Qiu Yuzhou a20df3001f feat(ng2): external binary supply chain and packaging gate (#24) ...

Pin sslocal v1.25.0 (aarch64-apple-darwin) and v2ray-plugin v1.3.2 via
committed manifests (tag + asset URL + archive SHA-256 + bundle location +
sign identifier):

- Scripts/fetch-external-binaries.sh downloads the pinned archive, verifies
  its SHA-256 byte-for-byte, extracts only the named member (arm64-only
  check) and stamps the local cache; archive hash mismatch fails hard, and
  any manifest/local-artifact drift forces a re-verified refetch. It re-runs
  as a pre-build phase so tampering fails the build itself.
- project.yml installs both binaries via Copy Files into
  Contents/Helpers[/Plugins]; generate requires the artifacts to exist
  (fetch before generate, else Copy Files phases are silently dropped).
- Scripts/sign-embedded-helpers.sh re-signs each helper Developer ID with
  --options runtime --timestamp and the pinned identifier
  (<bundle-id>[.plugin.]<name>) before Xcode seals the outer app signature.
- Scripts/packaging-gate.sh asserts strict nested signature verification,
  DevID + Hardened Runtime on the app with no App Sandbox entitlement, and
  exact per-binary manifest coverage under Contents/Helpers.
- Tests pin both manifests' schema and anchor hashes.

Verified: build + gate all green; byte-flip, foreign-binary and
missing-binary tampers each caught; 5 unit tests pass; no submodules or
in-repo builds; notarization stays out of scope (#39).

2026-09-20 14:27:21 +08:00

..

fetch-external-binaries.sh

feat(ng2): external binary supply chain and packaging gate (#24)

2026-09-20 14:27:21 +08:00

lib-manifests.sh

feat(ng2): external binary supply chain and packaging gate (#24)

2026-09-20 14:27:21 +08:00

packaging-gate.sh

feat(ng2): external binary supply chain and packaging gate (#24)

2026-09-20 14:27:21 +08:00

sign-embedded-helpers.sh

feat(ng2): external binary supply chain and packaging gate (#24)

2026-09-20 14:27:21 +08:00