morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5538] [Bug] inspect-signature lists completed signing captures as an outstanding limitation #3372

New issue

Closed

opened 2026-10-31 00:39:39 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:39:39 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5538

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

node scripts/rea.mjs inspect-signature "$WORK/target" --json successfully returned an ad hoc signed Mach-O's entitlements and designated requirement, with three successful codesign captures in provenance. Both the normalized result and top-level Evidence limitations nevertheless included:

Entitlements and designated requirements require separate bounded commands.

Those commands had already completed. The signing facts were present and correct in the independently reproduced fixture; the defect is misleading limitations wording.

Reproduction

From an already built baseline checkout on macOS arm64 with Xcode Command Line Tools, set WORK to a fresh absolute directory outside the checkout and NODE to a supported Node.js executable. The independent verifier executed the following fixture preparation and CLI inspection with Node.js v24.22.0:

mkdir -p "$WORK/home" "$WORK/config" "$WORK/data" "$WORK/cache" "$WORK/state" "$WORK/runtime"
printf 'int main(void) { return 0; }\n' > "$WORK/target.c"
cat > "$WORK/entitlements.plist" <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0"><dict><key>com.apple.security.get-task-allow</key><true/></dict></plist>
PLIST
xcrun clang "$WORK/target.c" -o "$WORK/target"
codesign --force --sign - --identifier local.repro --entitlements "$WORK/entitlements.plist" "$WORK/target"
env HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/runtime" "$NODE" scripts/rea.mjs inspect-signature "$WORK/target" --json > "$WORK/signed.json" 2> "$WORK/signed.stderr"

Inspect normalized_result.entitlements, normalized_result.designated_requirement, both limitations arrays, and the three provenance entries in signed.json. This signed fixture inspection exited 0 with empty stderr. The verifier also removed its signature and reran the CLI, then re-signed without entitlements and reran it; those controls are described below. Dependency installation and building were not part of this reproduction.

Expected behavior

Limitations should describe boundaries that still apply to the completed answer. When requirements and entitlements have already been captured, the result should not imply their acquisition remains outstanding. An explicit statement that separate commands completed would also communicate this accurately.

At the baseline, src/contracts/native/nativeToolContracts.ts:106-110 advertises requirements, entitlements, and exact command provenance; docs/native-investigation.md:570-574 confirms entitlement reporting; docs/tool-design.md:51-56 calls for relevant limitations and inline answers with provenance. These are source-derived expectations. Preserve the genuine snapshot and trust-validation caveat.

Impact and scope

P3 wording defect: the observed signed result includes the requested signing facts and successful provenance. No missing signing data, downstream behavior failure, or security-boundary failure was observed. Callers can read the returned fields and successful provenance directly.

The limitation appeared in the entitlement-bearing signed fixture and the signed control without entitlements. The unsigned control instead reported Artifact is not signed.. Source inspection indicates the parser adds the disputed sentence for signed results generally; broader target coverage and MCP runtime behavior were not exercised.

REA version

6.7.0, source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v24.22.0; macOS (Darwin), arm64; Xcode Command Line Tools used for compilation and signing. The Node version satisfies the package engines range, but the exact .nvmrc pin was not used. No deep analysis provider is required. NOT_ENOUGH_INFO: the verifier did not record the macOS version/build or Xcode Command Line Tools version.

Target and artifact context

Locally compiled Mach-O arm64 executable containing int main(void) { return 0; }, ad hoc signed with identifier local.repro and entitlement com.apple.security.get-task-allow=true. Controls used the same fixture unsigned and ad hoc signed without entitlements.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

The independent verifier's CLI observations, summarized without private paths:

Signed with entitlements:
  exit=0; stderr empty; signed=true
  entitlements={"com.apple.security.get-task-allow":true}
  designated_requirement: non-null
  display, requirements, entitlements provenance: exit code 0 for all three
  normalized and top-level limitations both contain:
    Entitlements and designated requirements require separate bounded commands.

Unsigned control:
  exit=0; stderr empty; signed=false
  designated_requirement=null; entitlements=null
  limitation: Artifact is not signed.

Re-signed without entitlements:
  exit=0; signed=true
  designated_requirement: non-null; entitlements=null
  same separate-command limitation

The other signed-result limitation correctly states: Inspected a digest-verified Mach-O byte snapshot; filesystem-bound signing context and trust validation are not examined.

Typed outcome or recovery expected

Repeat the signed-fixture inspection and retain the same signing facts and successful command provenance, while removing or clarifying the inapplicable acquisition limitation. Preserve the actual snapshot/trust-validation caveat. The unsigned control should retain signed: false and its unsigned limitation; the signed control without entitlements should retain its non-null requirement and null entitlements. These are proposed restoration checks, not an implemented fix.

Analysis or suspected cause

Source-derived at the baseline: src/native/parsers/codesign.ts:48-52 adds the sentence for signed parser results. src/native/NativeMacOSProvider.ts:631-695 performs the supplementary captures, retains the parser limitations, fills the two signing fields, and records provenance. This explains why an internal acquisition note survives in the completed caller-visible limitations.

Additional context

Prepared with AI assistance and independently reproduced through the public CLI by a separate verifier. The submission check fetched upstream main and inspected the later change touching the cited files; that change concerns command-failure/cleanup handling and leaves this limitation and successful-capture path unchanged. No additional runtime reproduction was performed during submission.

Related #4293 and PRs #3583/#4359 concern universal-slice coverage; #3187 concerns debugger-attach guidance. They do not report this completed-capture wording defect. NOT_ENOUGH_INFO: no last-known-good version or first-bad revision was established.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5538 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior `node scripts/rea.mjs inspect-signature "$WORK/target" --json` successfully returned an ad hoc signed Mach-O's entitlements and designated requirement, with three successful codesign captures in provenance. Both the normalized result and top-level Evidence limitations nevertheless included: ```text Entitlements and designated requirements require separate bounded commands. ``` Those commands had already completed. The signing facts were present and correct in the independently reproduced fixture; the defect is misleading limitations wording. ### Reproduction From an already built baseline checkout on macOS arm64 with Xcode Command Line Tools, set `WORK` to a fresh absolute directory outside the checkout and `NODE` to a supported Node.js executable. The independent verifier executed the following fixture preparation and CLI inspection with Node.js v24.22.0: ```sh mkdir -p "$WORK/home" "$WORK/config" "$WORK/data" "$WORK/cache" "$WORK/state" "$WORK/runtime" printf 'int main(void) { return 0; }\n' > "$WORK/target.c" cat > "$WORK/entitlements.plist" <<'PLIST' <?xml version="1.0" encoding="UTF-8"?> <plist version="1.0"><dict><key>com.apple.security.get-task-allow</key><true/></dict></plist> PLIST xcrun clang "$WORK/target.c" -o "$WORK/target" codesign --force --sign - --identifier local.repro --entitlements "$WORK/entitlements.plist" "$WORK/target" env HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/runtime" "$NODE" scripts/rea.mjs inspect-signature "$WORK/target" --json > "$WORK/signed.json" 2> "$WORK/signed.stderr" ``` Inspect `normalized_result.entitlements`, `normalized_result.designated_requirement`, both limitations arrays, and the three provenance entries in `signed.json`. This signed fixture inspection exited 0 with empty stderr. The verifier also removed its signature and reran the CLI, then re-signed without entitlements and reran it; those controls are described below. Dependency installation and building were not part of this reproduction. ### Expected behavior Limitations should describe boundaries that still apply to the completed answer. When requirements and entitlements have already been captured, the result should not imply their acquisition remains outstanding. An explicit statement that separate commands completed would also communicate this accurately. At the baseline, `src/contracts/native/nativeToolContracts.ts:106-110` advertises requirements, entitlements, and exact command provenance; `docs/native-investigation.md:570-574` confirms entitlement reporting; `docs/tool-design.md:51-56` calls for relevant limitations and inline answers with provenance. These are source-derived expectations. Preserve the genuine snapshot and trust-validation caveat. ### Impact and scope P3 wording defect: the observed signed result includes the requested signing facts and successful provenance. No missing signing data, downstream behavior failure, or security-boundary failure was observed. Callers can read the returned fields and successful provenance directly. The limitation appeared in the entitlement-bearing signed fixture and the signed control without entitlements. The unsigned control instead reported `Artifact is not signed.`. Source inspection indicates the parser adds the disputed sentence for signed results generally; broader target coverage and MCP runtime behavior were not exercised. ### REA version 6.7.0, source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v24.22.0; macOS (Darwin), arm64; Xcode Command Line Tools used for compilation and signing. The Node version satisfies the package engines range, but the exact `.nvmrc` pin was not used. No deep analysis provider is required. NOT_ENOUGH_INFO: the verifier did not record the macOS version/build or Xcode Command Line Tools version. ### Target and artifact context Locally compiled Mach-O arm64 executable containing `int main(void) { return 0; }`, ad hoc signed with identifier `local.repro` and entitlement `com.apple.security.get-task-allow=true`. Controls used the same fixture unsigned and ad hoc signed without entitlements. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence The independent verifier's CLI observations, summarized without private paths: ```text Signed with entitlements: exit=0; stderr empty; signed=true entitlements={"com.apple.security.get-task-allow":true} designated_requirement: non-null display, requirements, entitlements provenance: exit code 0 for all three normalized and top-level limitations both contain: Entitlements and designated requirements require separate bounded commands. Unsigned control: exit=0; stderr empty; signed=false designated_requirement=null; entitlements=null limitation: Artifact is not signed. Re-signed without entitlements: exit=0; signed=true designated_requirement: non-null; entitlements=null same separate-command limitation ``` The other signed-result limitation correctly states: `Inspected a digest-verified Mach-O byte snapshot; filesystem-bound signing context and trust validation are not examined.` ### Typed outcome or recovery expected Repeat the signed-fixture inspection and retain the same signing facts and successful command provenance, while removing or clarifying the inapplicable acquisition limitation. Preserve the actual snapshot/trust-validation caveat. The unsigned control should retain `signed: false` and its unsigned limitation; the signed control without entitlements should retain its non-null requirement and null entitlements. These are proposed restoration checks, not an implemented fix. ### Analysis or suspected cause Source-derived at the baseline: `src/native/parsers/codesign.ts:48-52` adds the sentence for signed parser results. `src/native/NativeMacOSProvider.ts:631-695` performs the supplementary captures, retains the parser limitations, fills the two signing fields, and records provenance. This explains why an internal acquisition note survives in the completed caller-visible limitations. ### Additional context Prepared with AI assistance and independently reproduced through the public CLI by a separate verifier. The submission check fetched upstream main and inspected the later change touching the cited files; that change concerns command-failure/cleanup handling and leaves this limitation and successful-capture path unchanged. No additional runtime reproduction was performed during submission. Related #4293 and PRs #3583/#4359 concern universal-slice coverage; #3187 concerns debugger-attach guidance. They do not report this completed-capture wording defect. NOT_ENOUGH_INFO: no last-known-good version or first-bad revision was established.

bsakaguchi closed this issue

2026-10-31 00:39:39 +00:00

bsakaguchi commented

2026-10-31 00:39:40 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #4293 and sibling #5423 regarding signature inspection output, limitations, and capture metadata. Cataloged under Cluster AY in consolidation tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #4293 and sibling #5423 regarding signature inspection output, limitations, and capture metadata. Cataloged under Cluster AY in consolidation tracker #4330.

bsakaguchi referenced this issue

2026-10-31 01:09:01 +00:00

[PR #3420] docs(docker): add a container image and guide #5733

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471