From 8ecab43818234fc65344c869eea96d6914b4ae83 Mon Sep 17 00:00:00 2001 From: zqxwce Date: Tue, 28 Jul 2026 12:56:10 +0300 Subject: [PATCH] ci: build the portable .app in the release workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release workflow ran `make bundle`, which produces a lean .app (binary + ldid + signcert + icon only) — missing the bundled scripts/patchers/resources/ requirements.txt/vphoned/.tools — so published release assets were not self-contained and `brew install` copies couldn't run the fw/restore/cfw pipeline. Switch to ./scripts/build.sh (the canonical portable build): - also init the scripts/resources storage submodule + the scripts/repos/{trustcache,insert_dylib} tool sources - build .tools/bin/{trustcache,insert_dylib} (mirrors setup_tools steps 2-3; its venv + sshpass steps aren't needed to build) - run build.sh, then fail the job if the bundle is missing any runtime asset or the virtualization entitlement before packaging + uploading Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01Y4VDqWf5pVakcFLqB23CKe --- .github/workflows/release.yml | 61 +++++++++++++++++++++++++---------- 1 file changed, 44 insertions(+), 17 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a422a06..cce6feb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,8 +1,10 @@ name: release -# Build the signed vphone-cli.app and attach it to a published GitHub Release. -# Signing is ad-hoc (codesign --sign -) with sources/vphone.entitlements, exactly -# like a local `make bundle` — no Developer ID certificate or secrets required. +# Build the portable, signed vphone-cli.app and attach it to a published +# GitHub Release. Uses ./scripts/build.sh (the canonical build) so the .app +# ships self-contained — bundled scripts/patchers/resources/requirements.txt/ +# vphoned/.tools — not the lean `make bundle` output. Signing is ad-hoc +# (codesign --sign -) with sources/vphone.entitlements; no secrets required. on: release: @@ -18,35 +20,60 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Init build submodules - # --recursive: libcapstone-spm builds capstone from its own nested - # Vendor/capstone submodule. Scoped to these paths, so the large - # scripts/resources storage submodule is still skipped. + - name: Init submodules + # vendor/* (--recursive: libcapstone-spm builds capstone from its own + # nested submodule) for the Swift build; scripts/resources is the CFW + # asset storage that build.sh bundles into the .app; scripts/repos/* + # provide the trustcache/insert_dylib tool sources. run: | git submodule update --init --recursive --depth 1 \ vendor/swift-argument-parser \ vendor/Dynamic \ vendor/libcapstone-spm \ vendor/libimg4-spm \ - vendor/MachOKit + vendor/MachOKit \ + scripts/resources \ + scripts/repos/trustcache \ + scripts/repos/insert_dylib - name: Toolchain versions run: | swift --version xcodebuild -version - - name: Install ldid - run: brew install ldid-procursus + - name: Install build deps + run: brew install ldid-procursus openssl@3 - - name: Build and bundle - run: make bundle - - - name: Verify entitlements + - name: Build .tools/bin/{trustcache,insert_dylib} + # build.sh bundles these runtime tools into the .app and errors if + # absent. Mirrors scripts/setup_tools.sh steps [2/4] and [3/4]; its + # venv ([4/4]) and sshpass ([1/4]) steps aren't needed to build. run: | + set -euo pipefail + mkdir -p .tools/bin + openssl_prefix="$(brew --prefix openssl@3)" + make -C scripts/repos/trustcache \ + OPENSSL=1 \ + CFLAGS="-I${openssl_prefix}/include -DOPENSSL -w" \ + LDFLAGS="-L${openssl_prefix}/lib" \ + -j"$(sysctl -n hw.logicalcpu)" + cp scripts/repos/trustcache/trustcache .tools/bin/trustcache + clang -o .tools/bin/insert_dylib \ + scripts/repos/insert_dylib/insert_dylib/main.c -framework Security -O2 + + - name: Build and bundle (portable .app) + run: ./scripts/build.sh + + - name: Verify the bundle is portable-complete and entitled + run: | + set -euo pipefail + res=.build/vphone-cli.app/Contents/Resources + for p in scripts/fw_prepare.sh scripts/patchers/cfw.py scripts/resources \ + requirements.txt vphoned.signed .tools/bin/trustcache .tools/bin/insert_dylib; do + [ -e "$res/$p" ] || { echo "::error::bundle is missing $p — not portable"; exit 1; } + done bin=.build/vphone-cli.app/Contents/MacOS/vphone-cli - ents=$(codesign -d --entitlements - "$bin" 2>&1) - echo "$ents" - echo "$ents" | grep -q 'com.apple.private.virtualization' \ + codesign -d --entitlements - "$bin" 2>&1 | grep -q 'com.apple.private.virtualization' \ || { echo "::error::required virtualization entitlement missing from signed app"; exit 1; } - name: Package app