Prevent metadata leaks in cask ZIPs

[VladimirBrejcha]

Why

Default macOS archive behavior can serialize resource and extended-attribute metadata as AppleDouble entries. Filtered archive listings can then hide the unsafe payload.

Changed

• package app-only ZIP candidates with explicit metadata-suppression flags
• validate the hidden candidate through a bounded Python standard-library contract before checksum or publication
• clear stale outputs and publish mode-0644 ZIP/checksum candidates fail-closed
• add portable and real/fake macOS regressions plus manifest/spec coverage

Verification

• focused cask packaging tests: 7/7
• documentation tests: 51/51
• full repository suite, including app tests: green
• implementation and spec-only harness profiles: green
• public-source and independent exact-diff reviews: clean
• agent closeout: passed

Residual risk

The standard-library central inventory does not prove absence of orphan local records. This remains bounded by the trusted system archive producer and is documented without adding a second ZIP parser.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T17:08:10.878940Z	6b74cf6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[fiveonecode-autopilot]

Autopilot needs your choice — AD-20260901-001

Review finding (External review):
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

• Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
• Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
.agents/manifests/implementation-foundation.yaml@ee67acf9d5d78c2010b7cf59f41f733af2e21de0..82dc7e8ab9f107c161d337d62aafb92824136a71;.agents/manifests/specs.yaml@6074926b0e0966b83bb6bd1e7d41a753eb1f0af9..b9b4df6581f9ed72e519e605d42899ee8be06b2b

Guarded hits:

• .agents/manifests/implementation-foundation.yaml (base blob ee67acf9d5d78c2010b7cf59f41f733af2e21de0, head blob 82dc7e8ab9f107c161d337d62aafb92824136a71)
• .agents/manifests/specs.yaml (base blob 6074926b0e0966b83bb6bd1e7d41a753eb1f0af9, head blob b9b4df6581f9ed72e519e605d42899ee8be06b2b)
  Prevent metadata leaks in cask ZIPs #39

Autopilot's assessment:
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

• Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
• Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
.agents/manifests/implementation-foundation.yaml@ee67acf9d5d78c2010b7cf59f41f733af2e21de0..82dc7e8ab9f107c161d337d62aafb92824136a71;.agents/manifests/specs.yaml@6074926b0e0966b83bb6bd1e7d41a753eb1f0af9..b9b4df6581f9ed72e519e605d42899ee8be06b2b

Guarded hits:

• .agents/manifests/implementation-foundation.yaml (base blob ee67acf9d5d78c2010b7cf59f41f733af2e21de0, head blob 82dc7e8ab9f107c161d337d62aafb92824136a71)
• .agents/manifests/specs.yaml (base blob 6074926b0e0966b83bb6bd1e7d41a753eb1f0af9, head blob b9b4df6581f9ed72e519e605d42899ee8be06b2b)

Autopilot recommends:
Authorize this verifier implementation change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.

Choose what Autopilot should do next:

1. authorize-contract-change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.
2. keep-blocked-until-head-reverts — Autopilot will leave the PR blocked until HEAD reverts the guarded implementation. It will not push, will not run HEAD bootstrap, and will not run HEAD verifier.

Reply with exactly one:
Autopilot decision AD-20260901-001: choose authorize-contract-change
Autopilot decision AD-20260901-001: choose keep-blocked-until-head-reverts

Local artifact: job 20260901-010608-6e11e1f3-d022-4ee0-ac91-b5bed57b1437/report.md

[fiveonecode-autopilot]

Autopilot recorded decision AD-20260901-001: selected authorize-contract-change.

Operator: @VladimirBrejcha

[fiveonecode-autopilot]

Reviewed top-level PR feedback and left the current code unchanged.

These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.

• Source: Prevent metadata leaks in cask ZIPs #39 (comment)
  This Codex review-summary comment records a completed review of 6b74cf6 with no findings or requested changes. There is nothing to implement on this thread.