From 65509837d75989a3ba848feeb1956ec22da38db5 Mon Sep 17 00:00:00 2001 From: Ashesh Vashi Date: Fri, 24 Jul 2026 18:25:46 +0530 Subject: [PATCH 1/2] fix: scan all Mach-O binaries for bundle linkage, not just .so/.dylib _verify_bundle_linkage's host-library scan only matched files by .so/.dylib name suffix, so a shipped executable (Contents/MacOS/*) or a Python.framework payload with a host-linked dependency but no matching suffix would slip through unchecked. Detect Mach-O executables/libraries by content instead (same pattern already used by the codesign step), regardless of extension. --- pkg/mac/build-functions.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/mac/build-functions.sh b/pkg/mac/build-functions.sh index 9598c08a2ea..9c271311d9b 100644 --- a/pkg/mac/build-functions.sh +++ b/pkg/mac/build-functions.sh @@ -515,7 +515,10 @@ _verify_bundle_linkage() { echo "ERROR: ${f} links against build-host libraries:" >&2 echo "${deps}" | sed 's/^/ /' >&2 found="yes" - done < <(find "${BUNDLE_DIR}" \( -name '*.so' -o -name '*.dylib' \) -type f) + done < <(find "${BUNDLE_DIR}" -type f -perm +111 -exec file "{}" \; | \ + grep -v "(for architecture" | \ + grep -E "Mach-O executable|Mach-O 64-bit executable|Mach-O 64-bit bundle|Mach-O 64-bit dynamically linked shared library" | \ + awk -F":" '{print $1}' | uniq) if [ -n "${found}" ]; then echo "ERROR: the bundle links against libraries outside it; those paths" >&2 From 93ae6c1b604552d2276b7886de38a9235a6f78f0 Mon Sep 17 00:00:00 2001 From: Ashesh Vashi Date: Fri, 24 Jul 2026 18:30:47 +0530 Subject: [PATCH 2/2] fix: don't skip non-executable Mach-O libraries in bundle scan -perm +111 excluded readable-but-not-executable dylibs from the Mach-O scan, letting their install names go unchecked. Drop the predicate and let file's content-based filtering do the matching. --- pkg/mac/build-functions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/mac/build-functions.sh b/pkg/mac/build-functions.sh index 9c271311d9b..5bcc3c5a322 100644 --- a/pkg/mac/build-functions.sh +++ b/pkg/mac/build-functions.sh @@ -515,7 +515,7 @@ _verify_bundle_linkage() { echo "ERROR: ${f} links against build-host libraries:" >&2 echo "${deps}" | sed 's/^/ /' >&2 found="yes" - done < <(find "${BUNDLE_DIR}" -type f -perm +111 -exec file "{}" \; | \ + done < <(find "${BUNDLE_DIR}" -type f -exec file "{}" \; | \ grep -v "(for architecture" | \ grep -E "Mach-O executable|Mach-O 64-bit executable|Mach-O 64-bit bundle|Mach-O 64-bit dynamically linked shared library" | \ awk -F":" '{print $1}' | uniq)