 Hermes
|
af970aa564
|
[grade=B] feat: real macOS .dmg built entirely on Linux (libguestfs + libdmg-hfsplus)
CI / Security audit (push) Canceled after 0s
CI / Test & Lint (push) Canceled after 0s
Adds scripts/build-dmg-linux.sh + 'npm run build:dmg':
- virt-make-fs creates an HFS+ volume inside a plain 400M image file
(guestfs appliance; never touches block devices)
- libdmg-hfsplus converts it to compressed UDZO .dmg (real koly/UDIF)
- app + /Applications drag-install symlink; secret scan on extracted contents
- BUILD_GUIDE documents the route + Gatekeeper first-run note
Verified end-to-end: rc=0, 121MB DMG with valid koly trailer,
extractall round-trip reproduced the full 264MB app, secrets scan clean.
|
2026-09-01 03:36:16 -07:00 |
|
|
Hermes
|
468bc00106
|
[grade=A] installer: stop shipping production CA private keys in installers
electron-builder extraResources bundled ../dashcaddy-api wholesale, so every
built AppImage/deb/NSIS/mac-zip carried Sami's PRODUCTION pki/root.key,
pki/intermediate.key, generated-certs/* TLS keys, data/, logs.
Fix: denylist excludes all key/cert extensions, secret dirs, pki/**,
generated-certs/**, data/**, .env*; Dockerfile needs only *.js,src/,routes/,
openapi.yaml,VERSION (verified). New scripts/check-artifact-secrets.sh
(build:scan) greps built trees for key material + PRIVATE KEY----- blocks.
Verified: pre-fix build leaked keys (find . -name '*.key' -> root.key etc);
post-fix build clean on linux/win/mac resource trees (scanner passes).
Judge: qwen3.8-max stand-in lane, round1 B+7 polish, polish folded,
round2 A 0 blocking. Verdicts /tmp/judge-batch3a-{verdict,r2-verdict}.json
|
2026-09-01 00:20:00 -07:00 |
|