Strip local paths from Release app binaries - #37
Merged
Conversation
Why: - Release Mach-O debug and linker metadata retained checkout and DerivedData paths that text-only scans missed. - Same-version skip-build reuse and extra universal bytes required defenses independent of the current checkout spelling. Changed: - Generate the external dSYM before Release-only debugging-symbol stripping while preserving Swift symbols. - Gate the staged executable on exact architectures, fat and thin raw bytes, debug records, absolute-path symbols, and embedded DWARF. - Add deterministic Mach-O regressions and document the pre-signing contract. Verification: - agent:verify implementation passed. - agent:verify spec-only passed. - Release universal, both thin slices, dSYM UUID matching, runtime smoke, negative baseline, and public-source audits passed. Affected: - macOS Release app builds and distribution pre-signing validation. Refs: - RR21 - https://how.complexsystems.fail/ Session: - task-sessions/rr21-release-path-remapping-20260831
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Reviewed top-level PR feedback and left the current code unchanged. These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed\n\nRelease macOS builds now generate the external dSYM first, then strip debugging records only from the shipped executable while leaving Swift symbols intact. Distribution packaging resolves the exact Xcode-visible checkout root immediately before signing and verifies the staged Mach-O rather than relying on text scanners.\n\nThe verifier requires exactly arm64 and x86_64, scans both thin slices and the universal container as raw bytes, and rejects retained STABS/debug records, absolute-path symbol names, or embedded DWARF. The compiled regression covers clean output, leaks in either required slice, bytes appended outside slices, a leaking arm64e third slice, a missing architecture, and a same-version unstripped build whose original checkout root differs from the current checkout.\n\nThe failure required several conditions together: compiler and linker metadata survived in NUL-containing binary bytes, text and strings-based scanners did not see it, a current-root-only check could miss moved-checkout reuse, and required-slice-only inspection could miss extra or container bytes. The correction keeps those defenses independent and checks the final pre-signing boundary.\n\n## How you verified\n\n- [x] Pre-fix Release executable reproduced 118 exact checkout-root occurrences across the universal binary and both architecture slices\n- [x] Final unsigned Release build contains zero exact Xcode-root occurrences in the universal executable, arm64, and x86_64\n- [x] Final executable and external dSYM UUIDs match for both architectures; the dSYM resolves line information and stays outside the app and archive\n- [x] Repaired verifier rejects the real pre-fix executable even when supplied an unrelated current root\n- [x] Release app stayed live under isolated runtime state until controlled termination\n- [x] Full implementation profile passed, including the full npm test, app 171/171, harness build, and harness 113/113\n- [x] Spec-only profile passed, including docs 42/42 and harness config 10/10\n- [x] Repository and independent staged current-source audits passed\n- [x] Independent review reproduced two bypasses, both were repaired, and final re-review found no P1/P2 issues\n\n## Notes\n\nThe defense intentionally targets the observed Release debug/linker metadata and exact current build root. It does not add a broad temporary-directory ban or arbitrary binary privacy scanner. External dSYMs retain local source paths for crash symbolication and remain build artifacts, never distribution payloads.\n\nNo signing, notarization, release, tag, retained Alpha artifact, or publishing behavior was invoked or changed.\n\nThis project is Alpha, macOS-only, and needs Xcode to talk to iOS Simulators. See CONTRIBUTING.md.