Files
rea/scripts
Kaoru0822andClaude Opus 5.5 37824e8c46 fix(native): verify nested code and keep ticket read failures local
Address review findings in inspect_signature:
- Verify with `codesign --verify --deep --strict`. Shallow verification
  misses a file added inside a nested XPC service, or a modified dylib
  inside a framework. verify:code-signature now tampers inside the
  nested XPC service and requires `invalid`.
- Classify verification as `unsigned` only when the top-level target is
  unsigned. Unsigned nested code inside a signed bundle is `invalid`.
- Report a stapled ticket that exists but cannot be read as
  `unreadable`, with the error code in a new `reason` field, instead of
  failing the whole signature inspection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-07 11:54:32 +00:00
..