From 08f64f7087be0971ede9cde1e99b87090d5dac2b Mon Sep 17 00:00:00 2001 From: zhayujie Date: Tue, 29 Sep 2026 23:22:18 +0800 Subject: [PATCH] ci(desktop): fail the overlay mac build when an extension links OpenSSL dynamically Co-authored-by: cowagent --- .github/workflows/release-overlay.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/release-overlay.yml b/.github/workflows/release-overlay.yml index 9c2ba575..ce1a1305 100644 --- a/.github/workflows/release-overlay.yml +++ b/.github/workflows/release-overlay.yml @@ -155,6 +155,26 @@ jobs: --distpath desktop/build/dist \ --workpath desktop/build/build-work + # Same guard as release.yml: the bundle carries only Python's own + # libssl.3.dylib, so an extension linked against another OpenSSL fails to + # load on users' machines. + - name: Verify no extension links a foreign OpenSSL + if: matrix.platform == 'mac' + shell: bash + run: | + internal=desktop/build/dist/cowagent-backend/_internal + bad="" + while IFS= read -r -d '' so; do + case "$so" in */python3.*/lib-dynload/*) continue ;; esac + if otool -L "$so" | tail -n +2 | grep -Eq 'lib(ssl|crypto)\.[0-9.]+dylib'; then + bad="$bad ${so#$internal/}" + fi + done < <(find "$internal" -name '*.so' -print0) + if [ -n "$bad" ]; then + echo "::error::extensions dynamically linked to OpenSSL:$bad" + exit 1 + fi + - name: Install desktop deps working-directory: desktop run: npm ci