fix(release): allow embedded signing profiles

Author: Nagi-ovo

scripts/__tests__/verify-release-privacy.test.ts

@@ -5,6 +5,11 @@ import { join, resolve } from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
 
 const tempRoots: string[] = [];
+const scannerPath = resolve(process.cwd(), 'scripts/verify-release-privacy.mjs');
+
+function runScanner(artifact: string) {
+  return spawnSync(process.execPath, [scannerPath, artifact], { encoding: 'utf8' });
+}
 
 afterEach(() => {
   for (const root of tempRoots.splice(0)) rmSync(root, { force: true, recursive: true });
@@ -23,13 +28,29 @@ describe('release privacy verification', () => {
     writeFileSync(join(externalDirectory, 'private.txt'), '/Users/private-owner/secret');
     symlinkSync(externalDirectory, join(artifact, 'Applications'));
 
-    const result = spawnSync(
-      process.execPath,
-      [resolve(process.cwd(), 'scripts/verify-release-privacy.mjs'), artifact],
-      { encoding: 'utf8' },
-    );
+    const result = runScanner(artifact);
 
     expect(result.status, result.stderr).toBe(0);
     expect(result.stdout).toContain('Release privacy check passed (1 files, 1 symlinks)');
   });
+
+  it('allows only the embedded provisioning profiles required by signed apps', () => {
+    const tempRoot = mkdtempSync(join(tmpdir(), 'voyager-release-privacy-'));
+    tempRoots.push(tempRoot);
+
+    const contents = join(tempRoot, 'Voyager.app', 'Contents');
+    const extensionContents = join(contents, 'PlugIns', 'Voyager Extension.appex', 'Contents');
+    mkdirSync(contents, { recursive: true });
+    mkdirSync(extensionContents, { recursive: true });
+    writeFileSync(join(contents, 'embedded.provisionprofile'), 'signed profile content');
+    writeFileSync(join(extensionContents, 'embedded.provisionprofile'), 'signed profile content');
+
+    const expectedProfileResult = runScanner(tempRoot);
+    expect(expectedProfileResult.status, expectedProfileResult.stderr).toBe(0);
+
+    writeFileSync(join(contents, 'exported.provisionprofile'), 'unexpected profile content');
+    const unexpectedProfileResult = runScanner(tempRoot);
+    expect(unexpectedProfileResult.status).toBe(1);
+    expect(unexpectedProfileResult.stderr).toContain('forbidden release filename');
+  });
 });

scripts/verify-release-privacy.mjs

@@ -39,6 +39,12 @@ const forbiddenPatterns = [
 const files = [];
 const symlinks = [];
 
+function isExpectedEmbeddedProfile(path) {
+  return /\.app\/Contents\/(?:PlugIns\/[^/]+\.appex\/Contents\/)?embedded\.provisionprofile$/.test(
+    path,
+  );
+}
+
 async function collect(path) {
   const metadata = await lstat(path);
   if (metadata.isSymbolicLink()) {
@@ -70,7 +76,10 @@ function scanContent(path, content) {
 }
 
 for (const file of files) {
-  if (forbiddenNames.some((pattern) => pattern.test(basename(file)))) {
+  if (
+    forbiddenNames.some((pattern) => pattern.test(basename(file))) &&
+    !isExpectedEmbeddedProfile(file)
+  ) {
     failures.push(`${file}: forbidden release filename`);
     continue;
   }