Something went wrong. Try again.
fork of prime agent with changes i want but are not upstreamable probqbly (and some fixes)
Something went wrong. Try again.
2.0 kB · 36 lines
JavaScript
at main
12345678910111213141516171819202122232425262728293031323334353637#!/usr/bin/env nodeimport { execFileSync } from "node:child_process";import { resolve } from "node:path";import { pathToFileURL } from "node:url";import { darwinReleasePlatforms, releasePlatforms } from "../../../scripts/release-platforms.mjs";
function requiresMacosSigning(platform) { if (!releasePlatforms.includes(platform)) throw new Error(`Unsupported binary platform: ${platform}`); if (!darwinReleasePlatforms.includes(platform)) return false; if (process.platform !== "darwin") throw new Error("Darwin binaries must be signed and verified on macOS"); return true;}
export function verifyMacosBinary(binary, platform) { if (!requiresMacosSigning(platform)) return; execFileSync("/usr/bin/codesign", ["--verify", "--deep", "--strict", "--verbose=4", resolve(binary)], { stdio: "inherit" });}
export function signMacosBinary(binary, platform) { if (!requiresMacosSigning(platform)) return; // Bun 1.4.0 emits invalid page hashes. Apple must replace its signature, not preserve it. // Preserve Intel hardened runtime and Bun's JSC grants; do not add permissions on arm64. // These are Bun's compatibility grants, not a claim of minimum required permissions. // https://github.com/oven-sh/bun/blob/bun-v1.4.0/entitlements.plist // https://github.com/oven-sh/bun/blob/bun-v1.4.0/docs/guides/runtime/codesign-macos-executable.mdx execFileSync("/usr/bin/codesign", ["--force", "--sign", "-", "--preserve-metadata=entitlements,flags", resolve(binary)], { stdio: "inherit" }); verifyMacosBinary(binary, platform);}
if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) { const [command, binary, platform, ...extra] = process.argv.slice(2); if (!binary || !platform || extra.length || !["sign", "verify"].includes(command)) throw new Error("Usage: node macos-signature.mjs sign|verify <binary> <platform>"); if (command === "sign") signMacosBinary(binary, platform); else verifyMacosBinary(binary, platform);}