From 444c1c9aa5337626404226873aa940688602f6e9 Mon Sep 17 00:00:00 2001 From: Ronald Eddings Date: Sat, 4 Jul 2026 11:51:15 -0500 Subject: [PATCH] =?UTF-8?q?Release=200.22.3=20=E2=80=94=20build=20hardenin?= =?UTF-8?q?g:=20ad-hoc=20codesign=20for=20locally=20built=20macOS=20binari?= =?UTF-8?q?es?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ad-hoc codesigning for locally built binaries (community contribution — thanks @miskaone, #114): on Apple Silicon, macOS SIGKILLs unsigned Mach-O executables, so a freshly compiled interceptor exited 137 ("Killed: 9") with no output and the daemon never stayed up — every CLI command then returned empty. scripts/build.sh now strips any stale signature and ad-hoc re-signs dist/interceptor, the daemon, and the bridge binary after every compile. Guarded to macOS hosts with codesign present; a no-op on Linux/Windows and CI hosts. Maintainer hardening on top: codesign --verify --strict after each sign so a malformed signature fails the build loudly instead of resurfacing as a silent kill at first run, and a post-build smoke check (dist/interceptor --version) that proves the compiled CLI actually executes on the build host. The ad-hoc path intentionally carries no entitlements: enforcement only applies under the hardened runtime, which ad-hoc signing doesn't enable. Release artifacts are re-signed with the Developer ID identity, entitlements, and notarization by the release pipeline, which is unchanged. Co-Authored-By: Claude Fable 5 --- extension/dist-mv2/manifest.json | 2 +- extension/manifest.json | 2 +- package.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/extension/dist-mv2/manifest.json b/extension/dist-mv2/manifest.json index e0bcd1d..5ec601f 100644 --- a/extension/dist-mv2/manifest.json +++ b/extension/dist-mv2/manifest.json @@ -1,7 +1,7 @@ { "manifest_version": 2, "name": "Interceptor Electron App Bridge", - "version": "0.22.2", + "version": "0.22.3", "description": "Electron app bridge", "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr8I3MwCNVrLcP0OCP8fRpiGWHIpbu2iMsyweU4YcX/CWdmO2fnZAJ6UP+IKkM5Zw9mt9kY4CFW4tZt096ChuMKiVBg4HM47ffWHTlo6rXOzdLuXMQ6MtFDuqbQuq6x0tLgYlOr7UxSiPVFgPRuczOz+kPkTO/h8nJNDaouNY1WnG4/ESruv10gwLwxgNKEvisnjxDU6lw9zDm/+pF8aAB8RMJbJQpRRBKDVL8rTRb4yCp6qi8E9VkJRK3sTD9sX0fgZoYd4pkvbK+7kPh9oxiuzPKNCKm9v8XTCVBh+sWBJBdke7PAoERkdXOs2MEijjO2A0X4/tzqygr3oARSghkQIDAQAB", "icons": { diff --git a/extension/manifest.json b/extension/manifest.json index 4e58752..1d853f7 100644 --- a/extension/manifest.json +++ b/extension/manifest.json @@ -1,7 +1,7 @@ { "manifest_version": 3, "name": "Interceptor", - "version": "0.22.2", + "version": "0.22.3", "minimum_chrome_version": "116", "description": "Browser bridge", "icons": { diff --git a/package.json b/package.json index 1462bf0..30548a2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "interceptor", - "version": "0.22.2", + "version": "0.22.3", "type": "module", "license": "Elastic-2.0", "bin": {