wehub-resource-sync
a06f331eb8
install-script / powershell-syntax (push) Waiting to run
CI / benchmark (push) Has been skipped
install-script / posix-syntax (push) Successful in 6m1s
install-script / install (macos-14) (push) Waiting to run
install-script / install (ubuntu-latest) (push) Waiting to run
CI / build-onnx (push) Failing after 6m43s
init-smoke / dry-run (push) Failing after 15m57s
security / govulncheck (push) Has been cancelled
security / trivy-fs (push) Has been cancelled
CI / test (1.26, ubuntu-latest) (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
CI / test (1.26, macos-latest) (push) Has been cancelled
CI / build-windows (push) Has been cancelled
CI / lint (push) Has been cancelled
52 lines
2.1 KiB
Bash
Executable File
52 lines
2.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# Smoke test for the macOS __DATA_CONST regression (issue #176).
|
|
#
|
|
# macOS 15 Sequoia and 26 Tahoe's dyld ABORT a process at load time if the
|
|
# __DATA_CONST segment is missing the SG_READ_ONLY (0x10) segment flag:
|
|
#
|
|
# dyld: __DATA_CONST segment missing SG_READ_ONLY flag in <binary>
|
|
#
|
|
# Apple's native linker (ld-prime) sets that flag; the osxcross/cctools ld64
|
|
# used by goreleaser-cross did not — so a cross-compiled cask shipped broken
|
|
# while every locally `go build`-ed binary worked. This guard fails the
|
|
# release if a darwin binary is produced without the flag, so the broken
|
|
# shape can never ship again.
|
|
#
|
|
# Usage: verify-macho-readonly.sh <mach-o-binary>
|
|
set -eu
|
|
|
|
bin="${1:?usage: verify-macho-readonly.sh <mach-o-binary>}"
|
|
[ -f "$bin" ] || { echo "FATAL: $bin does not exist" >&2; exit 1; }
|
|
|
|
# Pull the SEGMENT-level flags for __DATA_CONST out of `otool -l`. A segment
|
|
# block is "cmd LC_SEGMENT_64 ... segname __DATA_CONST ... flags 0xNN"; the
|
|
# section sub-blocks that follow also carry a segname field, so we capture the
|
|
# FIRST flags line after the segment's segname and stop — that is the segment
|
|
# command's flags, not a section's.
|
|
flags="$(otool -l "$bin" | awk '
|
|
/^Load command/ { inseg=0; seg="" }
|
|
$1=="cmd" && ($2=="LC_SEGMENT_64" || $2=="LC_SEGMENT") { inseg=1 }
|
|
inseg && $1=="segname" && seg=="" { seg=$2 }
|
|
inseg && $1=="flags" && seg=="__DATA_CONST" { print $2; exit }
|
|
')"
|
|
|
|
if [ -z "$flags" ]; then
|
|
echo "FATAL: no __DATA_CONST segment found in $bin (is it a Mach-O?)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# otool prints segment flags as hex (e.g. 0x10 / 0x00000010); some builds
|
|
# render the symbolic name. Accept either form.
|
|
case "$flags" in
|
|
*READ_ONLY*) echo "ok: $bin __DATA_CONST carries SG_READ_ONLY ($flags)"; exit 0 ;;
|
|
esac
|
|
|
|
# Shell arithmetic understands the 0x prefix; SG_READ_ONLY is 0x10.
|
|
if [ $(( flags & 0x10 )) -eq 0 ]; then
|
|
echo "FATAL: $bin __DATA_CONST flags=$flags missing SG_READ_ONLY (0x10)." >&2
|
|
echo " This binary would abort under the macOS 15+/Tahoe dyld (issue #176)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "ok: $bin __DATA_CONST carries SG_READ_ONLY (flags=$flags)"
|