morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2546] fix(apple): IPA component lists include AppleDouble metadata files #862

New issue

Closed

opened 2026-10-15 18:29:06 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:29:06 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2546

Summary

Projecting an authenticated IPA inventory that includes AppleDouble metadata beside a library and inside a framework reports those metadata files as native-library and framework components. The result also says that AppleDouble entries are excluded from bundle roles. This gives consumers incorrect component lists even though the projection reports complete inventory coverage.

Steps to reproduce

Use the source checkout and runtime stated below with its installed lockfile dependencies. Add the following test case to the existing Apple application projection test suite, using that suite's inventoryEvidence and macho helpers to construct valid authenticated inventory Evidence. The verifier executed this fixture in a disposable test file and also checked the shared application service and a ZIP control.

it("excludes AppleDouble metadata from IPA component lists", () => {
  const entries = [
    { path: "Payload/Fixture.app/Info.plist" },
    macho("Payload/Fixture.app/Fixture"),
    { path: "Payload/Fixture.app/Contents/Resources/._libfoo.dylib" },
    { path: "Payload/Fixture.app/Frameworks/Foo.framework/._Foo" },
    macho("Payload/Fixture.app/Contents/Resources/libreal.dylib"),
  ];
  const result = projectAppleApplication({
    inventory_evidence: [inventoryEvidence("ipa", "Fixture.ipa", entries)],
  });
  expect(result.components.native_libraries.map(({ path }) => path)).toEqual([
    "Payload/Fixture.app/Contents/Resources/libreal.dylib",
  ]);
  expect(result.components.frameworks).toEqual([]);
});

Run the focused test file:

npm run test:focused -- src/domain/apple/appleApplication.test.ts

The library exclusion assertion fails. Change the fixture's root format from ipa to zip and its subject name to Fixture.zip for the control. With the same entries, the ZIP projection excludes both metadata files while preserving the real application executable and library. This is a projection-boundary reproduction using authored inventory Evidence; an actual IPA archive was not inventoried, and no CLI or MCP process was executed.

Expected behavior

AppleDouble metadata describes neighbouring files and remains an inventory fact, but the Apple application projection excludes it from roots, bundle roles, and anatomy components. For this IPA input, native_libraries should contain only Payload/Fixture.app/Contents/Resources/libreal.dylib, and frameworks should be empty. The real executable and library should remain available in their applicable component lists. Ordinary IPA entries outside application roots have a separate preservation contract and are not the metadata entries in this reproduction.

Actual behavior

The accepted IPA projection returns both Payload/Fixture.app/Contents/Resources/._libfoo.dylib and Payload/Fixture.app/Contents/Resources/libreal.dylib under native_libraries. It returns Payload/Fixture.app/Frameworks/Foo.framework/._Foo under frameworks. Both metadata occurrences have format file. The result reports complete-within-inventory coverage and emits the limitation that AppleDouble sidecars are excluded from bundle roles. The bundles list contains only the application root; the metadata does not create a framework bundle.

The shared application service accepts the same input and wraps exactly the same projection in normalized_result. The ZIP control returns only the real library and no framework components. Both formats retain the real library and application executable in executables. The verifier's focused run finished with two passing diagnostic/control cases and one failing exclusion case, with exit status 1.

Evidence

Expected source: docs/apple-application-analysis.md:134-136 explicitly excludes AppleDouble metadata from roots, bundle roles, and anatomy components; src/domain/apple/appleApplication.ts:428-432 emits the same exclusion limitation for the tested input.
Failure source: Executed projection and shared application service results for the inline fixture. In src/domain/apple/appleApplication.ts:230-231, IPA components reach classification before the sidecar exclusion used for other root formats; the framework and library selectors at lines 272-273 then accept the metadata paths.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The existing authenticated fixture helpers are in src/domain/apple/appleApplication.test.ts:22-146. Schema validation, inventory authentication, root-format admission, artifact-node lookup, and result validation all completed in the verifier run. The supported shared entry is src/application/apple/AppleApplicationService.ts:14-29. CLI registration calls that service, and the MCP contract accepts the same projection input schema. Those adapter paths were inspected from source rather than executed.

IPA native_libraries:
  Payload/Fixture.app/Contents/Resources/._libfoo.dylib
  Payload/Fixture.app/Contents/Resources/libreal.dylib
IPA frameworks:
  Payload/Fixture.app/Frameworks/Foo.framework/._Foo
IPA coverage:
  {"status":"complete-within-inventory","inventory_complete":true}
ZIP native_libraries:
  Payload/Fixture.app/Contents/Resources/libreal.dylib
ZIP frameworks:
  []

Read-only searches of open and closed issues found no matching sidecar report. The nearby closed reports case policy for bundle anatomy and duplicate-content path classification address different failures. Their bodies, closure comments, and fixing-change references were inspected; this reproduction still fails on the tested baseline.

Restoration check

Repeat the IPA fixture and require native_libraries to contain only the real library and frameworks to be empty. Keep the application root, real executable, real library, and source inventory Evidence intact. Repeat the ZIP control with the same entries and retain its passing component lists. Continue reporting the presence of sidecar inventory facts without assigning the demonstrated metadata paths to framework or native-library components. Preserve the existing contract for ordinary IPA components outside application roots.

Runtime or environment

Failure was verified at a2d8b94dd5 and is still present at 8b181716ac by source recheck, package version 6.4.0.
Node.js v26.10.0, npm 11.19.1, Vitest v5.0.3, macOS. Dependencies were already installed from the repository lockfile.
The focused domain test completed in 722 ms, including 24 ms of test execution. No provider or target execution was required.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: This accepted IPA input produces incorrect native-library and framework component lists while reporting complete inventory coverage. The observed failure is bounded to metadata paths that match those classifications; no artifact modification or downstream runtime failure was demonstrated.
Workaround status: available
Workaround basis: Consumers displaying or counting these arrays can filter entries whose last path segment starts with ._ or whose path contains a __MACOSX segment. The output retains exact paths, and this fixture distinguishes both metadata entries from the retained real executable and library. This is a consumer workaround for component lists, not a correction to the stored projection.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2546 ## Summary Projecting an authenticated IPA inventory that includes AppleDouble metadata beside a library and inside a framework reports those metadata files as native-library and framework components. The result also says that AppleDouble entries are excluded from bundle roles. This gives consumers incorrect component lists even though the projection reports complete inventory coverage. ## Steps to reproduce Use the source checkout and runtime stated below with its installed lockfile dependencies. Add the following test case to the existing Apple application projection test suite, using that suite's inventoryEvidence and macho helpers to construct valid authenticated inventory Evidence. The verifier executed this fixture in a disposable test file and also checked the shared application service and a ZIP control. ```ts it("excludes AppleDouble metadata from IPA component lists", () => { const entries = [ { path: "Payload/Fixture.app/Info.plist" }, macho("Payload/Fixture.app/Fixture"), { path: "Payload/Fixture.app/Contents/Resources/._libfoo.dylib" }, { path: "Payload/Fixture.app/Frameworks/Foo.framework/._Foo" }, macho("Payload/Fixture.app/Contents/Resources/libreal.dylib"), ]; const result = projectAppleApplication({ inventory_evidence: [inventoryEvidence("ipa", "Fixture.ipa", entries)], }); expect(result.components.native_libraries.map(({ path }) => path)).toEqual([ "Payload/Fixture.app/Contents/Resources/libreal.dylib", ]); expect(result.components.frameworks).toEqual([]); }); ``` Run the focused test file: ```sh npm run test:focused -- src/domain/apple/appleApplication.test.ts ``` The library exclusion assertion fails. Change the fixture's root format from ipa to zip and its subject name to Fixture.zip for the control. With the same entries, the ZIP projection excludes both metadata files while preserving the real application executable and library. This is a projection-boundary reproduction using authored inventory Evidence; an actual IPA archive was not inventoried, and no CLI or MCP process was executed. ## Expected behavior AppleDouble metadata describes neighbouring files and remains an inventory fact, but the Apple application projection excludes it from roots, bundle roles, and anatomy components. For this IPA input, native_libraries should contain only Payload/Fixture.app/Contents/Resources/libreal.dylib, and frameworks should be empty. The real executable and library should remain available in their applicable component lists. Ordinary IPA entries outside application roots have a separate preservation contract and are not the metadata entries in this reproduction. ## Actual behavior The accepted IPA projection returns both Payload/Fixture.app/Contents/Resources/._libfoo.dylib and Payload/Fixture.app/Contents/Resources/libreal.dylib under native_libraries. It returns Payload/Fixture.app/Frameworks/Foo.framework/._Foo under frameworks. Both metadata occurrences have format file. The result reports complete-within-inventory coverage and emits the limitation that AppleDouble sidecars are excluded from bundle roles. The bundles list contains only the application root; the metadata does not create a framework bundle. The shared application service accepts the same input and wraps exactly the same projection in normalized_result. The ZIP control returns only the real library and no framework components. Both formats retain the real library and application executable in executables. The verifier's focused run finished with two passing diagnostic/control cases and one failing exclusion case, with exit status 1. ## Evidence - Expected source: docs/apple-application-analysis.md:134-136 explicitly excludes AppleDouble metadata from roots, bundle roles, and anatomy components; src/domain/apple/appleApplication.ts:428-432 emits the same exclusion limitation for the tested input. - Failure source: Executed projection and shared application service results for the inline fixture. In src/domain/apple/appleApplication.ts:230-231, IPA components reach classification before the sidecar exclusion used for other root formats; the framework and library selectors at lines 272-273 then accept the metadata paths. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The existing authenticated fixture helpers are in src/domain/apple/appleApplication.test.ts:22-146. Schema validation, inventory authentication, root-format admission, artifact-node lookup, and result validation all completed in the verifier run. The supported shared entry is src/application/apple/AppleApplicationService.ts:14-29. CLI registration calls that service, and the MCP contract accepts the same projection input schema. Those adapter paths were inspected from source rather than executed. ```text IPA native_libraries: Payload/Fixture.app/Contents/Resources/._libfoo.dylib Payload/Fixture.app/Contents/Resources/libreal.dylib IPA frameworks: Payload/Fixture.app/Frameworks/Foo.framework/._Foo IPA coverage: {"status":"complete-within-inventory","inventory_complete":true} ZIP native_libraries: Payload/Fixture.app/Contents/Resources/libreal.dylib ZIP frameworks: [] ``` Read-only searches of open and closed issues found no matching sidecar report. The nearby closed reports [case policy for bundle anatomy](https://github.com/morluto/rea/issues/1486) and [duplicate-content path classification](https://github.com/morluto/rea/issues/1234) address different failures. Their bodies, closure comments, and fixing-change references were inspected; this reproduction still fails on the tested baseline. ## Restoration check Repeat the IPA fixture and require native_libraries to contain only the real library and frameworks to be empty. Keep the application root, real executable, real library, and source inventory Evidence intact. Repeat the ZIP control with the same entries and retain its passing component lists. Continue reporting the presence of sidecar inventory facts without assigning the demonstrated metadata paths to framework or native-library components. Preserve the existing contract for ordinary IPA components outside application roots. ## Runtime or environment - Failure was verified at a2d8b94dd50dab8d966239dd63ab84718aa8b4b4 and is still present at 8b181716aca2cb467be499cba226abfb5ae19141 by source recheck, package version 6.4.0. - Node.js v26.10.0, npm 11.19.1, Vitest v5.0.3, macOS. Dependencies were already installed from the repository lockfile. - The focused domain test completed in 722 ms, including 24 ms of test execution. No provider or target execution was required. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: This accepted IPA input produces incorrect native-library and framework component lists while reporting complete inventory coverage. The observed failure is bounded to metadata paths that match those classifications; no artifact modification or downstream runtime failure was demonstrated. - Workaround status: available - Workaround basis: Consumers displaying or counting these arrays can filter entries whose last path segment starts with ._ or whose path contains a __MACOSX segment. The output retains exact paths, and this fixture distinguishes both metadata entries from the retained real executable and library. This is a consumer workaround for component lists, not a correction to the stored projection.

bsakaguchi

2026-10-15 18:29:06 +00:00

closed this issue
added the
bug
label

bsakaguchi referenced this issue

2026-10-16 21:16:55 +00:00

[PR #862] [MERGED] build: verify resolved module boundaries #2298

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#862

No description provided.

Rows
Columns