Merge pull request 'fix(m9): Debug entitlements disable library validation for test host (#119)' (#121) from feat/119-debug-entitlements into milestone/m9-monterey

Reviewed-on: #120

.gitea/workflows/macos.yml

@@ -45,6 +45,19 @@ jobs:
             CODE_SIGNING_ALLOWED=YES \
             CODE_SIGN_IDENTITY='-'
 
+      # Xcode embeds the shared ICCeryCore package framework into the app
+      # and the test bundle without signing it. Ad-hoc hosts still require
+      # every loaded dylib to carry a cdhash — dyld killed the test host at
+      # launch (run 31992) — so sign every embedded copy once the build is
+      # done (embed steps run after any build script phase) (#119).
+      - name: Sign package product frameworks
+        run: |
+          find "$DERIVED/Build/Products/Debug" -depth -name '*_PackageProduct.framework' -print0 \
+            | while IFS= read -r -d '' fw; do
+                echo "signing $fw"
+                codesign --force --sign - --timestamp=none "$fw"
+              done
+
       - name: Test unit (ICCeryCoreTests)
         run: |
           XCTESTRUN="$(find "$DERIVED" -name 'ICCery*.xctestrun' | head -n 1)"

Resources/ICCery.Debug.entitlements

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- App Sandbox intentionally absent: ICCery must spawn Argyll tools,
+	     read/write user-chosen working directories, and talk to lp/CUPS. -->
+	<key>com.apple.security.device.usb</key>
+	<true/>
+	<!-- Debug only: the shared ICCeryCore package framework embedded in the
+	     test products is ad-hoc signed with no Team ID, so hardened-runtime
+	     library validation kills the test host at launch (run 31992, #119).
+	     Release uses ICCery.entitlements and links the package statically. -->
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+</dict>
+</plist>

Sources/ICCery/Print/PrintSessionViewModel.swift

@@ -110,7 +110,8 @@ final class PrintSessionViewModel: ObservableObject {
         isPrinting = true
         let task = Task { @MainActor [weak self] in
             guard let self else { return }
-            defer { self.printTask = nil }
+            // `defer` cannot mutate isolated state under Swift 5.7
+            // (Xcode 14.2 / macOS 12 runner), so clear explicitly (#113).
             var printed = 0
             for page in result.pages {
                 do {
@@ -123,6 +124,7 @@ final class PrintSessionViewModel: ObservableObject {
                             + error.localizedDescription
                     )
                     isPrinting = false
+                    self.printTask = nil
                     return
                 }
             }
@@ -132,6 +134,7 @@ final class PrintSessionViewModel: ObservableObject {
                 autoHideAfter: nil
             )
             isPrinting = false
+            self.printTask = nil
         }
         printTask = task
     }
@@ -141,7 +144,6 @@ final class PrintSessionViewModel: ObservableObject {
         isPrinting = true
         let task = Task { @MainActor [weak self] in
             guard let self else { return }
-            defer { self.printTask = nil }
             do {
                 try await spool(page, index: page.index, pageSize: pageSize)
                 printNotice = Notice(
@@ -156,6 +158,7 @@ final class PrintSessionViewModel: ObservableObject {
                 )
             }
             isPrinting = false
+            self.printTask = nil
         }
         printTask = task
     }

Sources/ICCery/Stage4View.swift

@@ -138,6 +138,9 @@ struct Stage4View: View {
                 .textFieldStyle(.roundedBorder)
                 .accessibilityIdentifier("colprofCopyright")
 
+            // Nested VStack keeps the parent at the Swift 5.7 ViewBuilder
+            // 10-child limit (Xcode 14.2 / macOS 12 CI runner, #111).
+            VStack(alignment: .leading, spacing: 12) {
                 Toggle("Apply calibration curve", isOn: $model.applyCalibration)
                     .accessibilityIdentifier("colprofApplyCalibration")
 
@@ -151,6 +154,7 @@ struct Stage4View: View {
                     }
                 }
             }
+        }
         .padding(16)
         .background(Theme.panel)
     }

Tests/ICCeryCoreTests/ProcessRunSupportTests.swift

@@ -21,7 +21,9 @@ final class ProcessRunSupportTests: XCTestCase {
             setRunning: { running.append($0) },
             resetLog: { resets += 1 },
             onLog: { batch in
-                MainActor.assertIsolated()
+                // MainActor.assertIsolated() needs Swift 5.9; the runner is
+                // on Xcode 14.2 (Swift 5.7) (#115).
+                XCTAssertTrue(Thread.isMainThread)
                 received.append(contentsOf: batch)
             }
         ) { onLog in

project.yml

@@ -19,6 +19,7 @@ targets:
       - path: Resources
         excludes:
           - ICCery.entitlements
+          - ICCery.Debug.entitlements
           - Argyll
       - path: Resources/Argyll
         type: folder
@@ -62,6 +63,15 @@ targets:
         OTHER_SWIFT_FLAGS: ["$(inherited)", "-strict-concurrency=minimal"]
         MACOSX_DEPLOYMENT_TARGET: "12.0"
         ARCHS: "$(ARCHS_STANDARD)"
+      # Debug builds sign ad-hoc; hardened-runtime library validation would
+      # reject the embedded ICCeryCore package framework (no Team ID) when
+      # the test host launches (run 31992, #119). DISABLE_LIBRARY_VALIDATION
+      # does not inject the entitlement on Xcode 14.2, so use a dedicated
+      # Debug entitlements file. Release keeps validation and links the
+      # package statically anyway.
+      configs:
+        Debug:
+          CODE_SIGN_ENTITLEMENTS: Resources/ICCery.Debug.entitlements
 
   ICCeryCoreTests:
     type: bundle.unit-test