freecode-sh 0.1.0-alpha.19 → 0.1.0-alpha.21

package/install.sh

@@ -9,6 +9,14 @@ DEFAULT_CHANNEL="alpha"
 DEFAULT_DOWNLOAD_BASE_URL="https://releases.freecode.sh/releases"
 DEFAULT_CHANNEL_BASE_URL="https://releases.freecode.sh/channels"
 EXPECTED_TEAM_IDENTIFIER="GD597P8KJ2"
+# Apple code requirement language. "anchor apple generic" forces the signing
+# chain to terminate at Apple's root certificate, so only a real Developer ID
+# certificate issued to this team can satisfy it. Text printed by
+# `codesign --display` cannot be trusted for this: Authority and TeamIdentifier
+# lines are read straight out of the certificate, so a self-signed certificate
+# can present any subject and OU it likes.
+RELEASE_CODE_REQUIREMENT="=anchor apple generic and certificate leaf[subject.OU] = \"$EXPECTED_TEAM_IDENTIFIER\""
+CODESIGN_BIN="/usr/bin/codesign"
 LEGACY_ALPHA6_MANIFEST_SHA256="1bf63e0d6114b12d61c07094936bd2606ae82ce87d5b054fbfb01c5f3d3646d8"
 LAUNCHER_RELATIVE_PATH="bin/freecode"
 INTERFACE_RELATIVE_PATH="libexec/freecode/freecode-tui"
@@ -374,6 +382,18 @@ validate_release_security() {
   esac
 }
 
+# Test-only seam. Signature verification runs /usr/bin/codesign by absolute path
+# so nothing on PATH can impersonate it; the installer test suite substitutes a
+# stub, and like every other FREECODE_TEST_* override it is refused unless the
+# release is being read from a local file:// URL.
+resolve_codesign_bin() {
+  [ -n "${FREECODE_TEST_CODESIGN_BIN:-}" ] || return 0
+  case "$DOWNLOAD_BASE_URL" in
+    file://*) CODESIGN_BIN="$FREECODE_TEST_CODESIGN_BIN" ;;
+    *) fail "the test codesign override is permitted only with local file URLs" ;;
+  esac
+}
+
 verify_release_signatures() {
   root=$1
   if [ "$RELEASE_MODE" = "unsigned-override" ]; then
@@ -381,19 +401,15 @@ verify_release_signatures() {
     return
   fi
 
-  [ -x /usr/bin/codesign ] || fail "/usr/bin/codesign is required to verify this release"
+  [ -x "$CODESIGN_BIN" ] || fail "$CODESIGN_BIN is required to verify this release"
   for executable in \
     "$root/$LAUNCHER_RELATIVE_PATH" \
     "$root/$INTERFACE_RELATIVE_PATH" \
     "$root/$ENGINE_RELATIVE_PATH"
   do
-    /usr/bin/codesign --verify --strict --verbose=2 "$executable" \
-      || fail "Apple signature verification failed for $executable"
-    SIGNATURE_DETAILS=$(/usr/bin/codesign --display --verbose=4 "$executable" 2>&1) \
-      || fail "could not inspect Apple signature for $executable"
-    TEAM_IDENTIFIER=$(printf '%s\n' "$SIGNATURE_DETAILS" | sed -n 's/^TeamIdentifier=//p' | head -n 1)
-    [ "$TEAM_IDENTIFIER" = "$EXPECTED_TEAM_IDENTIFIER" ] \
-      || fail "unexpected Apple TeamIdentifier for $executable (expected $EXPECTED_TEAM_IDENTIFIER, received ${TEAM_IDENTIFIER:-missing})"
+    # Without -R this only proves the seal is intact, not who signed it.
+    "$CODESIGN_BIN" --verify --strict --verbose=2 -R "$RELEASE_CODE_REQUIREMENT" "$executable" \
+      || fail "Apple signature verification failed for $executable; it must be Developer ID signed by Apple team $EXPECTED_TEAM_IDENTIFIER"
   done
 }
 
@@ -466,6 +482,8 @@ DOWNLOAD_BASE_URL=${DOWNLOAD_BASE_URL%/}
 CHANNEL_BASE_URL=${CHANNEL_BASE_URL%/}
 validate_channel "$CHANNEL"
 
+resolve_codesign_bin
+
 TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/freecode-install.XXXXXX")
 RELEASE_PUBLIC_KEY="$TEMP_DIR/release-signing-public.pem"
 write_release_public_key "$RELEASE_PUBLIC_KEY"
@@ -627,16 +645,38 @@ printf '\nUninstall:\n'
 printf '  rm -f "%s/freecode" && rm -rf "%s"\n' "$BIN_DIR" "$INSTALL_ROOT"
 
 if [ "$LAUNCH_AFTER_INSTALL" = "true" ]; then
-  TTY_DEVICE="${FREECODE_TEST_TTY_FILE:-}"
-  if [ -z "$TTY_DEVICE" ] && [ -t 1 ]; then
-    TTY_DEVICE="/dev/tty"
+  if [ -n "${FREECODE_TEST_TTY_FILE:-}" ]; then
+    if [ -r "$FREECODE_TEST_TTY_FILE" ]; then
+      CAN_LAUNCH="true"
+    else
+      CAN_LAUNCH="false"
+    fi
+  elif [ -t 1 ]; then
+    CAN_LAUNCH="true"
+  else
+    CAN_LAUNCH="false"
   fi
-  if [ -n "$TTY_DEVICE" ] && [ -r "$TTY_DEVICE" ]; then
+
+  if [ "$CAN_LAUNCH" = "true" ]; then
     printf '\nStarting Free Code...\n'
-    if ! "$BIN_DIR/freecode" < "$TTY_DEVICE"; then
-      printf '\nFree Code closed before startup finished. The installation is still ready.\n' >&2
+    if [ -n "${FREECODE_TEST_TTY_FILE:-}" ]; then
+      if "$BIN_DIR/freecode" < "$FREECODE_TEST_TTY_FILE"; then
+        LAUNCH_SUCCEEDED="true"
+      else
+        LAUNCH_SUCCEEDED="false"
+      fi
+    elif "$BIN_DIR/freecode" 0<&1; then
+      LAUNCH_SUCCEEDED="true"
+    else
+      LAUNCH_SUCCEEDED="false"
+    fi
+
+    if [ "$LAUNCH_SUCCEEDED" != "true" ]; then
+      printf '\nFree Code could not start automatically, but the installation succeeded.\n' >&2
+      printf 'Open a Terminal and run:\n  "%s/freecode"\n' "$BIN_DIR" >&2
     fi
   else
-    printf '\nFree Code is installed. Open a Terminal and run freecode when you are ready.\n'
+    printf '\nFree Code is installed. Open a Terminal and run:\n'
+    printf '  "%s/freecode"\n' "$BIN_DIR"
   fi
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freecode-sh",
-  "version": "0.1.0-alpha.19",
+  "version": "0.1.0-alpha.21",
   "description": "A free coding agent for your terminal.",
   "license": "UNLICENSED",
   "author": "Free Code",