From bbdb5bc9b769572dc8d53ed7b858113852da4501 Mon Sep 17 00:00:00 2001 From: Vladimir Date: Tue, 1 Sep 2026 02:34:11 +0800 Subject: [PATCH] Prepare v0.1.0-alpha.5 release candidate Why: - Preserve the immutable Alpha4 failure record while preparing a corrected prerelease after the release-path defenses landed. - Keep installation surfaces aligned with one frozen, notarized four-asset candidate. Changed: - Bump public package, documentation, support, and release-contract surfaces to v0.1.0-alpha.5. - Record the Alpha4 non-release and the bounded RR19-RR23 recovery changes. - Pin the Homebrew Formula and Cask to the frozen CLI and notarized app bytes. Verification: - `npm test` (public surface 262, broker core 294, client 257, harness adoption 24, app 171). - `npm run agent:verify -- --profile spec-only` passed with no warnings. - Public-source scans, raw CLI/Cask validators, checksum and pin parity, Developer ID trust, notarization, stapling, Gatekeeper, and two independent frozen-byte audits passed. Affected: - Public install and support guidance, package metadata, Homebrew Formula/Cask, changelog, and release contract. Refs: - #35, #36, #37, #38, #39; v0.1.0-alpha.4 Session: - task-sessions/alpha5-release-v4-20260901 --- .github/ISSUE_TEMPLATE/install-failure.yml | 4 +-- CHANGELOG.md | 29 ++++++++++++++++++++++ Casks/simulator-broker.rb | 4 +-- Formula/simbroker.rb | 4 +-- README.md | 6 ++--- SECURITY.md | 10 ++++---- docs/getting-started.md | 6 ++--- package-lock.json | 4 +-- package.json | 2 +- packages/simbroker/README.md | 2 +- packages/simbroker/package.json | 2 +- spec/README.md | 2 +- spec/build-and-test.md | 7 +++--- 13 files changed, 56 insertions(+), 26 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/install-failure.yml b/.github/ISSUE_TEMPLATE/install-failure.yml index 8b87205..8e55fdc 100644 --- a/.github/ISSUE_TEMPLATE/install-failure.yml +++ b/.github/ISSUE_TEMPLATE/install-failure.yml @@ -9,7 +9,7 @@ body: Simulator Broker is **Alpha**, **macOS-only**, and needs **Xcode** to create or run iOS Simulators. Install the CLI with `brew install fiveonecode/simulator-broker/simbroker` or - `npm install -g` of the `simbroker-0.1.0-alpha.4.tgz` from GitHub + `npm install -g` of the `simbroker-0.1.0-alpha.5.tgz` from GitHub Releases. Install the operator app with `brew install --cask fiveonecode/simulator-broker/simulator-broker`. @@ -23,7 +23,7 @@ body: label: What install path did you use? options: - Homebrew (`brew install fiveonecode/simulator-broker/simbroker`) - - npm (`npm install -g` of `simbroker-0.1.0-alpha.4.tgz` from GitHub Releases) + - npm (`npm install -g` of `simbroker-0.1.0-alpha.5.tgz` from GitHub Releases) - Homebrew cask (`brew install --cask fiveonecode/simulator-broker/simulator-broker`) - CLI-only (`bash scripts/install_local.sh --cli-only`) - Contributor app + CLI (`npm run install:local`) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8156901..9f79920 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,8 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.1.0-alpha.5] - 2026-09-01 + +Alpha 5 is the provenance-safe recovery release for the immutable failed +Alpha 4 tag. It keeps the same four-custom-asset contract and rebuilds every +asset from the corrected source tree. + +### Fixed + +- RR19 distinguishes a documented hosted-runner path from a private + runtime-home leak while retaining positive and negative public-source + regression coverage. +- RR20 packages the CLI README as literal data, so Markdown command examples + cannot execute or capture checkout-root output during archive creation. +- RR21 generates the app dSYM before stripping deployment debug records, then + rejects build paths, STABS, embedded DWARF, unexpected architectures, and + leaks in the complete Mach-O container or either required slice. +- RR22 makes CLI packaging emit portable raw USTAR with normalized ownership, + safe paths and modes, no AppleDouble or PAX metadata, and stale-output + cleanup, with the same contract exercised on macOS and Ubuntu. +- RR23 gives cask ZIP packaging explicit metadata-suppression flags and a + validated hidden candidate, rejecting AppleDouble, unsafe or extra roots, + unsupported entry types, and stale public outputs before final publication. + ## [0.1.0-alpha.4] - 2026-08-31 +The `v0.1.0-alpha.4` tag is preserved as immutable failed-release evidence. +Its workflow stopped before creating a GitHub Release or uploading any custom +asset because the public-source check treated a documented hosted-runner path +as a private home-path leak. The tag must not be republished; Alpha 5 +supersedes it. + This release hardens the public install, upgrade, and dashboard paths used for the first broader Simulator Broker announcement. It also makes the complete GitHub Release inventory explicit: CLI archive, CLI checksum, npm tarball, and diff --git a/Casks/simulator-broker.rb b/Casks/simulator-broker.rb index 70a4709..742a8f0 100644 --- a/Casks/simulator-broker.rb +++ b/Casks/simulator-broker.rb @@ -1,6 +1,6 @@ cask "simulator-broker" do - version "0.1.0-alpha.4" - sha256 "d44c4ba8318338c5e009ed2e71aa6fea03e6167698a4a60df7ce5b865f5e3963" + version "0.1.0-alpha.5" + sha256 "4fcad6743f4a4d6e8cf3fe427d43814c2e4348e9709bbe264a7d275bb252c30a" url "https://github.com/fiveonecode/simulator-broker/releases/download/v#{version}/Simulator-Broker-#{version}.zip" name "Simulator Broker" diff --git a/Formula/simbroker.rb b/Formula/simbroker.rb index d721813..8dc08e5 100644 --- a/Formula/simbroker.rb +++ b/Formula/simbroker.rb @@ -1,8 +1,8 @@ class Simbroker < Formula desc "Local iOS Simulator control plane CLI" homepage "https://github.com/fiveonecode/simulator-broker" - url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.4/simulator-broker-0.1.0-alpha.4-cli.tar.gz" - sha256 "1e04e4e9f7c0b372722b80e057b63dda87e12d7d5cbf7043d084826f0ea57503" + url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.5/simulator-broker-0.1.0-alpha.5-cli.tar.gz" + sha256 "429c6477ff3a85f90a660693bda5527963a89942a8e8052eee31086a5ecc3ddd" license "MIT" depends_on macos: :sonoma diff --git a/README.md b/README.md index 1288c0a..dfdd1ef 100644 --- a/README.md +++ b/README.md @@ -79,7 +79,7 @@ simbroker idle enable --grace-seconds <60-86400> --actor-type human --actor-id < Other CLI install options: ```bash -npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.4/simbroker-0.1.0-alpha.4.tgz +npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.5/simbroker-0.1.0-alpha.5.tgz simbroker --help ``` @@ -102,8 +102,8 @@ are also attached to those releases. The archive contains a versioned top-level directory: ```bash -tar -xzf simulator-broker-0.1.0-alpha.4-cli.tar.gz -./simulator-broker-0.1.0-alpha.4-cli/bin/simbroker --help +tar -xzf simulator-broker-0.1.0-alpha.5-cli.tar.gz +./simulator-broker-0.1.0-alpha.5-cli/bin/simbroker --help ``` `simbroker` help and `simbroker doctor` print human-readable text by default. diff --git a/SECURITY.md b/SECURITY.md index 19c43f6..14fd9e9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -3,13 +3,13 @@ ## Supported Versions Security fixes are considered for the current `main` branch and for the latest -tagged Alpha (`0.1.0-alpha.4`). Older Alpha tags are not supported. The +tagged Alpha (`0.1.0-alpha.5`). Older Alpha tags are not supported. The published Alpha has exactly four custom GitHub Release assets: -1. `simulator-broker-0.1.0-alpha.4-cli.tar.gz` -2. `simulator-broker-0.1.0-alpha.4-cli.tar.gz.sha256` -3. `simbroker-0.1.0-alpha.4.tgz` -4. `Simulator-Broker-0.1.0-alpha.4.zip` +1. `simulator-broker-0.1.0-alpha.5-cli.tar.gz` +2. `simulator-broker-0.1.0-alpha.5-cli.tar.gz.sha256` +3. `simbroker-0.1.0-alpha.5.tgz` +4. `Simulator-Broker-0.1.0-alpha.5.zip` The Homebrew formula and cask install the matching CLI and signed, notarized app archives. GitHub's generated source archives appear separately. diff --git a/docs/getting-started.md b/docs/getting-started.md index 7c44ecf..f7b8489 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -51,7 +51,7 @@ does not require XcodeGen. The app still needs the CLI installed separately. ## Install the CLI with npm ```bash -npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.4/simbroker-0.1.0-alpha.4.tgz +npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.5/simbroker-0.1.0-alpha.5.tgz command -v simbroker simbroker --help ``` @@ -76,8 +76,8 @@ To install from a tagged Alpha without cloning, download then run: ```bash -tar -xzf simulator-broker-0.1.0-alpha.4-cli.tar.gz -./simulator-broker-0.1.0-alpha.4-cli/bin/simbroker --help +tar -xzf simulator-broker-0.1.0-alpha.5-cli.tar.gz +./simulator-broker-0.1.0-alpha.5-cli/bin/simbroker --help ``` The archive is the Node CLI only and contains that versioned top-level diff --git a/package-lock.json b/package-lock.json index f96907a..afcdec3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "simulator-broker-app", - "version": "0.1.0-alpha.4", + "version": "0.1.0-alpha.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "simulator-broker-app", - "version": "0.1.0-alpha.4", + "version": "0.1.0-alpha.5", "license": "MIT", "engines": { "node": ">=20" diff --git a/package.json b/package.json index 277044c..8725fd4 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,7 @@ "test:package-smoke": "bash ./scripts/package_smoke.sh", "verify:public-surface": "node client/public-surface.mjs" }, - "version": "0.1.0-alpha.4", + "version": "0.1.0-alpha.5", "description": "Local simulator broker and macOS operator app for coordinated iOS Simulator workflows", "license": "MIT", "repository": { diff --git a/packages/simbroker/README.md b/packages/simbroker/README.md index cf80699..42cb317 100644 --- a/packages/simbroker/README.md +++ b/packages/simbroker/README.md @@ -4,7 +4,7 @@ Alpha CLI for Simulator Broker. Node.js 20 or newer is required. Creating and running iOS Simulators still requires macOS and Xcode. ```bash -npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.4/simbroker-0.1.0-alpha.4.tgz +npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.5/simbroker-0.1.0-alpha.5.tgz simbroker --help ``` diff --git a/packages/simbroker/package.json b/packages/simbroker/package.json index 3424330..37fe17a 100644 --- a/packages/simbroker/package.json +++ b/packages/simbroker/package.json @@ -1,6 +1,6 @@ { "name": "simbroker", - "version": "0.1.0-alpha.4", + "version": "0.1.0-alpha.5", "private": false, "description": "CLI for the local iOS Simulator control plane", "license": "MIT", diff --git a/spec/README.md b/spec/README.md index 1144605..a77d76a 100644 --- a/spec/README.md +++ b/spec/README.md @@ -56,7 +56,7 @@ This repo exists to develop a reusable local simulator broker: - local install, local-debug portable packaging, Release distribution packaging, and onboarding flows now exist through `install_local.sh`, `install_local.sh --cli-only`, `package_local.sh`, `package_distribution.sh`, `test:install-smoke`, `test:package-smoke`, `host init --bootstrap-config`, and `project init` - the published onboarding docs now distinguish CLI-only install, repo-local contributor app+CLI install, local-debug portable bundling, and signed distribution packaging; a new login shell should resolve `simbroker` after install without sourcing `env.sh` - `CONTRIBUTING.md` publishes a public-patch track (Node.js 20 and the Node test suites, no harness session) and a labeled maintainer/agent harness track; `agent:complete` enforcement is unchanged -- tagged Alpha `0.1.0-alpha.4` publishes exactly four custom GitHub Release assets: a CLI tarball from `scripts/package_cli.sh`, its SHA-256 checksum, the packable npm CLI, and a notarized operator app zip. The tag workflow runs the public docs, public-surface, broker-core, client, and harness-adoption checks on GitHub-hosted Ubuntu before attaching the first three assets; the operator attaches the app zip after Developer ID signing and notarization. GitHub's generated source archives are not custom assets. Public pull-request CI remains split between Ubuntu and macOS, while the macOS app suite and home-path public-surface scan stay local. +- tagged Alpha `0.1.0-alpha.5` publishes exactly four custom GitHub Release assets: a CLI tarball from `scripts/package_cli.sh`, its SHA-256 checksum, the packable npm CLI, and a notarized operator app zip. The tag workflow runs the public docs, public-surface, broker-core, client, and harness-adoption checks on GitHub-hosted Ubuntu before attaching the first three assets; the operator attaches the app zip after Developer ID signing and notarization. GitHub's generated source archives are not custom assets. Public pull-request CI remains split between Ubuntu and macOS, while the macOS app suite and home-path public-surface scan stay local. - public pull-request CI and the tagged-release workflow run `npm run test:docs` so archive paths, install guidance, and workflow gates cannot drift without a failing check diff --git a/spec/build-and-test.md b/spec/build-and-test.md index f20c035..6e5d544 100644 --- a/spec/build-and-test.md +++ b/spec/build-and-test.md @@ -159,7 +159,7 @@ A first extracted implementation slice now exists: fixtures inject `processController.currentPid` so hardcoded fixture PIDs cannot match the GitHub Actions test-runner pid. Containment still skips the live `process.pid` when `currentPid` is omitted. -- tagged versions such as `v0.1.0-alpha.4` attach exactly four custom assets +- tagged versions such as `v0.1.0-alpha.5` attach exactly four custom assets to a GitHub Release: the CLI tarball, its `.sha256` checksum, the packable `simbroker-.tgz`, and the notarized `Simulator-Broker-.zip`. GitHub-generated source archives are not @@ -253,8 +253,9 @@ not reinstall a live machine. 1. Bump `package.json` / lock / `packages/simbroker`, `CHANGELOG.md`, newcomer docs, `Formula/simbroker.rb` URL, and - `Casks/simulator-broker.rb` version. Leave the cask `sha256` on the - previous zip until the new zip exists. + `Casks/simulator-broker.rb` version. Replace both Homebrew checksums with + an explicit 64-zero prebuild placeholder so stale prior-release bytes + cannot appear pinned to the new version. 2. Run `npm run agent:verify -- --profile spec-only` for the changed paths. 3. Run `npm run package:cli` and `npm run package:npm`. Pin