanZip-2.6.33.pkg
+xattr -dr com.apple.quarantine ~/Downloads/CleanZip-2.6.34.pkg
+open ~/Downloads/CleanZip-2.6.34.pkg
 ```
 
-Manual installation is also available from `CleanZip-2.6.33.zip`: move `CleanZip.app` to `/Applications` and `CleanZipService.service` to `/Library/Services`.
+Manual installation is also available from `CleanZip-2.6.34.zip`: move `CleanZip.app` to `/Applications` and `CleanZipService.service` to `/Library/Services`.
 
 ## Compatibility
 
@@ -172,7 +172,7 @@ gh workflow run cleanzip-liquid-glass-icon.yml --repo lyc280705/CleanZip --ref m
 To rebuild and update an existing GitHub release asset set:
 
 ```sh
-gh workflow run cleanzip-liquid-glass-icon.yml --repo lyc280705/CleanZip --ref main -f release_tag=v2.6.33 -f upload_release=true
+gh workflow run cleanzip-liquid-glass-icon.yml --repo lyc280705/CleanZip --ref main -f release_tag=v2.6.34 -f upload_release=true
 ```
 
 Lightweight local fallback with Command Line Tools:

work/CleanZipBuild/src/CleanZip-Info.plist

@@ -132,7 +132,7 @@
 	<key>CFBundleShortVersionString</key>
 	<string>2.6</string>
 	<key>CFBundleVersion</key>
-	<string>33</string>
+	<string>34</string>
 	<key>LSApplicationCategoryType</key>
 	<string>public.app-category.utilities</string>
 	<key>LSMinimumSystemVersion</key>

work/CleanZipBuild/src/CleanZipService-Info.plist

@@ -37,7 +37,7 @@
 	<key>CFBundleShortVersionString</key>
 	<string>2.6</string>
 	<key>CFBundleVersion</key>
-	<string>33</string>
+	<string>34</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>14.0</string>
 	<key>LSUIElement</key>

work/CleanZipBuild/src/PackageComponents.plist

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<array>
+	<dict>
+		<key>BundleHasStrictIdentifier</key>
+		<true/>
+		<key>BundleIsRelocatable</key>
+		<false/>
+		<key>BundleIsVersionChecked</key>
+		<true/>
+		<key>BundleOverwriteAction</key>
+		<string>upgrade</string>
+		<key>RootRelativeBundlePath</key>
+		<string>Applications/CleanZip.app</string>
+	</dict>
+	<dict>
+		<key>BundleHasStrictIdentifier</key>
+		<true/>
+		<key>BundleIsRelocatable</key>
+		<false/>
+		<key>BundleIsVersionChecked</key>
+		<true/>
+		<key>BundleOverwriteAction</key>
+		<string>upgrade</string>
+		<key>RootRelativeBundlePath</key>
+		<string>Library/Services/CleanZipService.service</string>
+	</dict>
+</array>
+</plist>

work/CleanZipBuild/src/package.sh

@@ -7,10 +7,11 @@ SERVICE="$ROOT/CleanZipService.service"
 DIST="$ROOT/dist"
 ROOT_DIR="$DIST/pkgroot"
 SCRIPTS_DIR="$DIST/scripts"
+COMPONENT_PLIST="$ROOT/src/PackageComponents.plist"
 
 export COPYFILE_DISABLE=1
 
-if [[ ! -d "$APP" || ! -d "$SERVICE" ]]; then
+if [[ ! -d "$APP" || ! -d "$SERVICE" || ! -f "$COMPONENT_PLIST" ]]; then
   echo "CleanZip.app or CleanZipService.service is missing. Run src/build_xcode.sh or src/build.sh first." >&2
   exit 2
 fi
@@ -54,12 +55,25 @@ chmod +x "$SCRIPTS_DIR/postinstall"
 
 pkgbuild \
   --root "$ROOT_DIR" \
+  --component-plist "$COMPONENT_PLIST" \
   --scripts "$SCRIPTS_DIR" \
   --identifier "local.codex.cleanzip.pkg" \
   --version "$PACKAGE_VERSION" \
   --install-location "/" \
   "$DIST/$PKG_NAME"
 
+PACKAGE_VERIFY_DIR="$DIST/pkgverify"
+pkgutil --expand "$DIST/$PKG_NAME" "$PACKAGE_VERIFY_DIR"
+PACKAGE_INFO="$PACKAGE_VERIFY_DIR/PackageInfo"
+RELOCATE_COUNT="$(xmllint --xpath 'count(/pkg-info/relocate/bundle)' "$PACKAGE_INFO")"
+APP_BUNDLE_PATH="$(xmllint --xpath 'string(/pkg-info/bundle[@id="local.codex.cleanzip"]/@path)' "$PACKAGE_INFO")"
+rm -rf "$PACKAGE_VERIFY_DIR"
+
+if [[ "$RELOCATE_COUNT" != "0" || "$APP_BUNDLE_PATH" != "./Applications/CleanZip.app" ]]; then
+  echo "Package validation failed: CleanZip.app must be fixed at /Applications and non-relocatable." >&2
+  exit 3
+fi
+
 ZIP_ROOT="$DIST/ziproot/CleanZip"
 mkdir -p "$ZIP_ROOT"
 ditto --norsrc "$APP" "$ZIP_ROOT/CleanZip.app"