P0: bundle self-contained Mac connector runtime

.github/workflows/_build-reusable.yml

@@ -44,6 +44,10 @@ env:
   PEEKABOO_SHA256: '5be06117ed861ac7a87ea1d1e552122db4231bf2cd618ec516d77c66acd39620'
   PEEKABOO_BINARY_SHA256: '4a5c7e28c263c84e406aa1853ef62cad3042b13f40a7a9e044ec74ec42933383'
   PEEKABOO_LICENSE_SHA256: '62316704df7426e5a79d2827ff8aca36e9abb3a73b8e68557030749ebefec667'
+  PYTHON_RUNTIME_VERSION: '3.12.13'
+  PYTHON_RUNTIME_RELEASE: '20260510'
+  PYTHON_RUNTIME_ARM64_SHA256: '5a30271f8d345a5b02b0c9e4e31e0f1e1455a8e4a04fba95cd9762472abc3b17'
+  PYTHON_RUNTIME_X64_SHA256: 'cd369e76973c3179bc578230d8615ab621968ed758c5e32f636eecef4ad79894'
 
 jobs:
   code-quality:
@@ -666,6 +670,13 @@ jobs:
             echo "EVAOS_REQUIRED_PEEKABOO_SOURCE_SHA256=$PEEKABOO_BINARY_SHA256"
           } >> "$GITHUB_ENV"
 
+      - name: Install pinned evaOS desktop bridge Python runtime (macOS only)
+        if: startsWith(matrix.platform, 'macos')
+        shell: bash
+        run: |
+          set -euo pipefail
+          scripts/prepareEvaosDesktopBridgePythonRuntime.sh "${{ matrix.arch }}" "$GITHUB_ENV"
+
       # macOS: Build with notarization - DMG failure = CI failure, notarization failure = warning only
       # macOS: 构建并公证 - DMG 失败 = CI 失败，公证失败 = 仅警告
       - name: Build with electron-builder (macOS)

.github/workflows/workbench-functional-smoke.yml

@@ -41,6 +41,10 @@ env:
   PEEKABOO_SHA256: '5be06117ed861ac7a87ea1d1e552122db4231bf2cd618ec516d77c66acd39620'
   PEEKABOO_BINARY_SHA256: '4a5c7e28c263c84e406aa1853ef62cad3042b13f40a7a9e044ec74ec42933383'
   PEEKABOO_LICENSE_SHA256: '62316704df7426e5a79d2827ff8aca36e9abb3a73b8e68557030749ebefec667'
+  PYTHON_RUNTIME_VERSION: '3.12.13'
+  PYTHON_RUNTIME_RELEASE: '20260510'
+  PYTHON_RUNTIME_ARM64_SHA256: '5a30271f8d345a5b02b0c9e4e31e0f1e1455a8e4a04fba95cd9762472abc3b17'
+  PYTHON_RUNTIME_X64_SHA256: 'cd369e76973c3179bc578230d8615ab621968ed758c5e32f636eecef4ad79894'
   WORKBENCH_SMOKE_BRIDGE_REF: ${{ inputs.bridge_ref || vars.EVAOS_DESKTOP_BRIDGE_SOURCE_REF }}
   WORKBENCH_SMOKE_REF: ${{ inputs.ref }}
 
@@ -149,6 +153,12 @@ jobs:
             echo "EVAOS_REQUIRED_PEEKABOO_SOURCE_SHA256=$PEEKABOO_BINARY_SHA256"
           } >> "$GITHUB_ENV"
 
+      - name: Install pinned desktop bridge Python runtime
+        shell: bash
+        run: |
+          set -euo pipefail
+          scripts/prepareEvaosDesktopBridgePythonRuntime.sh arm64 "$GITHUB_ENV"
+
       - name: evaOS guardrail audit
         if: ${{ inputs.run_guardrails }}
         shell: bash
@@ -188,6 +198,8 @@ jobs:
           BRIDGE_HELPER="$APP_PATH/Contents/Resources/Bridge/bin/evaos-connector-helper"
           BRIDGE_PEEKABOO_LICENSE="$APP_PATH/Contents/Resources/Bridge/licenses/Peekaboo-LICENSE.txt"
           BRIDGE_MANIFEST="$APP_PATH/Contents/Resources/Bridge/manifest.json"
+          BRIDGE_PYTHON="$APP_PATH/Contents/Resources/Bridge/python/bin/python3"
+          BRIDGE_PYTHON_LICENSE="$APP_PATH/Contents/Resources/Bridge/licenses/CPython-LICENSE.txt"
           AIONCORE_DIR="$APP_PATH/Contents/Resources/bundled-aioncore"
           HUB_DIR="$APP_PATH/Contents/Resources/hub"
 
@@ -196,6 +208,8 @@ jobs:
           test -x "$BRIDGE_HELPER"
           test -f "$BRIDGE_PEEKABOO_LICENSE"
           test -f "$BRIDGE_MANIFEST"
+          test -x "$BRIDGE_PYTHON"
+          test -f "$BRIDGE_PYTHON_LICENSE"
           test -d "$AIONCORE_DIR"
           test -d "$HUB_DIR"
 
@@ -209,6 +223,8 @@ jobs:
           BUNDLED_PEEKABOO_LICENSE_SHA256="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(m.bundledTools?.peekaboo?.licenseSha256 || 'unknown')" "$BRIDGE_MANIFEST")"
           PACKAGED_PEEKABOO_SHA256="$(shasum -a 256 "$BRIDGE_PEEKABOO" | awk '{print $1}')"
           ACTUAL_PEEKABOO_LICENSE_SHA256="$(shasum -a 256 "$BRIDGE_PEEKABOO_LICENSE" | awk '{print $1}')"
+          BUNDLED_PYTHON_VERSION="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(m.bundledTools?.python?.version || 'unknown')" "$BRIDGE_MANIFEST")"
+          BUNDLED_PYTHON_SOURCE_SHA256="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(m.bundledTools?.python?.sourceSha256 || 'unknown')" "$BRIDGE_MANIFEST")"
 
           if [ "$BRIDGE_VERSION" != "$WORKBENCH_SMOKE_BRIDGE_REF" ]; then
             echo "::error::Bundled bridge manifest ($BRIDGE_VERSION) does not match requested bridge ref ($WORKBENCH_SMOKE_BRIDGE_REF)"
@@ -238,6 +254,14 @@ jobs:
             echo "::error::Bundled Peekaboo license digest does not match the bridge manifest."
             exit 1
           fi
+          if [ "$BUNDLED_PYTHON_VERSION" != "$PYTHON_RUNTIME_VERSION" ] || [ "$BUNDLED_PYTHON_SOURCE_SHA256" != "$PYTHON_RUNTIME_ARM64_SHA256" ]; then
+            echo "::error::Bundled Python runtime identity does not match the pinned arm64 release."
+            exit 1
+          fi
+          test "$(readlink "$BRIDGE_PYTHON")" = python3.12
+          test "$(lipo -archs "$APP_PATH/Contents/Resources/Bridge/python/bin/python3.12")" = arm64
+          env -i HOME="$HOME" PATH=/usr/bin:/bin:/usr/sbin:/sbin "$BRIDGE_PYTHON" -I -c 'import ApplicationServices, Quartz'
+          env -i HOME="$HOME" PATH=/usr/bin:/bin:/usr/sbin:/sbin "$BRIDGE" status --json | jq -e '.ok == true or .ok == false' >/dev/null
 
           echo "app_path=$APP_PATH" >> "$GITHUB_OUTPUT"
           echo "bundle_id=$BUNDLE_ID" >> "$GITHUB_OUTPUT"

CHANGELOG.md

@@ -17,6 +17,12 @@
 
 ### Pristine Mac Enrollment
 
+- Bundles a pinned, checksum-verified CPython 3.12 runtime with the desktop
+  bridge, including the pinned PyObjC frameworks used by direct Accessibility
+  control, so connector setup no longer depends on Homebrew, a system Python,
+  or a customer-installed Python package; release packaging fails closed if
+  the runtime, architecture, dependency provenance, native signing closure, or
+  license notices are missing.
 - Adds an authenticated, customer-scoped Workbench action for the typed
   `unenrolled` secure-network state; wrong-control-plane, ACL, missing-client,
   and incomplete-evidence states remain fail closed.

scripts/afterPack.js

@@ -178,13 +178,39 @@ function requireManagedNodeRuntime(resourcesDir, runtimeKey, electronPlatformNam
   }
 }
 
-function verifyEvaosDesktopBridgeResource(resourcesDir, electronPlatformName) {
+const PYTHON_RUNTIME_SOURCE_SHA256_BY_ARCH = {
+  arm64: '5a30271f8d345a5b02b0c9e4e31e0f1e1455a8e4a04fba95cd9762472abc3b17',
+  x64: 'cd369e76973c3179bc578230d8615ab621968ed758c5e32f636eecef4ad79894',
+};
+const PYTHON_RUNTIME_PACKAGES = [
+  ['pyobjc-core', '12.2.1', 'a64232bb27ed101d4adc7d42b0e64a6d3331aac7bee7861c037a6777a163f10b'],
+  ['pyobjc-framework-Cocoa', '12.2.1', '28b9b8bab1c36efb94744786918752d0c1842f5fbb67e7d5ca97b5f736512080'],
+  ['pyobjc-framework-Quartz', '12.2.1', 'de9c8cca7e95290c8d540466af11c7cdfe3a5458e6f56c34006d5b45243f9ed9'],
+  [
+    'pyobjc-framework-ApplicationServices',
+    '12.2.1',
+    'f519ced13888d03410cd7da1f08fc56ee2944099e607216cef7ca26ecfdef61b',
+  ],
+  ['pyobjc-framework-CoreText', '12.2.1', 'ac2ead13dfa4379a1566129d0e8a8ea778a2bcac9ac360a583360fd4f1ba39c6'],
+].map(([name, version, sha256]) => ({ name, version, sha256 }));
+
+function thinMachOArchitecture(filePath) {
+  const header = fs.readFileSync(filePath).subarray(0, 8).toString('hex');
+  if (header.startsWith('cffaedfe0c000001')) return 'arm64';
+  if (header.startsWith('cffaedfe07000001')) return 'x64';
+  return undefined;
+}
+
+function verifyEvaosDesktopBridgeResource(resourcesDir, electronPlatformName, targetArch) {
   if (electronPlatformName !== 'darwin') return;
 
   const bridgePath = path.join(resourcesDir, 'Bridge', 'evaos-desktop-bridge');
   const peekabooPath = path.join(resourcesDir, 'Bridge', 'bin', 'peekaboo');
   const helperPath = path.join(resourcesDir, 'Bridge', 'bin', 'evaos-connector-helper');
   const manifestPath = path.join(resourcesDir, 'Bridge', 'manifest.json');
+  const pythonPath = path.join(resourcesDir, 'Bridge', 'python', 'bin', 'python3');
+  const versionedPythonPath = path.join(resourcesDir, 'Bridge', 'python', 'bin', 'python3.12');
+  const pythonLicensePath = path.join(resourcesDir, 'Bridge', 'licenses', 'CPython-LICENSE.txt');
   const missing = [];
   if (!fs.existsSync(bridgePath)) {
     missing.push(path.join('Bridge', 'evaos-desktop-bridge'));
@@ -216,6 +242,21 @@ function verifyEvaosDesktopBridgeResource(resourcesDir, electronPlatformName) {
   if (!fs.existsSync(manifestPath)) {
     missing.push(path.join('Bridge', 'manifest.json'));
   }
+  if (!fs.existsSync(pythonPath)) {
+    missing.push(path.join('Bridge', 'python', 'bin', 'python3'));
+  } else {
+    try {
+      fs.accessSync(pythonPath, fs.constants.X_OK);
+    } catch {
+      throw new Error(`Packaged evaOS desktop bridge Python runtime is not executable: ${pythonPath}`);
+    }
+  }
+  if (!fs.existsSync(versionedPythonPath)) {
+    missing.push(path.join('Bridge', 'python', 'bin', 'python3.12'));
+  }
+  if (!fs.existsSync(pythonLicensePath)) {
+    missing.push(path.join('Bridge', 'licenses', 'CPython-LICENSE.txt'));
+  }
   if (missing.length > 0) {
     throw new Error(`Packaged app is missing required evaOS desktop bridge resource(s): ${missing.join(', ')}`);
   }
@@ -231,6 +272,34 @@ function verifyEvaosDesktopBridgeResource(resourcesDir, electronPlatformName) {
   if (strictReleaseBridge) {
     requireMachOExecutable(peekabooPath, path.join('Bridge', 'bin', 'peekaboo'));
     requireMachOExecutable(helperPath, path.join('Bridge', 'bin', 'evaos-connector-helper'));
+    requireMachOExecutable(pythonPath, path.join('Bridge', 'python', 'bin', 'python3'));
+    const pythonMetadata = manifest.bundledTools?.python;
+    if (
+      !pythonMetadata?.version ||
+      !/^[0-9a-f]{64}$/i.test(String(pythonMetadata.sourceSha256 || '')) ||
+      !String(pythonMetadata.sourceUrl || '').startsWith('https://github.com/astral-sh/python-build-standalone/') ||
+      pythonMetadata.licensePath !== 'licenses/CPython-LICENSE.txt' ||
+      JSON.stringify(pythonMetadata.packages) !== JSON.stringify(PYTHON_RUNTIME_PACKAGES)
+    ) {
+      throw new Error('Packaged evaOS desktop bridge manifest is missing pinned bundled Python runtime provenance.');
+    }
+    if (targetArch) {
+      const expectedDigest = PYTHON_RUNTIME_SOURCE_SHA256_BY_ARCH[targetArch];
+      if (
+        !expectedDigest ||
+        pythonMetadata.architecture !== targetArch ||
+        pythonMetadata.sourceSha256 !== expectedDigest ||
+        thinMachOArchitecture(versionedPythonPath) !== targetArch
+      ) {
+        throw new Error(
+          `Packaged evaOS desktop bridge Python runtime does not match target architecture ${targetArch}.`
+        );
+      }
+    }
+    const pythonLink = fs.lstatSync(pythonPath);
+    if (pythonLink.isSymbolicLink() && fs.readlinkSync(pythonPath) !== 'python3.12') {
+      throw new Error('Packaged evaOS desktop bridge Python launcher symlink is not relocatable.');
+    }
   }
 
   console.log('   ✓ evaOS desktop bridge resource verified');
@@ -302,7 +371,7 @@ module.exports = async function afterPack(context) {
     }
 
     verifyBundledResources(resourcesDir, electronPlatformName, targetArch);
-    verifyEvaosDesktopBridgeResource(resourcesDir, electronPlatformName);
+    verifyEvaosDesktopBridgeResource(resourcesDir, electronPlatformName, targetArch);
   } else {
     throw new Error(`resources directory not found: ${resourcesDir}`);
   }
@@ -457,4 +526,5 @@ module.exports = async function afterPack(context) {
 
 module.exports.verifyBundledResources = verifyBundledResources;
 module.exports.verifyEvaosDesktopBridgeResource = verifyEvaosDesktopBridgeResource;
+module.exports.thinMachOArchitecture = thinMachOArchitecture;
 module.exports.isMachOExecutable = isMachOExecutable;

scripts/afterSign.js

@@ -159,17 +159,25 @@ function getAppTrustProcessTimeoutMs(env = process.env) {
   return getPositiveProcessTimeoutMs(env, 'EVAOS_APP_TRUST_PROCESS_TIMEOUT_MS', DEFAULT_APP_TRUST_PROCESS_TIMEOUT_MS);
 }
 
-function isMachOExecutable(filePath) {
+function isMachOFile(filePath) {
   if (!fs.existsSync(filePath)) return false;
   try {
-    fs.accessSync(filePath, fs.constants.X_OK);
     const header = fs.readFileSync(filePath, { encoding: null, flag: 'r' }).subarray(0, 4).toString('hex');
     return MACHO_MAGICS.has(header);
   } catch {
     return false;
   }
 }
 
+function isMachOExecutable(filePath) {
+  try {
+    fs.accessSync(filePath, fs.constants.X_OK);
+    return isMachOFile(filePath);
+  } catch {
+    return false;
+  }
+}
+
 function expectedMacControlHelperTeamId(env = process.env) {
   return (
     getEnvValue(env, {
@@ -196,11 +204,16 @@ function codeSignatureDetails(filePath, runProcess = spawnSync) {
   return output;
 }
 
-function assertMacControlHelperSignature(filePath, env = process.env, runProcess = spawnSync) {
+function assertMacControlHelperSignature(
+  filePath,
+  env = process.env,
+  runProcess = spawnSync,
+  requireExecutable = true
+) {
   if (!fs.existsSync(filePath)) {
     throw new Error(`Strict evaOS beta release is missing bundled Mac-control helper: ${filePath}`);
   }
-  if (!isMachOExecutable(filePath)) {
+  if (!(requireExecutable ? isMachOExecutable(filePath) : isMachOFile(filePath))) {
     throw new Error(
       `Strict evaOS beta release requires bundled Mac-control helper to be a native Mach-O executable: ${filePath}`
     );
@@ -223,6 +236,32 @@ function assertMacControlHelperSignatures(appPath, env = process.env, runProcess
   for (const relativePath of MAC_CONTROL_HELPER_RELATIVE_PATHS) {
     assertMacControlHelperSignature(path.join(appPath, relativePath), env, runProcess);
   }
+
+  const pythonRuntimeDir = path.join(appPath, 'Contents', 'Resources', 'Bridge', 'python');
+  if (!fs.existsSync(pythonRuntimeDir)) {
+    throw new Error(`Strict evaOS beta release is missing bundled Python runtime: ${pythonRuntimeDir}`);
+  }
+  const runtimeMachOPaths = [];
+  const pending = [pythonRuntimeDir];
+  while (pending.length > 0) {
+    const directory = pending.pop();
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const entryPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(entryPath);
+      } else if (entry.isFile() && isMachOFile(entryPath)) {
+        runtimeMachOPaths.push(entryPath);
+      }
+    }
+  }
+  if (runtimeMachOPaths.length === 0) {
+    throw new Error(
+      `Strict evaOS beta release bundled Python runtime has no native Mach-O closure: ${pythonRuntimeDir}`
+    );
+  }
+  for (const runtimePath of runtimeMachOPaths) {
+    assertMacControlHelperSignature(runtimePath, env, runProcess, false);
+  }
 }
 
 function isProcessTimeoutError(error) {

scripts/create-mock-release-artifacts.sh

@@ -42,20 +42,48 @@ create_mock_macos_zip() {
   mkdir -p "$tmp_dir/${PRODUCT_NAME}.app/Contents/Resources/Bridge/licenses"
   printf '#!/usr/bin/env bash\nprintf "{}\\n"\n' > "$tmp_dir/${PRODUCT_NAME}.app/Contents/Resources/Bridge/evaos-desktop-bridge"
   chmod +x "$tmp_dir/${PRODUCT_NAME}.app/Contents/Resources/Bridge/evaos-desktop-bridge"
-  python3 - "$tmp_dir/${PRODUCT_NAME}.app/Contents/Resources/Bridge" <<'PY'
+  python3 - "$tmp_dir/${PRODUCT_NAME}.app/Contents/Resources/Bridge" "$output_path" <<'PY'
 import hashlib
 import json
 import pathlib
 import sys
 
 bridge = pathlib.Path(sys.argv[1])
+output_path = pathlib.Path(sys.argv[2])
+architecture = "arm64" if "arm64" in output_path.name else "x64"
+runtime_sha256 = (
+    "5a30271f8d345a5b02b0c9e4e31e0f1e1455a8e4a04fba95cd9762472abc3b17"
+    if architecture == "arm64"
+    else "cd369e76973c3179bc578230d8615ab621968ed758c5e32f636eecef4ad79894"
+)
+python_header = bytes.fromhex("cffaedfe0c000001" if architecture == "arm64" else "cffaedfe07000001")
 macho = bytes.fromhex("cafebabe00000000")
 license_bytes = b"MIT License\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\n"
+python_license_bytes = b"Python Software Foundation License Version 2\n"
 (bridge / "bin" / "peekaboo").write_bytes(macho)
 (bridge / "bin" / "evaos-connector-helper").write_bytes(macho)
 (bridge / "bin" / "peekaboo").chmod(0o755)
 (bridge / "bin" / "evaos-connector-helper").chmod(0o755)
 (bridge / "licenses" / "Peekaboo-LICENSE.txt").write_bytes(license_bytes)
+(bridge / "licenses" / "CPython-LICENSE.txt").write_bytes(python_license_bytes)
+python_bin = bridge / "python" / "bin"
+site_packages = bridge / "python" / "lib" / "python3.12" / "site-packages"
+python_bin.mkdir(parents=True)
+(python_bin / "python3.12").write_bytes(python_header)
+(python_bin / "python3.12").chmod(0o755)
+(python_bin / "python3").symlink_to("python3.12")
+for package in ("ApplicationServices", "Quartz", "objc"):
+    package_dir = site_packages / package
+    package_dir.mkdir(parents=True, exist_ok=True)
+    (package_dir / "__init__.py").write_text("", encoding="utf-8")
+(site_packages / "objc" / "_objc.cpython-312-darwin.so").write_bytes(macho)
+python_packages = [
+    {"name":"pyobjc-core","version":"12.2.1","sha256":"a64232bb27ed101d4adc7d42b0e64a6d3331aac7bee7861c037a6777a163f10b"},
+    {"name":"pyobjc-framework-Cocoa","version":"12.2.1","sha256":"28b9b8bab1c36efb94744786918752d0c1842f5fbb67e7d5ca97b5f736512080"},
+    {"name":"pyobjc-framework-Quartz","version":"12.2.1","sha256":"de9c8cca7e95290c8d540466af11c7cdfe3a5458e6f56c34006d5b45243f9ed9"},
+    {"name":"pyobjc-framework-ApplicationServices","version":"12.2.1","sha256":"f519ced13888d03410cd7da1f08fc56ee2944099e607216cef7ca26ecfdef61b"},
+    {"name":"pyobjc-framework-CoreText","version":"12.2.1","sha256":"ac2ead13dfa4379a1566129d0e8a8ea778a2bcac9ac360a583360fd4f1ba39c6"},
+]
 manifest = {
     "placeholder": False,
     "source": "mock-release-asset",
@@ -66,7 +94,17 @@ manifest = {
             "license": "MIT",
             "licensePath": "licenses/Peekaboo-LICENSE.txt",
             "licenseSha256": hashlib.sha256(license_bytes).hexdigest(),
-        }
+        },
+        "python": {
+            "version": "3.12.13",
+            "architecture": architecture,
+            "sourceSha256": runtime_sha256,
+            "sourceUrl": "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython.tar.gz",
+            "packages": python_packages,
+            "license": "Python-2.0",
+            "licensePath": "licenses/CPython-LICENSE.txt",
+            "licenseSha256": hashlib.sha256(python_license_bytes).hexdigest(),
+        },
     },
 }
 (bridge / "manifest.json").write_text(json.dumps(manifest) + "\n", encoding="utf-8")