fix: prevent macOS package staging from competing with installed app #23

Merged

erik merged 1 commit from fix/task-060d38bf-macos-package-staging into main 2026-09-24 05:58:23 -05:00

Conversation 1 Commits 1 Files changed 6 +160 -5

erik commented 2026-09-23 22:57:07 -05:00

Owner

Copy link

Summary

Stop leaving generated KvshareMac app bundles registered alongside the installed app. On the affected Mac, removing five generated registrations and reconnecting the installed app restored Local Network connectivity without changing a privacy grant.

Task

• task-060d38bf — Keep macOS package staging out of app registrations
• Follow-up to the deployed mirroring release; task-0318d385 remains done.

Changes

• Stage macOS packages in unique temporary workspaces rather than build/macos-package.
• On exit, inspect Launch Services and unregister only the matching staged app if present, then remove the workspace. Preserve original failure status and report cleanup failures.
• Handle INT/TERM through the same cleanup path; keep packages/checksums outside staging.
• Add cross-platform cleanup tests for registered/unregistered/incomplete bundles, failure statuses, inspection/unregistration/removal errors, paths containing spaces, unrelated registrations, and retained package/installed-app fixtures.
• Document duplicate-registration diagnosis, extraction cleanup, and actual installed-app upgrade verification rather than terminal probes or repeated permission toggling.

Testing

• Unit tests added/updated: 12 cleanup scenarios, included in release tooling tests.
• ./scripts/pre-pr.sh passes: Rust formatting/clippy/tests, Swift formatting/build/tests, release tooling.
• Real Apple-signed local package build succeeded; checksum verified, temporary workspace removed, only /Applications/KvshareMac.app remained registered.
• Expanded a test package in a disposable workspace: strict/deep signature and designated requirement verified, version 0.2.0 verified, Info.plist/config/LaunchAgent compared successfully; inspection workspace cleaned up.
• Installed app remained Input: Ready / Connection: Connected after package building.
• No permission toggles/resets, privacy-database writes, installer execution, installed-app replacement, or configuration changes during recovery or these tests.

Evidence and limits

• Before recovery: six registered KvshareMac bundles (installed plus five generated copies), same bundle ID and executable UUID; installed app logged Local network prohibited.
• After unregistering only the five generated copies and Disable/Enable: installed app connected; Network.framework logged state ready at 2026-09-23 22:43:46 CDT.
• Apple TN3179 documents unexpected Local Network privacy behavior with multiple installed app versions. This identifies a concrete packaging defect and successful recovery, not a guarantee against every macOS privacy failure.
• pkgbuild emitted four write: Permission denied diagnostics while returning success; the resulting extracted payload passed strict/deep code-signature verification and metadata/config comparisons. No diagnostic was suppressed.
• Test packages are unpublished build-validation artifacts, not a new release or replacement for published v0.2.0.
• A future version-to-version installed-app upgrade and live two-screen typing smoke test have not been performed; the documentation makes those separate release-verification requirements.

Checklist

• ./scripts/pre-pr.sh passes
• Documentation updated
• No unrelated changes included
• CI green
• Review complete
• Explicit human merge approval

## Summary Stop leaving generated KvshareMac app bundles registered alongside the installed app. On the affected Mac, removing five generated registrations and reconnecting the installed app restored Local Network connectivity without changing a privacy grant. ## Task - task-060d38bf — Keep macOS package staging out of app registrations - Follow-up to the deployed mirroring release; task-0318d385 remains done. ## Changes - Stage macOS packages in unique temporary workspaces rather than build/macos-package. - On exit, inspect Launch Services and unregister only the matching staged app if present, then remove the workspace. Preserve original failure status and report cleanup failures. - Handle INT/TERM through the same cleanup path; keep packages/checksums outside staging. - Add cross-platform cleanup tests for registered/unregistered/incomplete bundles, failure statuses, inspection/unregistration/removal errors, paths containing spaces, unrelated registrations, and retained package/installed-app fixtures. - Document duplicate-registration diagnosis, extraction cleanup, and actual installed-app upgrade verification rather than terminal probes or repeated permission toggling. ## Testing - [x] Unit tests added/updated: 12 cleanup scenarios, included in release tooling tests. - [x] `./scripts/pre-pr.sh` passes: Rust formatting/clippy/tests, Swift formatting/build/tests, release tooling. - [x] Real Apple-signed local package build succeeded; checksum verified, temporary workspace removed, only /Applications/KvshareMac.app remained registered. - [x] Expanded a test package in a disposable workspace: strict/deep signature and designated requirement verified, version 0.2.0 verified, Info.plist/config/LaunchAgent compared successfully; inspection workspace cleaned up. - [x] Installed app remained Input: Ready / Connection: Connected after package building. - [x] No permission toggles/resets, privacy-database writes, installer execution, installed-app replacement, or configuration changes during recovery or these tests. ### Evidence and limits - Before recovery: six registered KvshareMac bundles (installed plus five generated copies), same bundle ID and executable UUID; installed app logged Local network prohibited. - After unregistering only the five generated copies and Disable/Enable: installed app connected; Network.framework logged state ready at 2026-09-23 22:43:46 CDT. - Apple TN3179 documents unexpected Local Network privacy behavior with multiple installed app versions. This identifies a concrete packaging defect and successful recovery, not a guarantee against every macOS privacy failure. - pkgbuild emitted four `write: Permission denied` diagnostics while returning success; the resulting extracted payload passed strict/deep code-signature verification and metadata/config comparisons. No diagnostic was suppressed. - Test packages are unpublished build-validation artifacts, not a new release or replacement for published v0.2.0. - A future version-to-version installed-app upgrade and live two-screen typing smoke test have not been performed; the documentation makes those separate release-verification requirements. ## Checklist - [x] `./scripts/pre-pr.sh` passes - [x] Documentation updated - [x] No unrelated changes included - [ ] CI green - [ ] Review complete - [ ] Explicit human merge approval

erik added 1 commit 2026-09-23 22:57:07 -05:00

fix: keep package staging out of macOS app registrations ... 4f22d65965

Dispose of staging bundles and unregister only matching copies so package builds do not leave competing Local Network identities. Preserve failure status and document installed-app upgrade checks instead of permission-toggle workarounds.

Task: task-060d38bf

erik commented 2026-09-23 22:59:51 -05:00

Author

Owner

Copy link

Review update

• PR: #23 — open, commit 4f22d65965.
• Result: approved for the scoped packaging/diagnostics change.
• CI: Rust and Swift jobs both passed, run 80. Local pre-PR checks passed.
• Follow-up: wait for explicit human merge approval; do not merge automatically. A future version-to-version permission-preservation test remains separate from this packaging fix.

Acceptance criteria

1. Met — packaging now uses mktemp instead of persistent build/macos-package staging.
2. Met — cleanup matches only its app's exact/canonical registered path, skips unregistered/incomplete bundles, removes staging, preserves original nonzero status, and reports inspection/unregistration/removal errors. EXIT and handled INT/TERM converge on cleanup.
3. Met — 12 automated cleanup scenarios cover normal/error paths, interrupted exit statuses, unregistered/incomplete bundles, unrelated registration entries, paths containing spaces, and preservation of installed-app/package fixtures; release checks invoke them.
4. Met — real Apple-signed package build and checksum verification passed; temporary workspace was removed and only the installed app remained registered. Separately extracted payload passed strict/deep signature checks, designated-requirement inspection, and metadata/config comparisons.
5. Met — macOS/release docs explain duplicate registrations and require actual installed-app upgrade checks without permission toggling; terminal probes are explicitly insufficient.
6. Met — recorded installed-app recovery without privacy changes after unregistering five generated copies and reconnecting; connected state persisted through package validation. Future version-to-version upgrade and live typing checks are explicitly not claimed.

Quality and scope

• No app protocol/behavior, installed binary, signing identity, configuration, or privacy-policy changes.
• Cleanup operates on the disposable workspace and only its own app registration; failure handling is explicit and tested.
• pkgbuild's four stderr write: Permission denied diagnostics are retained in validation evidence; it returned success and the extracted signed payload/metadata verified. They are not being represented as a silent success or as proof of future upgrade behavior.
• Blocking findings in this diff: 0. Non-blocking review findings: 0.

PR Review Worker Result

• pr: open
• review: approved
• pr_comment: posted
• task_comment: posted
• blocking_issues: 0
• warnings: 0
• criteria_total: 6
• criteria_met: 6
• criteria_missing: 0

### Review update - PR: https://forge.caradoc.com/erik/kvshare/pulls/23 — open, commit 4f22d65965. - Result: **approved** for the scoped packaging/diagnostics change. - CI: Rust and Swift jobs both passed, run 80. Local pre-PR checks passed. - Follow-up: wait for explicit human merge approval; do not merge automatically. A future version-to-version permission-preservation test remains separate from this packaging fix. ### Acceptance criteria 1. **Met** — packaging now uses mktemp instead of persistent build/macos-package staging. 2. **Met** — cleanup matches only its app's exact/canonical registered path, skips unregistered/incomplete bundles, removes staging, preserves original nonzero status, and reports inspection/unregistration/removal errors. EXIT and handled INT/TERM converge on cleanup. 3. **Met** — 12 automated cleanup scenarios cover normal/error paths, interrupted exit statuses, unregistered/incomplete bundles, unrelated registration entries, paths containing spaces, and preservation of installed-app/package fixtures; release checks invoke them. 4. **Met** — real Apple-signed package build and checksum verification passed; temporary workspace was removed and only the installed app remained registered. Separately extracted payload passed strict/deep signature checks, designated-requirement inspection, and metadata/config comparisons. 5. **Met** — macOS/release docs explain duplicate registrations and require actual installed-app upgrade checks without permission toggling; terminal probes are explicitly insufficient. 6. **Met** — recorded installed-app recovery without privacy changes after unregistering five generated copies and reconnecting; connected state persisted through package validation. Future version-to-version upgrade and live typing checks are explicitly not claimed. ### Quality and scope - No app protocol/behavior, installed binary, signing identity, configuration, or privacy-policy changes. - Cleanup operates on the disposable workspace and only its own app registration; failure handling is explicit and tested. - pkgbuild's four stderr `write: Permission denied` diagnostics are retained in validation evidence; it returned success and the extracted signed payload/metadata verified. They are not being represented as a silent success or as proof of future upgrade behavior. - Blocking findings in this diff: **0**. Non-blocking review findings: **0**. ### PR Review Worker Result - pr: open - review: approved - pr_comment: posted - task_comment: posted - blocking_issues: 0 - warnings: 0 - criteria_total: 6 - criteria_met: 6 - criteria_missing: 0

erik merged commit 2dc42a1109 into main 2026-09-24 05:58:23 -05:00

erik referenced this pull request from a commit 2026-09-24 05:58:24 -05:00

Merge pull request 'fix: prevent macOS package staging from competing with installed app' (#23) from fix/task-060d38bf-macos-package-staging into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

erik/kvshare!23

No description provided.