| 1 | #!/usr/bin/env python3 |
| 2 | """Launch a relocated release archive without access to SwiftPM build fallbacks. |
| 3 | |
| 4 | Run on a logged-in Mac. No files in the source/build directories are modified. |
| 5 | The test terminates only the app process it launches. |
| 6 | """ |
| 7 | import argparse |
| 8 | import json |
| 9 | from pathlib import Path |
| 10 | import plistlib |
| 11 | import subprocess |
| 12 | import tempfile |
| 13 | import time |
| 14 | |
| 15 | parser = argparse.ArgumentParser(description=__doc__) |
| 16 | parser.add_argument("archive", type=Path) |
| 17 | args = parser.parse_args() |
| 18 | with tempfile.TemporaryDirectory(prefix="oficina-sheets-launch-") as directory: |
| 19 | root = Path(directory) |
| 20 | subprocess.run(["ditto", "-x", "-k", str(args.archive.resolve()), str(root)], check=True) |
| 21 | apps = list(root.glob("*.app")) |
| 22 | assert len(apps) == 1, "Expected one application in release archive" |
| 23 | app = apps[0] |
| 24 | info = plistlib.loads((app / "Contents/Info.plist").read_bytes()) |
| 25 | executable = app / "Contents/MacOS" / info["CFBundleExecutable"] |
| 26 | strings = subprocess.check_output(["strings", str(executable)], text=True).splitlines() |
| 27 | fallbacks = {line.split("/.build/", 1)[0] + "/.build" for line in strings |
| 28 | if line.startswith("/") and "/.build/" in line and line.endswith(".bundle")} |
| 29 | assert fallbacks, "No SwiftPM fallback paths found; review test coverage" |
| 30 | profile = '(version 1)(allow default)' + ''.join( |
| 31 | f'(deny file-read* (subpath {json.dumps(path)}))' for path in sorted(fallbacks)) |
| 32 | probe = root / "windows.swift" |
| 33 | probe.write_text('''import CoreGraphics |
| 34 | import Foundation |
| 35 | let pid = Int(CommandLine.arguments[1])! |
| 36 | let windows = CGWindowListCopyWindowInfo(.optionAll, kCGNullWindowID) as? [[String: Any]] ?? [] |
| 37 | let found = windows.contains { window in |
| 38 | guard window[kCGWindowOwnerPID as String] as? Int == pid, |
| 39 | window[kCGWindowLayer as String] as? Int == 0, |
| 40 | let bounds = window[kCGWindowBounds as String] as? [String: Any], |
| 41 | let width = bounds["Width"] as? Double, |
| 42 | let height = bounds["Height"] as? Double else { return false } |
| 43 | return width >= 300 && height >= 100 // Signed-out account chooser is compact. |
| 44 | } |
| 45 | exit(found ? 0 : 1) |
| 46 | ''') |
| 47 | subprocess.run(["swiftc", str(probe), "-o", str(root / "windows")], check=True) |
| 48 | with (root / "launch.log").open("w+") as log: |
| 49 | process = subprocess.Popen(["sandbox-exec", "-p", profile, str(executable), |
| 50 | "-ApplePersistenceIgnoreState", "YES"], stdout=log, stderr=log) |
| 51 | try: |
| 52 | found = False |
| 53 | deadline = time.monotonic() + 12 |
| 54 | while time.monotonic() < deadline: |
| 55 | if process.poll() is not None: |
| 56 | log.seek(0) |
| 57 | raise RuntimeError(f"App exited with {process.returncode}: {log.read()}") |
| 58 | if subprocess.run([str(root / "windows"), str(process.pid)]).returncode == 0: |
| 59 | found = True |
| 60 | time.sleep(0.25) |
| 61 | assert found, "App survived but did not create a normal window" |
| 62 | print(f'PASS: {info["CFBundleName"]} {info["CFBundleShortVersionString"]} ' |
| 63 | f'({info["CFBundleVersion"]}) opens a window with build-directory access denied') |
| 64 | finally: |
| 65 | if process.poll() is None: |
| 66 | process.terminate() |
| 67 | try: |
| 68 | process.wait(timeout=5) |
| 69 | except subprocess.TimeoutExpired: |
| 70 | process.kill() |
| 71 | process.wait() |
| 72 | |
amadan