sdaduanbilei/cc-haha
1
0
Fork 0
mirror of https://github.com/NanmiCoder/cc-haha synced 2026-07-16 13:03:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix macOS build artifacts to keep notification identity stable

Browse Source 
The notification bridge fix was correct, but the local macOS build script still left Tauri's raw app and DMG outputs available with the executable's ad-hoc signing identifier. Opening that raw artifact made macOS treat notification authorization as a different app identity, so the UI could fall back to the unsupported environment state even though the canonical output worked.

Normalize the Tauri-produced app bundle in place before copying it to the canonical output, then replace the Tauri-generated DMG with the rebuilt canonical DMG. This keeps every path printed by the build script on the same bundle identity and prevents testers from accidentally opening the unstable raw artifact.

Constraint: Local test builds use ad-hoc signing, but macOS notification authorization still depends on stable app identity.
Rejected: Only tell testers to open canonical output | the script still printed and preserved misleading usable-looking artifacts.
Confidence: high
Scope-risk: narrow
Directive: Keep Tauri raw app and canonical app signing identifiers aligned before reporting build artifacts as runnable.
Tested: bash -n desktop/scripts/build-macos-arm64.sh
Tested: SKIP_INSTALL=1 ./desktop/scripts/build-macos-arm64.sh
Tested: codesign -dv --verbose=4 shows com.claude-code-haha.desktop for both target bundle app and canonical app
Tested: hdiutil verify target DMG and canonical DMG
Tested: Computer Use opened target bundle app and verified Settings -> General shows notifications as authorized.
Not-tested: Fresh first-time notification prompt after resetting macOS notification permissions for this bundle id.
This commit is contained in:
程序员阿江(Relakkes) 2026-05-08 11:11:20 +08:00
parent 28955bf74a
commit bcab84e072
1 changed files with 25 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
desktop/scripts/build-macos-arm64.sh
View File

@ -281,11 +281,13 @@ sign_canonical_app_bundle() {
codesign --verify --deep --strict --verbose=2 "${app_bundle}"
}
if [[ -n "${LATEST_DMG}" ]]; then
cp -f "${LATEST_DMG}" "${CANONICAL_OUTPUT_DIR}/"
fi
if [[ -n "${LATEST_APP}" ]]; then
# Normalize the Tauri-produced app in place before copying it anywhere.
# Without this, opening target/.../bundle/macos/Claude Code Haha.app directly
# uses the executable's ad-hoc signing identifier instead of the app bundle id,
# which makes macOS notification authorization behave like a different app.
sign_canonical_app_bundle "${LATEST_APP}"
# 不要 deep re-sign。曾经脚本在这里跑过
# `codesign --force --deep --sign - --identifier <bundle-id>` 来统一
# sidecar 和外层的 signing identifier,但这会改变 sidecar binary 的
@ -296,16 +298,25 @@ if [[ -n "${LATEST_APP}" ]]; then
cp -R "${LATEST_APP}" "${CANONICAL_OUTPUT_DIR}/"
sign_canonical_app_bundle "${CANONICAL_OUTPUT_DIR}/${APP_BUNDLE_NAME}"
rm -f "${CANONICAL_OUTPUT_DIR}/"*.dmg
CANONICAL_DMG="${CANONICAL_OUTPUT_DIR}/$(basename "${LATEST_DMG:-Claude Code Haha_0.1.0_aarch64.dmg}")"
build_canonical_dmg \
"${CANONICAL_OUTPUT_DIR}/${APP_BUNDLE_NAME}" \
"${CANONICAL_OUTPUT_DIR}/$(basename "${LATEST_DMG:-Claude Code Haha_0.1.0_aarch64.dmg}")"
"${CANONICAL_DMG}"
if [[ -n "${LATEST_DMG}" ]]; then
cp -f "${CANONICAL_DMG}" "${LATEST_DMG}"
fi
elif [[ -n "${LATEST_DMG}" ]]; then
cp -f "${LATEST_DMG}" "${CANONICAL_OUTPUT_DIR}/"
fi
cat > "${CANONICAL_OUTPUT_DIR}/BUILD_INFO.txt" <<EOF
Target triple: ${TARGET_TRIPLE}
Canonical output: ${CANONICAL_OUTPUT_DIR}
Source DMG: ${LATEST_DMG:-not found}
Source app: ${LATEST_APP:-not found}
Canonical app: ${CANONICAL_OUTPUT_DIR}/${APP_BUNDLE_NAME}
Canonical DMG: ${CANONICAL_DMG:-not found}
Tauri app output: ${LATEST_APP:-not found}
Tauri DMG output: ${LATEST_DMG:-not found}
Built at: $(date '+%Y-%m-%d %H:%M:%S %z')
EOF
@ -315,18 +326,18 @@ fi
echo
echo "[build-macos-arm64] Build finished."
if [[ -n "${LATEST_DMG}" ]]; then
echo "[build-macos-arm64] DMG source: ${LATEST_DMG}"
else
echo "[build-macos-arm64] No DMG found in ${TARGETED_DMG_DIR} or ${FALLBACK_DMG_DIR}" >&2
fi
if [[ -n "${LATEST_APP}" ]]; then
echo "[build-macos-arm64] App source: ${LATEST_APP}"
echo "[build-macos-arm64] Tauri app output (identity normalized): ${LATEST_APP}"
else
echo "[build-macos-arm64] No .app found in ${TARGETED_APP_DIR} or ${FALLBACK_APP_DIR}" >&2
fi
if [[ -n "${LATEST_DMG}" ]]; then
echo "[build-macos-arm64] Tauri DMG output (replaced with canonical DMG): ${LATEST_DMG}"
else
echo "[build-macos-arm64] No DMG found in ${TARGETED_DMG_DIR} or ${FALLBACK_DMG_DIR}" >&2
fi
echo "[build-macos-arm64] Canonical output: ${CANONICAL_OUTPUT_DIR}"
echo "[build-macos-arm64] Removed legacy bundle dir: ${LEGACY_BUNDLE_ROOT}"