mobster-cli 0.4.3__py3-none-any.whl

mobile_agent/verify/netcerts.py

@@ -0,0 +1,67 @@
+"""A throwaway certificate authority for one run: the proxy answers a stubbed https host with a certificate this signs.
+
+The private key lives in a 0700 folder and is deleted when the run ends, so the public certificate that stays in the
+simulator's trust store can sign nothing."""
+
+import shutil
+import ssl
+import subprocess
+import tempfile
+from pathlib import Path
+
+OPENSSL = "/usr/bin/openssl"   # LibreSSL ships with macOS; a Homebrew openssl on PATH is not assumed
+DAYS = "2"
+TIMEOUT = 30
+
+
+class CertError(Exception):
+    pass
+
+
+class Authority:
+    def __init__(self, run=subprocess.run):
+        self._run = run
+        self.dir = Path(tempfile.mkdtemp(prefix="mobster-ca-"))
+        self.dir.chmod(0o700)
+        self.cert = self.dir / "ca.pem"
+        self._key = self.dir / "ca.key"
+        self._contexts = {}
+        # LibreSSL writes explicit curve parameters unless it is handed a named one.
+        self._curve = self.dir / "curve.pem"
+        self._openssl("ecparam", "-name", "prime256v1", "-out", self._curve)
+        self._openssl("req", "-x509", "-newkey", f"ec:{self._curve}", "-nodes",
+                      "-keyout", self._key, "-out", self.cert, "-sha256", "-days", DAYS,
+                      "-subj", "/CN=Mobster check CA", "-addext", "basicConstraints=critical,CA:TRUE",
+                      "-addext", "keyUsage=critical,keyCertSign", "-addext", "subjectKeyIdentifier=hash")
+
+    def _openssl(self, *args):
+        try:
+            done = self._run([OPENSSL, *map(str, args)], capture_output=True, text=True, timeout=TIMEOUT,
+                             stdin=subprocess.DEVNULL, cwd=self.dir)
+        except (OSError, subprocess.TimeoutExpired) as error:
+            raise CertError(f"openssl didn't run ({type(error).__name__}).") from None
+        if done.returncode != 0:
+            last = ((done.stderr or "").strip().splitlines() or ["failed"])[-1]
+            raise CertError("openssl couldn't make a certificate: " + last)
+
+    def context(self, host):
+        """A server-side SSL context for ``host``, with a certificate this authority signed."""
+        if host not in self._contexts:
+            stem = self.dir / f"leaf-{len(self._contexts)}"
+            extensions = stem.with_suffix(".ext")
+            # The key identifiers: strict verification (Python 3.13 and later by default) refuses a leaf without them.
+            extensions.write_text(f"subjectAltName=DNS:{host}\nextendedKeyUsage=serverAuth\nbasicConstraints=CA:FALSE\n"
+                                  "subjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid:always\n")
+            self._openssl("req", "-new", "-newkey", f"ec:{self._curve}", "-nodes",
+                          "-keyout", stem.with_suffix(".key"), "-out", stem.with_suffix(".csr"), "-subj", f"/CN={host}")
+            self._openssl("x509", "-req", "-in", stem.with_suffix(".csr"), "-CA", self.cert, "-CAkey", self._key,
+                          "-CAcreateserial", "-out", stem.with_suffix(".pem"), "-sha256", "-days", DAYS,
+                          "-extfile", extensions)
+            context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+            context.load_cert_chain(stem.with_suffix(".pem"), stem.with_suffix(".key"))
+            context.set_alpn_protocols(["http/1.1"])
+            self._contexts[host] = context
+        return self._contexts[host]
+
+    def close(self):
+        shutil.rmtree(self.dir, ignore_errors=True)

mobile_agent/verify/netproxy.py

@@ -0,0 +1,356 @@
+"""The run's local proxy: it shapes one simulator's traffic with a network profile and answers ``stubs:``.
+
+It listens on 127.0.0.1 only, serves one request per connection, and holds no state outside its own sockets: stopping
+it, or the process dying, ends every effect. Plain http requests and https requests to a stubbed host are read and
+answered or forwarded; every other https connection is a tunnel the proxy relays without opening."""
+
+import asyncio
+import random
+import socket
+import ssl
+import struct
+import threading
+import time
+from dataclasses import dataclass
+from urllib.parse import urlsplit
+
+from . import netstubs
+
+HEAD_LIMIT = 1 << 20
+BODY_LIMIT = 8 << 20
+HEAD_TIMEOUT = 30
+STALL_SECONDS = 1.0     # what a lost packet costs: about one retransmission timeout
+CHUNK = 16384
+ROW_LIMIT = 500
+CAPTURE_LIMIT = 200       # requests kept whole for wire assertions (verify/wire.py)
+CAPTURE_BYTES = 65536     # of each request body and each response, as sent
+SKIPPED_HEADERS = ("proxy-connection", "connection", "keep-alive", "proxy-authorization", "te", "upgrade")
+
+
+@dataclass(frozen=True)
+class Profile:
+    """A link: round-trip time, bandwidth each way, the share of chunks that stall, the share of connections that
+    reset."""
+    rtt_ms: int = 0
+    down_kbps: int = 0    # 0 is unlimited
+    up_kbps: int = 0
+    stall_pct: float = 0
+    reset_pct: float = 0
+    offline: bool = False
+
+
+PROFILES = {
+    "offline": Profile(offline=True),
+    "slow-3g": Profile(rtt_ms=400, down_kbps=400, up_kbps=400, stall_pct=2),
+    "lte": Profile(rtt_ms=50, down_kbps=12000, up_kbps=5000),
+    "flaky": Profile(rtt_ms=150, down_kbps=1500, up_kbps=750, stall_pct=5, reset_pct=10),
+}
+
+
+class ProxyError(Exception):
+    pass
+
+
+def _reset(writer):
+    """Close with a TCP reset, which is what a dropped link looks like to the app."""
+    sock = writer.get_extra_info("socket")
+    try:
+        if sock is not None:
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack("ii", 1, 0))
+    except OSError:
+        pass
+    writer.transport.abort()
+
+
+def _parse_head(raw):
+    lines = raw.decode("latin-1").split("\r\n")
+    parts = lines[0].split(" ", 2)
+    if len(parts) != 3:
+        raise ValueError("bad request line")
+    headers = []
+    for line in lines[1:]:
+        if line:
+            name, _, value = line.partition(":")
+            headers.append((name.strip(), value.strip()))
+    return parts[0], parts[1], headers
+
+
+def _header(headers, name):
+    return next((value for key, value in headers if key.lower() == name), None)
+
+
+class _Link:
+    """One connection's clock: which way data last went, so a change of direction costs half a round trip."""
+
+    def __init__(self):
+        self.last = None
+        self.started = time.monotonic()
+
+
+class Proxy:
+    def __init__(self, profile=None, stubs=(), authority=None, *, resolve=None, upstream_ssl=None, seed=0,
+                 watch=None):
+        self.profile = profile or Profile()
+        self.stubs = tuple(stubs)
+        # Host patterns whose https the proxy opens so wire assertions see paths and bodies; None keeps no captures.
+        self.watch = tuple(watch) if watch is not None else None
+        self._captures = [] if watch is not None else None
+        self.authority = authority
+        self._resolve = dict(resolve or {})       # host -> (address, port), for tests and local origins
+        self._upstream_ssl = upstream_ssl
+        self._rng = random.Random(seed)
+        self._rows, self.total = [], 0
+        self._started = time.monotonic()
+        self.port = None
+        self._loop = self._thread = self._stop = self._server = None
+        self._error = None
+        self._ready = threading.Event()
+        self._tasks = set()
+
+    # lifecycle
+
+    def start(self):
+        self._thread = threading.Thread(target=self._main, name="mobster-net-proxy", daemon=True)
+        self._thread.start()
+        self._ready.wait(15)
+        if self._error is not None or self.port is None:
+            why = type(self._error).__name__ if self._error else "timeout"
+            raise ProxyError(f"The network proxy didn't start ({why}).")
+        return self.port
+
+    def stop(self):
+        loop, stop = self._loop, self._stop
+        if loop is not None and stop is not None and not loop.is_closed():
+            try:
+                loop.call_soon_threadsafe(stop.set)
+            except RuntimeError:
+                pass
+        if self._thread is not None:
+            self._thread.join(10)
+
+    def rows(self):
+        return [dict(row) for row in self._rows]
+
+    def captures(self):
+        """The requests seen whole (wire assertions only): method, host, path, headers, body and response prefix."""
+        return [dict(item) for item in self._captures or ()]
+
+    def _main(self):
+        loop = self._loop = asyncio.new_event_loop()
+        try:
+            loop.run_until_complete(self._serve())
+        except BaseException as error:  # reported by start()
+            self._error = error
+            self._ready.set()
+        finally:
+            try:
+                loop.close()
+            except Exception:
+                pass
+
+    async def _serve(self):
+        self._stop = asyncio.Event()
+        self._server = await asyncio.start_server(self._client, "127.0.0.1", 0, limit=HEAD_LIMIT)
+        self.port = self._server.sockets[0].getsockname()[1]
+        self._ready.set()
+        await self._stop.wait()
+        self._server.close()
+        for task in list(self._tasks):
+            task.cancel()
+        await asyncio.gather(*self._tasks, return_exceptions=True)
+
+    # shaping
+
+    async def _shape(self, link, way, size):
+        profile = self.profile
+        if link.last != way and profile.rtt_ms:
+            await asyncio.sleep(profile.rtt_ms / 2000)
+        link.last = way
+        if profile.stall_pct and self._rng.random() * 100 < profile.stall_pct:
+            await asyncio.sleep(STALL_SECONDS)
+        kbps = profile.down_kbps if way == "down" else profile.up_kbps
+        if kbps:
+            await asyncio.sleep(size * 8 / (kbps * 1000))
+
+    async def _send(self, writer, data, link, way):
+        for start in range(0, len(data), CHUNK):
+            piece = data[start:start + CHUNK]
+            await self._shape(link, way, len(piece))
+            writer.write(piece)
+            await writer.drain()
+
+    # rows
+
+    def _row(self, **row):
+        self.total += 1
+        row = {"atMs": round((time.monotonic() - self._started) * 1000), "via": "", "status": None, "bytes": 0,
+               "ms": None, **row}
+        if len(self._rows) < ROW_LIMIT:
+            self._rows.append(row)
+        return row
+
+    @staticmethod
+    def _finish(row, link, **fields):
+        row.update(fields, ms=round((time.monotonic() - link.started) * 1000))
+
+    # connections
+
+    async def _client(self, reader, writer):
+        task = asyncio.current_task()
+        self._tasks.add(task)
+        link = _Link()
+        try:
+            await self._handle(reader, writer, link)
+        except (asyncio.CancelledError, ConnectionError, asyncio.IncompleteReadError, asyncio.TimeoutError,
+                ssl.SSLError, OSError, ValueError, asyncio.LimitOverrunError):
+            pass
+        finally:
+            self._tasks.discard(task)
+            try:
+                writer.close()
+            except Exception:
+                pass
+
+    async def _read_head(self, reader):
+        return await asyncio.wait_for(reader.readuntil(b"\r\n\r\n"), HEAD_TIMEOUT)
+
+    async def _handle(self, reader, writer, link):
+        raw = await self._read_head(reader)
+        method, target, headers = _parse_head(raw)
+        host = urlsplit(target).hostname if "://" in target else None
+        if not host:
+            host = target.rsplit(":", 1)[0] if method == "CONNECT" else (_header(headers, "host") or "").split(":")[0]
+        row = self._row(method=method, host=host or "", path="" if method == "CONNECT" else urlsplit(target).path)
+        if self.profile.offline or (self.profile.reset_pct and self._rng.random() * 100 < self.profile.reset_pct):
+            self._finish(row, link, via="refused")
+            _reset(writer)
+            return
+        if self.profile.rtt_ms:
+            await asyncio.sleep(self.profile.rtt_ms / 1000)   # the connection's own handshake
+        if method == "CONNECT":
+            name, _, port = target.rpartition(":")
+            opened = [stub["host"] for stub in self.stubs] + list(self.watch or ())
+            if any(netstubs.host_matches(pattern, name) for pattern in opened) and self.authority is not None:
+                writer.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
+                await writer.drain()
+                await writer.start_tls(self.authority.context(name))
+                raw = await self._read_head(reader)
+                method, target, headers = _parse_head(raw)
+                row.update(method=method, path=urlsplit(target).path)
+                await self._request(reader, writer, link, row, method, target, headers, "https", name, int(port or 443))
+            else:
+                await self._tunnel(reader, writer, link, row, name, int(port or 443))
+        else:
+            split = urlsplit(target)
+            await self._request(reader, writer, link, row, method, target, headers, split.scheme or "http",
+                                host, split.port or 80)
+
+    async def _connect(self, host, port, tls):
+        address, number = self._resolve.get(host, (host, port))
+        if not tls:
+            return await asyncio.open_connection(address, number, limit=HEAD_LIMIT)
+        context = self._upstream_ssl or ssl.create_default_context()
+        return await asyncio.open_connection(address, number, ssl=context, server_hostname=host, limit=HEAD_LIMIT)
+
+    async def _tunnel(self, reader, writer, link, row, host, port):
+        row["via"] = "tunnel"   # while it's open too: a no_request judged mid-run must see this connection
+        try:
+            upstream_reader, upstream_writer = await self._connect(host, port, False)
+        except OSError:
+            self._finish(row, link, via="tunnel", status=502)
+            writer.write(b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n")
+            return
+        writer.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
+        await writer.drain()
+        sizes = {"up": 0, "down": 0}
+
+        async def pipe(source, sink, way):
+            try:
+                while data := await source.read(CHUNK):
+                    sizes[way] += len(data)
+                    await self._send(sink, data, link, way)
+            except (ConnectionError, OSError):
+                pass
+            finally:
+                sink.close()
+        try:
+            await asyncio.gather(pipe(reader, upstream_writer, "up"), pipe(upstream_reader, writer, "down"))
+        finally:
+            self._finish(row, link, via="tunnel", status=200, bytes=sizes["down"])
+            upstream_writer.close()
+
+    async def _body(self, reader, headers):
+        """The request's body as sent (chunked framing kept), or b"" when it has none."""
+        if "chunked" in (_header(headers, "transfer-encoding") or "").lower():
+            body = b""
+            while True:
+                size_line = await reader.readuntil(b"\r\n")
+                body += size_line
+                size = int(size_line.split(b";")[0].strip() or b"0", 16)
+                body += await reader.readexactly(size + 2) if size else await reader.readuntil(b"\r\n")
+                if not size:
+                    return body
+                if len(body) > BODY_LIMIT:
+                    raise ValueError("body too large")
+        length = int(_header(headers, "content-length") or 0)
+        if length > BODY_LIMIT:
+            raise ValueError("body too large")
+        return await reader.readexactly(length) if length else b""
+
+    async def _request(self, reader, writer, link, row, method, target, headers, scheme, host, port):
+        body = await self._body(reader, headers)
+        split = urlsplit(target)
+        path = split.path or "/"
+        origin = path + (f"?{split.query}" if split.query else "")
+        await self._shape(link, "up", len(body))
+        seen = None
+        if self._captures is not None and len(self._captures) < CAPTURE_LIMIT:
+            seen = {"atMs": row["atMs"], "method": method, "host": host, "path": origin, "headers": list(headers),
+                    "body": body[:CAPTURE_BYTES], "status": None, "response": b""}
+            self._captures.append(seen)
+        stub = next((s for s in self.stubs if netstubs.matches(s, host, method, path)), None)
+        if stub is not None:
+            await self._stub(writer, link, row, stub, seen)
+            return
+        kept = "".join(f"{name}: {value}\r\n" for name, value in headers if name.lower() not in SKIPPED_HEADERS)
+        head = f"{method} {origin} HTTP/1.1\r\n" + kept + "Connection: close\r\n\r\n"
+        try:
+            upstream_reader, upstream_writer = await self._connect(host, port, scheme == "https")
+        except (OSError, ssl.SSLError):
+            self._finish(row, link, via="pass", status=502)
+            writer.write(b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
+            return
+        try:
+            upstream_writer.write(head.encode("latin-1") + body)
+            await upstream_writer.drain()
+            first, size = True, 0
+            while data := await upstream_reader.read(CHUNK):
+                if seen is not None and len(seen["response"]) < CAPTURE_BYTES:
+                    seen["response"] += data[:CAPTURE_BYTES - len(seen["response"])]
+                if first:
+                    first = False
+                    try:
+                        row["status"] = int(data.split(b" ", 2)[1])
+                        if seen is not None:
+                            seen["status"] = row["status"]
+                    except (IndexError, ValueError):
+                        pass
+                size += len(data)
+                await self._send(writer, data, link, "down")
+            self._finish(row, link, via="pass", bytes=size)
+        finally:
+            upstream_writer.close()
+
+    async def _stub(self, writer, link, row, stub, seen=None):
+        status, kind, body = netstubs.answer(stub)
+        if stub["delay_ms"]:
+            await asyncio.sleep(stub["delay_ms"] / 1000)
+        reason = {200: "OK", 201: "Created", 204: "No Content", 400: "Bad Request", 401: "Unauthorized",
+                  403: "Forbidden", 404: "Not Found", 429: "Too Many Requests", 500: "Internal Server Error",
+                  503: "Service Unavailable"}.get(status, "Stub")
+        head = (f"HTTP/1.1 {status} {reason}\r\nContent-Type: {kind}\r\nContent-Length: {len(body)}\r\n"
+                "Connection: close\r\n\r\n").encode()
+        if seen is not None:
+            seen.update(status=status, response=(head + body)[:CAPTURE_BYTES])
+        await self._send(writer, head + body, link, "down")
+        self._finish(row, link, via="stub", status=status, bytes=len(body))

mobile_agent/verify/netrun.py

@@ -0,0 +1,81 @@
+"""One run's network conditions on a simulator: the proxy, the shim that points the app at it, and the cleanup.
+
+``start`` returns the environment to launch the app with; ``stop`` ends the proxy and deletes the throwaway
+certificate authority, and is safe to call twice. Nothing else on the Mac changes."""
+
+import json
+from pathlib import Path
+
+from . import netcerts, netshim
+from .netproxy import PROFILES, Proxy, ProxyError
+
+NOT_SEEN = ("No request from the app reached the proxy. The app may use a network stack Mobster doesn't reach "
+            "(see docs/testing.mdx).")
+SUMMARY_ROWS = 200
+
+
+class NetError(Exception):
+    """What went wrong, then what to do."""
+
+    def __init__(self, message, fix):
+        super().__init__(message)
+        self.message, self.fix = message, fix
+
+
+class NetRun:
+    def __init__(self, profile, stubs, *, udid, run, build=netshim.ensure_built, authority=netcerts.Authority,
+                 proxy=Proxy, watch=None):
+        self.name, self.stubs, self.udid, self.run = profile, tuple(stubs), udid, run
+        self._build, self._authority, self._proxy_class = build, authority, proxy
+        self.proxy = self.ca = None
+        self._rows, self._total, self._captures = [], 0, []
+        self.watch = None if watch is None else tuple(watch)   # hosts wire assertions need opened (wire.py)
+
+    def start(self):
+        try:
+            library = self._build()
+            if self.stubs or self.watch:   # only a stub or a watched host needs https opened; a profile tunnels it
+                self.ca = self._authority()
+                code, output = self.run(["keychain", self.udid, "add-root-cert", str(self.ca.cert)])
+                if code != 0:
+                    raise NetError("Mobster couldn't make the simulator trust its stub certificate"
+                                   + (f": {output.splitlines()[-1][:160]}" if output else "") + ".",
+                                   "Run `mobster sim doctor`, then try again, or remove stubs from the check.")
+            extra = {} if self.watch is None else {"watch": self.watch}
+            self.proxy = self._proxy_class(PROFILES.get(self.name), self.stubs, self.ca, **extra)
+            port = self.proxy.start()
+        except netshim.ShimError as error:
+            self.stop()
+            raise NetError(error.message, error.fix) from None
+        except (netcerts.CertError, ProxyError) as error:
+            self.stop()
+            raise NetError(str(error), "Check that /usr/bin/openssl runs, then try again.") from None
+        except NetError:
+            self.stop()
+            raise
+        return {"DYLD_INSERT_LIBRARIES": library, "MOBSTER_PROXY_HOST": "127.0.0.1", "MOBSTER_PROXY_PORT": str(port)}
+
+    def stop(self):
+        proxy, ca, self.proxy, self.ca = self.proxy, self.ca, None, None
+        if proxy is not None:
+            proxy.stop()
+            self._rows, self._total = proxy.rows(), proxy.total
+            self._captures = proxy.captures() if self.watch is not None else []
+        if ca is not None:
+            ca.close()
+
+    def seen(self):
+        """(whole requests, rows) the proxy saw so far, for wire assertions; still readable after ``stop``."""
+        proxy = self.proxy
+        return (proxy.captures(), proxy.rows()) if proxy is not None else (list(self._captures), list(self._rows))
+
+    def summary(self):
+        """What the proxy saw, for the result: the profile, the request count and the first rows."""
+        out = {"profile": self.name, "requests": self._total, "rows": self._rows[:SUMMARY_ROWS]}
+        if not out["requests"]:
+            out["note"] = NOT_SEEN
+        return out
+
+    def write(self, directory):
+        Path(directory, "network.json").write_text(json.dumps(self.summary(), indent=1), encoding="utf-8")
+

mobile_agent/verify/netshim.m

@@ -0,0 +1,28 @@
+// Mobster's network shim. Mobster launches an app in the iOS Simulator with this library in DYLD_INSERT_LIBRARIES and
+// MOBSTER_PROXY_HOST / MOBSTER_PROXY_PORT set; every NSURLSession that sets no proxy of its own then goes through the
+// run's local proxy. It reads nothing else, writes nothing, and exists only in that process.
+#import <Foundation/Foundation.h>
+#import <objc/runtime.h>
+
+static NSDictionary *proxies(void) {
+    const char *host = getenv("MOBSTER_PROXY_HOST"), *port = getenv("MOBSTER_PROXY_PORT");
+    if (!host || !port) return nil;
+    NSString *name = @(host);
+    NSNumber *number = @(atoi(port));
+    return @{@"HTTPEnable": @1, @"HTTPProxy": name, @"HTTPPort": number,
+             @"HTTPSEnable": @1, @"HTTPSProxy": name, @"HTTPSPort": number};
+}
+
+static NSDictionary *(*original)(id, SEL);
+static NSDictionary *replacement(id self, SEL command) {
+    NSDictionary *own = original(self, command);
+    return own ?: proxies();
+}
+
+__attribute__((constructor)) static void install(void) {
+    if (!proxies()) return;
+    Method method = class_getInstanceMethod([NSURLSessionConfiguration class], @selector(connectionProxyDictionary));
+    if (!method) return;
+    original = (NSDictionary *(*)(id, SEL))method_getImplementation(method);
+    method_setImplementation(method, (IMP)replacement);
+}

mobile_agent/verify/netshim.py

@@ -0,0 +1,48 @@
+"""Builds Mobster's network shim (netshim.m) for the iOS Simulator with Xcode's clang, once per source version."""
+
+import hashlib
+import os
+import subprocess
+from pathlib import Path
+
+SOURCE = Path(__file__).with_name("netshim.m")
+MIN_IOS = "15.0"
+TIMEOUT = 120
+
+
+class ShimError(Exception):
+    """The shim couldn't be built: what happened, then what to do."""
+
+    def __init__(self, message, fix="Install Xcode's command-line tools (`xcode-select --install`), then try again."):
+        super().__init__(message)
+        self.message, self.fix = message, fix
+
+
+def cache_dir():
+    return Path(os.environ.get("MOBSTER_CACHE_DIR") or Path.home() / "Library" / "Caches" / "Mobster")
+
+
+def ensure_built(*, cache=None, run=subprocess.run):
+    """The path of the compiled, ad-hoc signed shim; built on first use and kept by the hash of its source."""
+    source = SOURCE.read_bytes()
+    folder = Path(cache or cache_dir()) / "netshim" / hashlib.sha256(source).hexdigest()[:12]
+    library = folder / "netshim.dylib"
+    if library.is_file():
+        return str(library)
+    folder.mkdir(parents=True, exist_ok=True)
+    partial = folder / f"netshim.{os.getpid()}.tmp"
+    try:
+        for command in (["xcrun", "--sdk", "iphonesimulator", "clang", "-dynamiclib", "-arch", "arm64",
+                         "-arch", "x86_64", f"-mios-simulator-version-min={MIN_IOS}", "-fobjc-arc",
+                         "-framework", "Foundation", "-o", str(partial), str(SOURCE)],
+                        ["codesign", "-s", "-", "--force", str(partial)]):
+            done = run(command, capture_output=True, text=True, timeout=TIMEOUT, stdin=subprocess.DEVNULL)
+            if done.returncode != 0:
+                last = next((line for line in reversed((done.stderr or "").splitlines()) if line.strip()), "")
+                raise ShimError(f"Mobster couldn't build its network shim: {last[:200] or command[0] + ' failed'}.")
+        partial.replace(library)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        raise ShimError(f"Mobster couldn't build its network shim ({type(error).__name__}).") from None
+    finally:
+        partial.unlink(missing_ok=True)
+    return str(library)