fix(release): keep privacy scan inside artifacts

Author: Nagi-ovo

scripts/__tests__/verify-release-privacy.test.ts

@@ -0,0 +1,35 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+
+const tempRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of tempRoots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe('release privacy verification', () => {
+  it('checks symlinks without following them outside the artifact', () => {
+    const tempRoot = mkdtempSync(join(tmpdir(), 'voyager-release-privacy-'));
+    tempRoots.push(tempRoot);
+
+    const artifact = join(tempRoot, 'artifact');
+    const externalDirectory = join(tempRoot, 'external');
+    mkdirSync(artifact);
+    mkdirSync(externalDirectory);
+    writeFileSync(join(artifact, 'safe.txt'), 'safe release content');
+    writeFileSync(join(externalDirectory, 'private.txt'), '/Users/private-owner/secret');
+    symlinkSync(externalDirectory, join(artifact, 'Applications'));
+
+    const result = spawnSync(
+      process.execPath,
+      [resolve(process.cwd(), 'scripts/verify-release-privacy.mjs'), artifact],
+      { encoding: 'utf8' },
+    );
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stdout).toContain('Release privacy check passed (1 files, 1 symlinks)');
+  });
+});

scripts/build-safari-release.sh

@@ -59,10 +59,8 @@ submit_for_notarization() {
   fi
 
   local notary_status
-  local submission_id
   notary_status=$(plutil -extract status raw -o - "$result_file")
-  submission_id=$(plutil -extract id raw -o - "$result_file")
-  printf 'Notarization %s (submission %s)\n' "$notary_status" "$submission_id"
+  printf 'Notarization %s\n' "$notary_status"
 
   if [[ $notary_status != Accepted ]]; then
     echo "Apple notarization rejected: $artifact" >&2

scripts/verify-release-privacy.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { readFile, readdir, stat } from 'node:fs/promises';
+import { lstat, readFile, readdir, readlink } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 
 const roots = process.argv.slice(2);
@@ -37,9 +37,15 @@ const forbiddenPatterns = [
 ];
 
 const files = [];
+const symlinks = [];
 
 async function collect(path) {
-  const metadata = await stat(path);
+  const metadata = await lstat(path);
+  if (metadata.isSymbolicLink()) {
+    symlinks.push({ path, target: await readlink(path) });
+    return;
+  }
+
   if (!metadata.isDirectory()) {
     files.push(path);
     return;
@@ -53,25 +59,37 @@ async function collect(path) {
 for (const root of roots) await collect(root);
 
 const failures = [];
+function scanContent(path, content) {
+  for (const [needle, label] of forbiddenContent) {
+    if (content.includes(Buffer.from(needle))) failures.push(`${path}: contains ${label}`);
+  }
+  const text = content.toString('latin1');
+  for (const [pattern, label] of forbiddenPatterns) {
+    if (pattern.test(text)) failures.push(`${path}: contains ${label}`);
+  }
+}
+
 for (const file of files) {
   if (forbiddenNames.some((pattern) => pattern.test(basename(file)))) {
     failures.push(`${file}: forbidden release filename`);
     continue;
   }
 
-  const content = await readFile(file);
-  for (const [needle, label] of forbiddenContent) {
-    if (content.includes(Buffer.from(needle))) failures.push(`${file}: contains ${label}`);
-  }
-  const text = content.toString('latin1');
-  for (const [pattern, label] of forbiddenPatterns) {
-    if (pattern.test(text)) failures.push(`${file}: contains ${label}`);
+  scanContent(file, await readFile(file));
+}
+
+for (const { path, target } of symlinks) {
+  if (forbiddenNames.some((pattern) => pattern.test(basename(path)))) {
+    failures.push(`${path}: forbidden release filename`);
+    continue;
   }
+
+  scanContent(`${path} -> ${target}`, Buffer.from(target));
 }
 
 if (failures.length > 0) {
   console.error(`Release privacy check failed:\n${failures.join('\n')}`);
   process.exit(1);
 }
 
-console.log(`Release privacy check passed (${files.length} files)`);
+console.log(`Release privacy check passed (${files.length} files, ${symlinks.length} symlinks)`);

src/pages/popup/__tests__/releaseArtifacts.test.ts

@@ -36,6 +36,7 @@ describe('release artifacts', () => {
 
     expect(script).toContain('local notary_status');
     expect(script).not.toMatch(/\blocal status\b/);
+    expect(script).not.toContain('submission_id');
   });
 
   it('builds and stores the Edge release variant independently from Chrome', () => {