5549fdc70f
test(mac): speed up elevation host suite ( #126338 )
...
* test(mac): speed up elevation host suite
* test(process): restore no-output startup margin
2026-08-19 09:46:23 -07:00
603b0ec7f5
fix(macos): avoid elevation codesign metadata SIGPIPE ( #125487 )
...
* fix(macos): avoid elevation codesign metadata SIGPIPE
* fix(macos): preserve codesign metadata failures
2026-08-17 21:40:38 -07:00
04c9924c45
fix(macos): keep elevation host CUA-free ( #125408 )
...
* fix(macos): isolate elevation host from CUA
* fix(macos): fail closed on unsafe elevation rollback
* fix(macos): quarantine unsafe elevation state before recovery
* fix(macos): bind elevation recovery ownership
2026-08-17 17:03:04 -07:00
b77671ced2
feat(mac): harden Peekaboo elevation cutovers ( #124564 )
...
* feat(mac): harden elevation cutovers
* fix(mac): make elevation recovery transactional
* fix(mac): revalidate elevation owner shutdown
* fix(mac): quiesce elevation recovery owners
* fix(mac): close elevation artifact and recovery races
* fix(mac): use signed exclusive app renames
* fix(mac): defer elevation hangup signals
* fix(mac): restore receipts during elevation rollback
* fix(mac): bind elevation receipts to both architectures
* fix(mac): close elevation attestation races
* fix(mac): bind elevation proof to final objects
* fix(mac): keep elevation rollback independently trusted
* fix(mac): validate every rollback generation
* fix(mac): authenticate legacy elevation recovery
* fix(mac): attest recursive Peekaboo sources
* fix(mac): recover when elevation app is unavailable
* fix(mac): preserve raced recovery custody
* test(mac): preserve missing-tool coverage
* test(mac): register recursive gitlink fixture
* fix(mac): authenticate all elevation custody
* fix(mac): bind elevation build and recovery inputs
* fix(mac): persist elevation recovery transactions
* fix(mac): durably publish elevation custody
* fix(mac): complete elevation transaction durability
2026-08-17 02:20:55 -07:00
3744af3d44
improve(mac): guard elevation signing identity against drift ( #123764 )
...
scripts/mac-elevation-host.sh ships as the portable installer added in
#123675 , so it is deliberately self-contained and cannot source shared
constants. That forces it to duplicate ELEVATION_TEAM_ID and
ELEVATION_IDENTITY from scripts/codesign-mac-app.sh, with nothing keeping
the two copies in sync. Add a test asserting they agree, so rotation drift
fails at build time instead of on a target Mac.
Also document why the sign-time and install-time elevation verification
functions both exist: verify_elevation_app requires a notarized and stapled
bundle, so it cannot replace the sign-time check, and deleting that check
would defer every identity failure until after a notarization submission is
already spent.
No behavior change: no artifact bytes, filenames, modes, receipt fields,
signing, notarization, or install paths are touched.
2026-08-14 12:50:57 -07:00
493a3e46b3
fix(mac): package portable elevation installer ( #123675 )
...
* fix(mac): package portable elevation installer
* docs(mac): explain portable elevation install
2026-08-14 07:33:05 -07:00
44dd983c0c
feat(mac): add canonical elevation host workflow ( #123569 )
...
* feat(mac): add canonical elevation host workflow
* fix(mac): clarify elevation host deployment
* test(ui): stabilize cloud startup effort flow
* fix(mac): fail closed on unknown TCC status
* test: synchronize async CI boundaries
* test: remove remaining CI timing races
2026-08-14 05:39:24 -07:00
Peter Steinberger