[PR #1084] [MERGED] fix(native): keep signature failure evidence instead of collapsing it #2632

New issue

Closed

opened 2026-10-17 21:08:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1084
Author: @morluto
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @morluto

Base: feat/signature-posture ← Head: cursor/signature-posture-cleanup-d298

📝 Commits (1)

3c69e9c fix(native): keep signature failure evidence instead of collapsing it

📊 Changes

5 files changed (+97 additions, -12 deletions)

View changed files

📝 src/native/CodesignVerification.ts (+28 -8)
📝 src/native/NativeSignatureInspection.ts (+10 -0)
📝 src/native/NativeSignaturePosture.ts (+10 -1)
📝 tests/boundary/providers/native/codesignVerificationReasons.test.ts (+3 -0)
📝 tests/boundary/providers/native/nativeSignaturePosture.test.ts (+46 -3)

📄 Description

Summary

Follow-up to #934. A few signature results were collapsing a real observation into a weaker status.

A regular Contents/CodeResources file replaced by a directory or FIFO before open was reported absent. That hid the replacement. It is now unreadable with reason changed.
A failed anchor apple probe kept only an exit code in provenance. The caller-visible limitation now includes the probe diagnostic.
Definitive codesign rejections are a phrase list, including bundle format unrecognized, invalid, or unsuitable, instead of one growing regular expression. Unlisted nonzero diagnostics stay unknown.

The stapled-ticket length check is unchanged. Real Firefox and Discord tickets already pass the current parser.

Verification

npm run test:focused -- tests/boundary/providers/native/codesignVerificationReasons.test.ts tests/boundary/providers/native/nativeSignaturePosture.test.ts src/native/CodeSigningPolicy.test.ts
Pre-push npm run check:fast

Real macOS verify:code-signature was not re-run here. Real Hopper/Ghidra verification was not applicable.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1084 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `feat/signature-posture` ← **Head:** `cursor/signature-posture-cleanup-d298` --- ### 📝 Commits (1) - [`3c69e9c`](https://github.com/morluto/rea/commit/3c69e9c86ca8403c5d1cc8be2ae711f1089dba85) fix(native): keep signature failure evidence instead of collapsing it ### 📊 Changes **5 files changed** (+97 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `src/native/CodesignVerification.ts` (+28 -8) 📝 `src/native/NativeSignatureInspection.ts` (+10 -0) 📝 `src/native/NativeSignaturePosture.ts` (+10 -1) 📝 `tests/boundary/providers/native/codesignVerificationReasons.test.ts` (+3 -0) 📝 `tests/boundary/providers/native/nativeSignaturePosture.test.ts` (+46 -3) </details> ### 📄 Description  ## Summary Follow-up to #934. A few signature results were collapsing a real observation into a weaker status. - A regular `Contents/CodeResources` file replaced by a directory or FIFO before `open` was reported `absent`. That hid the replacement. It is now `unreadable` with reason `changed`. - A failed `anchor apple` probe kept only an exit code in provenance. The caller-visible limitation now includes the probe diagnostic. - Definitive `codesign` rejections are a phrase list, including `bundle format unrecognized, invalid, or unsuitable`, instead of one growing regular expression. Unlisted nonzero diagnostics stay `unknown`. The stapled-ticket length check is unchanged. Real Firefox and Discord tickets already pass the current parser. ## Verification - `npm run test:focused -- tests/boundary/providers/native/codesignVerificationReasons.test.ts tests/boundary/providers/native/nativeSignaturePosture.test.ts src/native/CodeSigningPolicy.test.ts` - Pre-push `npm run check:fast` Real macOS `verify:code-signature` was not re-run here. Real Hopper/Ghidra verification was not applicable.  <div><a href="https://cursor.com/agents/bc-b50166c8-2750-4725-adf5-16ed0e97d298?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-b50166c8-2750-4725-adf5-16ed0e97d298&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:26 +00:00