morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3412] [CLOSED] fix(native): correct signature attach guidance #5726

New issue

Closed

opened 2026-10-31 01:08:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3412
Author: @rnb-tron
Created: 10/14/2026
Status: ❌ Closed

Base: main ← Head: fix/signature-attach-guidance-3187

📝 Commits (2)

138f627 fix(native): correct signature attach guidance
35820e7 fix(native): clarify unknown hardened-runtime status

📊 Changes

2 files changed (+9 additions, -5 deletions)

View changed files

📝 docs/native-investigation.md (+8 -4)
📝 src/native/LldbCallTracer.ts (+1 -1)

📄 Description

Summary

Fixes #3187. Correct guidance that directs users to a debugger-attach facet that inspect_signature does not return.

Problem and expected behavior

The native investigation guide and LLDB attach-denial remediation name a nonexistent inspect_signature result field. Users should instead be directed to the reported hardened_runtime and raw entitlements fields, without treating signing information as a decision about whether LLDB can attach.

Change and scope

Update the guide and the attach-denial remediation to name the actual fields and explain null values and the separate user-permission requirement. This changes guidance only; it adds no provider capability, target execution authority, or result field. A maintainer scope decision for a new capability is not applicable.

Contract and boundary impact

Semantic owner and earliest changed stage: Native investigation guidance and LLDB error presentation.
Contribution scope fit and linked maintainer decision: Existing capability guidance; no new capability.
CLI and MCP/tool-catalog contract: No change.
Provider, bridge, target-format, or platform compatibility: No behavior change.
Evidence, artifact, provenance, or reconstruction contract: No change.
Target selection, authority, upstream behavior, and cleanup details: No change.
Generated metadata, package, or installation impact: None.

Expected effects:

Documentation or usability only; no target interaction.

Evidence and regression coverage

Tests added or updated: None; the defect is incorrect guidance rather than result construction.
Base reproduction: The prior guide and remediation named a debugger-attach facet absent from inspectSignatureSchema.
User-visible CLI output: On macOS arm64, the compiled inspect-signature CLI inspected three local synthetic Mach-O samples. A hardened-runtime sample without an entitlement returned hardened_runtime: true and entitlements: null; one with com.apple.security.get-task-allow returned that entitlement as true; an unsigned sample returned hardened_runtime: null and entitlements: null. None returned a debugger-attach facet.
Remaining proof gaps: A real LLDB attach-denial workflow was not run. The checks used Node 24.19.0/npm 11.6.2 rather than the repository-pinned Node 24.18.0/npm 11.16.0.

Validation performed

npm run test:focused -- tests/boundary/providers/native/nativeCallObservation.test.ts tests/boundary/providers/native/nativeInventory.golden.test.ts — 28 tests passed.
npm run docs:check — passed.
npm run check — passed.
git diff --check — passed.
Push pre-check (check:fast) — passed.

Compatibility, safety, and release

Breaking changes or migration steps: None.
Real provider or platform coverage: Real macOS codesign inspection of local synthetic samples; no real LLDB attach.
Package or release metadata impact: None.
Security, privacy, process, or containment review: No change to target interaction or authority.

Author readiness

Human owner: @rnb-tron

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3412 **Author:** [@rnb-tron](https://github.com/rnb-tron) **Created:** 10/14/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/signature-attach-guidance-3187` --- ### 📝 Commits (2) - [`138f627`](https://github.com/morluto/rea/commit/138f62793c98a9402a89f7d39c0970bbd7b78c64) fix(native): correct signature attach guidance - [`35820e7`](https://github.com/morluto/rea/commit/35820e7c98a81886f684f80c21230f0e5eeedb21) fix(native): clarify unknown hardened-runtime status ### 📊 Changes **2 files changed** (+9 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `docs/native-investigation.md` (+8 -4) 📝 `src/native/LldbCallTracer.ts` (+1 -1) </details> ### 📄 Description ## Summary Fixes #3187. Correct guidance that directs users to a debugger-attach facet that `inspect_signature` does not return. ## Problem and expected behavior The native investigation guide and LLDB attach-denial remediation name a nonexistent `inspect_signature` result field. Users should instead be directed to the reported `hardened_runtime` and raw `entitlements` fields, without treating signing information as a decision about whether LLDB can attach. ## Change and scope Update the guide and the attach-denial remediation to name the actual fields and explain null values and the separate user-permission requirement. This changes guidance only; it adds no provider capability, target execution authority, or result field. A maintainer scope decision for a new capability is not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: Native investigation guidance and LLDB error presentation. - Contribution scope fit and linked maintainer decision: Existing capability guidance; no new capability. - CLI and MCP/tool-catalog contract: No change. - Provider, bridge, target-format, or platform compatibility: No behavior change. - Evidence, artifact, provenance, or reconstruction contract: No change. - Target selection, authority, upstream behavior, and cleanup details: No change. - Generated metadata, package, or installation impact: None. Expected effects: - [x] Documentation or usability only; no target interaction. ## Evidence and regression coverage - Tests added or updated: None; the defect is incorrect guidance rather than result construction. - Base reproduction: The prior guide and remediation named a debugger-attach facet absent from `inspectSignatureSchema`. - User-visible CLI output: On macOS arm64, the compiled `inspect-signature` CLI inspected three local synthetic Mach-O samples. A hardened-runtime sample without an entitlement returned `hardened_runtime: true` and `entitlements: null`; one with `com.apple.security.get-task-allow` returned that entitlement as `true`; an unsigned sample returned `hardened_runtime: null` and `entitlements: null`. None returned a debugger-attach facet. - Remaining proof gaps: A real LLDB attach-denial workflow was not run. The checks used Node 24.19.0/npm 11.6.2 rather than the repository-pinned Node 24.18.0/npm 11.16.0. ## Validation performed - `npm run test:focused -- tests/boundary/providers/native/nativeCallObservation.test.ts tests/boundary/providers/native/nativeInventory.golden.test.ts` — 28 tests passed. - `npm run docs:check` — passed. - `npm run check` — passed. - `git diff --check` — passed. - Push pre-check (`check:fast`) — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: None. - Real provider or platform coverage: Real macOS `codesign` inspection of local synthetic samples; no real LLDB attach. - Package or release metadata impact: None. - Security, privacy, process, or containment review: No change to target interaction or authority. ## Author readiness Human owner: @rnb-tron - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:58 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:44:53 +00:00

[PR #5726] [CLOSED] fix(il2cpp): report a magic without a complete version as a truncated header #7036

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5726

No description provided.

Rows
Columns