Real sslocal smoke (11 tests, ~27s) sat on every task test as the
slow tail. Tests/Smoke now builds as a separate target behind the
ShadowsocksX-NG2Smoke scheme; task test:smoke runs it on demand and
the README release gate requires it green next to packaging-gate.
SignalRecorder also gains kill(_, 0) semantics (stale pids report
ESRCH): the GUI-restart test burned the 5s waitForWrapperExit
ceiling on pid 99999, now 0.18s. Default lane: 617 tests ~40s.
Pin sslocal v1.25.0 (aarch64-apple-darwin) and v2ray-plugin v1.3.2 via
committed manifests (tag + asset URL + archive SHA-256 + bundle location +
sign identifier):
- Scripts/fetch-external-binaries.sh downloads the pinned archive, verifies
its SHA-256 byte-for-byte, extracts only the named member (arm64-only
check) and stamps the local cache; archive hash mismatch fails hard, and
any manifest/local-artifact drift forces a re-verified refetch. It re-runs
as a pre-build phase so tampering fails the build itself.
- project.yml installs both binaries via Copy Files into
Contents/Helpers[/Plugins]; generate requires the artifacts to exist
(fetch before generate, else Copy Files phases are silently dropped).
- Scripts/sign-embedded-helpers.sh re-signs each helper Developer ID with
--options runtime --timestamp and the pinned identifier
(<bundle-id>[.plugin.]<name>) before Xcode seals the outer app signature.
- Scripts/packaging-gate.sh asserts strict nested signature verification,
DevID + Hardened Runtime on the app with no App Sandbox entitlement, and
exact per-binary manifest coverage under Contents/Helpers.
- Tests pin both manifests' schema and anchor hashes.
Verified: build + gate all green; byte-flip, foreign-binary and
missing-binary tampers each caught; 5 unit tests pass; no submodules or
in-repo builds; notarization stays out of scope (#39).
XcodeGen-managed SwiftUI menu bar app in ShadowsocksX-NG2/: LSUIElement,
inherited bundle id com.qiuyuzhou.ShadowsocksX-NG, macOS 15 arm64,
Hardened Runtime + Developer ID signing, empty entitlements dict (no App
Sandbox; Release disables base entitlement injection). Placeholder status
menu and main window; unit test target wired into the app scheme. Test
bundles sign with the Apple Development cert so Hardened Runtime library
validation accepts injection. Generated .xcodeproj and plists are
gitignored; project.yml is the source of truth. Legacy/ untouched.
Closes#22
- Remove GitHub Actions workflows and issue templates
- Move legacy ShadowsocksX-NG project into Legacy/
- Remove git submodules; dependencies will use prebuilt
binaries copied from upstream releases instead of
building in-repo
- Add ShadowsocksX-NG2/ directory for the new project
- Update .gitignore paths for the new layout
Qiu Yuzhou
Kebin Liu
Charlie Qiu