Distinct id from Legacy (com.qiuyuzhou.ShadowsocksX-NG) lets NG2 own
~/Library/Application Support/ShadowsocksX-NG2/ directly; the v2/
subdir prefix is removed from all runtime paths.
- app/agent/tests targets + LaunchAgent plist renamed accordingly
- keychain service, queue labels, and Vendor signIdentifiers follow
the new bundle id; embedded helpers re-sign at build time
- Legacy handoff/import constants keep pointing at the old id
Migration: dev data under ShadowsocksX-NG/v2/ is not carried over
(fresh catalog/activation); old LaunchAgent registration and old
keychain entries must be cleaned up manually.
Pin sslocal v1.25.0 (aarch64-apple-darwin) and v2ray-plugin v1.3.2 via
committed manifests (tag + asset URL + archive SHA-256 + bundle location +
sign identifier):
- Scripts/fetch-external-binaries.sh downloads the pinned archive, verifies
its SHA-256 byte-for-byte, extracts only the named member (arm64-only
check) and stamps the local cache; archive hash mismatch fails hard, and
any manifest/local-artifact drift forces a re-verified refetch. It re-runs
as a pre-build phase so tampering fails the build itself.
- project.yml installs both binaries via Copy Files into
Contents/Helpers[/Plugins]; generate requires the artifacts to exist
(fetch before generate, else Copy Files phases are silently dropped).
- Scripts/sign-embedded-helpers.sh re-signs each helper Developer ID with
--options runtime --timestamp and the pinned identifier
(<bundle-id>[.plugin.]<name>) before Xcode seals the outer app signature.
- Scripts/packaging-gate.sh asserts strict nested signature verification,
DevID + Hardened Runtime on the app with no App Sandbox entitlement, and
exact per-binary manifest coverage under Contents/Helpers.
- Tests pin both manifests' schema and anchor hashes.
Verified: build + gate all green; byte-flip, foreign-binary and
missing-binary tampers each caught; 5 unit tests pass; no submodules or
in-repo builds; notarization stays out of scope (#39).
Qiu Yuzhou