fix(cua-driver-rs)(install): _install-local-rust.sh symlink swap + macOS 26 codesign - #1716
Merged
Merged
Conversation
…cOS 26 codesign
Two install-script bugs surfaced by today's macOS 26.4 + slow-path
re-install.
1) Atomic symlink swap was broken on macOS
================================================
Previous code:
TMP_LINK="$CURRENT_LINK.new"
rm -f "$TMP_LINK"
ln -s "$VERSIONED_DIR" "$TMP_LINK"
mv -Tf "$TMP_LINK" "$CURRENT_LINK" 2>/dev/null \
|| mv -f "$TMP_LINK" "$CURRENT_LINK"
`mv -T` is GNU-only. On macOS BSD coreutils the `-Tf` form silently
errors (redirected to /dev/null), then the fallback `mv -f` fires. When
the destination is a symlink-to-directory (which `$CURRENT_LINK` is on
re-install), BSD `mv -f` *follows the symlink* and drops the temp
symlink INSIDE the directory as `current/current.new`, leaving stale
`current.new` orphans at both the packages/ level AND inside the
versioned release dir, and the actual `current` symlink untouched.
Replacement: `ln -sfn` — POSIX, atomic on POSIX-compliant filesystems,
works identically on macOS BSD and Linux GNU. No temp file, no orphan
to sweep on partial failure. Also adds an `rm -f "$CURRENT_LINK.new"`
to clean up any orphan that a previous (pre-fix) run might've left.
User-facing repro:
$ ./install-local.sh
...
Staging into ...
mv: ...current.new and .../current/current.new are identical
[exit 1, broken state on disk]
2) macOS 26 Taskgated rejects linker-emitted adhoc signatures after cp
========================================================================
macOS 26.4 (the user's host) enforces CODESIGNING-namespace verification
stricter than 14.x and earlier. After `cp` planted the new binary at
the versioned release dir, the kernel's cached signature for the new
inode didn't match the embedded linker-emitted ad-hoc signature
strictly enough, and Taskgated SIGKILLed the binary on first launch
with no stderr output. Exit code 137. Only diagnostic was buried in
~/Library/Logs/DiagnosticReports/cua-driver-*.ips:
"type": "EXC_CRASH",
"signal": "SIGKILL (Code Signature Invalid)"
"namespace": "CODESIGNING",
"indicator": "Taskgated Invalid Signature"
Fix: re-sign in place with `codesign --force --sign -` immediately
after the `cp`. The fresh embedded ad-hoc signature is keyed to the
on-disk bytes Taskgated will subsequently verify. Cheap (~50ms on a
40MB binary). macOS-only — guarded with `command -v codesign` so
Linux + minimal macOS shells don't blow up if codesign is missing.
If codesign fails for any reason (rare — would need a corrupted dev
toolchain), prints a yellow warning rather than failing the install,
so users on older macOS where the issue doesn't manifest aren't
blocked. The warning text names the symptom (SIGKILL on first run)
so anyone hitting it can correlate.
Test plan
=========
- [x] `bash -n` clean
- [x] Live test on macOS 26.4.1: install-local.sh end-to-end completes,
no orphan files, `~/.local/bin/cua-driver --version` exits 0
- [ ] Linux verification (the codesign step is guarded; symlink fix
applies on both)
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe local Rust installation script now re-signs the staged ChangesLocal Rust Installation Flow
Possibly Related PRs
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two bugs in
_install-local-rust.shBoth surfaced today on macOS 26.4.1 mid-session.
1. Atomic symlink swap was broken on macOS
mv -Tis GNU-only. On macOS BSD coreutils the-Tfform silently errors (stderr discarded), the fallbackmv -ffires, and when the destination is a symlink-to-directory it follows the symlink, dumping the temp inside ascurrent/current.new. Leaves stalecurrent.neworphans at both levels; the actualcurrentsymlink never gets repointed.User-facing repro:
Fix: replace with
ln -sfn. POSIX, atomic on POSIX-compliant FS, works the same on BSD and GNU. No temp file means no orphan to sweep on partial failure.2. macOS 26 Taskgated SIGKILLs the freshly-installed binary
After
cpplanted the new binary, the kernel's cached signature for the new inode didn't match the linker-emitted ad-hoc signature strictly enough under macOS 26's CODESIGNING namespace. Result:SIGKILL (Code Signature Invalid) — Taskgated Invalid Signatureon first run, no stderr, exit 137. Buried in~/Library/Logs/DiagnosticReports/cua-driver-*.ips.Fix: re-sign in place with
codesign --force --sign -immediately after thecp. Macos-only; guarded withcommand -v codesign. ~50ms cost on a 40MB binary. Prints a warning rather than failing if codesign isn't available, so older macOS / Linux installs aren't blocked.Repro (this Mac, macOS 26.4.1)
Test plan
bash -ncleancodesignstep is guarded bycommand -v codesign, so it's a no-op; theln -sfnfix applies on both🤖 Generated with Claude Code
Summary by CodeRabbit