Merge pull request 'fix(m9): Debug entitlements disable library validation for test host (#119)' (#121) from feat/119-debug-entitlements into milestone/m9-monterey

Reviewed-on: #120

.gitea/workflows/macos.yml

@@ -24,10 +24,11 @@ jobs:
       - name: Assert Xcode 14 toolchain
         run: xcodebuild -version | grep -E "Xcode 14." || (echo "Unexpected Xcode version" && exit 1)
 
+      # Homebrew's xcodegen formula requires Xcode 15.3, which cannot be
+      # installed on macOS 12 (#109). The script installs a pinned
+      # prebuilt release instead.
       - name: Ensure host tools
-        run: |
-          command -v xcodegen || brew install xcodegen
-          python3 -c "import dmgbuild" 2>/dev/null || pip3 install dmgbuild
+        run: scripts/ensure-host-tools.sh
 
       - name: Generate Xcode project
         run: xcodegen generate --spec project.yml
@@ -44,6 +45,19 @@ jobs:
             CODE_SIGNING_ALLOWED=YES \
             CODE_SIGN_IDENTITY='-'
 
+      # Xcode embeds the shared ICCeryCore package framework into the app
+      # and the test bundle without signing it. Ad-hoc hosts still require
+      # every loaded dylib to carry a cdhash — dyld killed the test host at
+      # launch (run 31992) — so sign every embedded copy once the build is
+      # done (embed steps run after any build script phase) (#119).
+      - name: Sign package product frameworks
+        run: |
+          find "$DERIVED/Build/Products/Debug" -depth -name '*_PackageProduct.framework' -print0 \
+            | while IFS= read -r -d '' fw; do
+                echo "signing $fw"
+                codesign --force --sign - --timestamp=none "$fw"
+              done
+
       - name: Test unit (ICCeryCoreTests)
         run: |
           XCTESTRUN="$(find "$DERIVED" -name 'ICCery*.xctestrun' | head -n 1)"
@@ -134,6 +148,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # scripts/package-release.sh runs `xcodegen generate` and dmgbuild;
+      # see build-and-test for why brew is not used on macOS 12 (#109).
+      - name: Ensure host tools
+        run: scripts/ensure-host-tools.sh
+
       - name: Package release
         run: scripts/package-release.sh
         env:

Resources/ICCery.Debug.entitlements

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- App Sandbox intentionally absent: ICCery must spawn Argyll tools,
+	     read/write user-chosen working directories, and talk to lp/CUPS. -->
+	<key>com.apple.security.device.usb</key>
+	<true/>
+	<!-- Debug only: the shared ICCeryCore package framework embedded in the
+	     test products is ad-hoc signed with no Team ID, so hardened-runtime
+	     library validation kills the test host at launch (run 31992, #119).
+	     Release uses ICCery.entitlements and links the package statically. -->
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+</dict>
+</plist>

Sources/ICCery/Print/PrintSessionViewModel.swift

@@ -110,7 +110,8 @@ final class PrintSessionViewModel: ObservableObject {
         isPrinting = true
         let task = Task { @MainActor [weak self] in
             guard let self else { return }
-            defer { self.printTask = nil }
+            // `defer` cannot mutate isolated state under Swift 5.7
+            // (Xcode 14.2 / macOS 12 runner), so clear explicitly (#113).
             var printed = 0
             for page in result.pages {
                 do {
@@ -123,6 +124,7 @@ final class PrintSessionViewModel: ObservableObject {
                             + error.localizedDescription
                     )
                     isPrinting = false
+                    self.printTask = nil
                     return
                 }
             }
@@ -132,6 +134,7 @@ final class PrintSessionViewModel: ObservableObject {
                 autoHideAfter: nil
             )
             isPrinting = false
+            self.printTask = nil
         }
         printTask = task
     }
@@ -141,7 +144,6 @@ final class PrintSessionViewModel: ObservableObject {
         isPrinting = true
         let task = Task { @MainActor [weak self] in
             guard let self else { return }
-            defer { self.printTask = nil }
             do {
                 try await spool(page, index: page.index, pageSize: pageSize)
                 printNotice = Notice(
@@ -156,6 +158,7 @@ final class PrintSessionViewModel: ObservableObject {
                 )
             }
             isPrinting = false
+            self.printTask = nil
         }
         printTask = task
     }

Sources/ICCery/Stage4View.swift

@@ -138,6 +138,9 @@ struct Stage4View: View {
                 .textFieldStyle(.roundedBorder)
                 .accessibilityIdentifier("colprofCopyright")
 
+            // Nested VStack keeps the parent at the Swift 5.7 ViewBuilder
+            // 10-child limit (Xcode 14.2 / macOS 12 CI runner, #111).
+            VStack(alignment: .leading, spacing: 12) {
                 Toggle("Apply calibration curve", isOn: $model.applyCalibration)
                     .accessibilityIdentifier("colprofApplyCalibration")
 
@@ -151,6 +154,7 @@ struct Stage4View: View {
                     }
                 }
             }
+        }
         .padding(16)
         .background(Theme.panel)
     }

Tests/ICCeryCoreTests/ProcessRunSupportTests.swift

@@ -21,7 +21,9 @@ final class ProcessRunSupportTests: XCTestCase {
             setRunning: { running.append($0) },
             resetLog: { resets += 1 },
             onLog: { batch in
-                MainActor.assertIsolated()
+                // MainActor.assertIsolated() needs Swift 5.9; the runner is
+                // on Xcode 14.2 (Swift 5.7) (#115).
+                XCTAssertTrue(Thread.isMainThread)
                 received.append(contentsOf: batch)
             }
         ) { onLog in

Tests/ICCeryUITests/Milestone6CalibrationUITests.swift

@@ -76,8 +76,15 @@ final class Milestone6CalibrationUITests: XCTestCase {
         // After generation the wizard should advance to Stage 2 (layout) because
         // a CAL_ .ti1 now exists and the session is in calibration mode.
         let layout = app.buttons["btnCreateLayout"]
+        if !layout.waitForExistence(timeout: 25) {
+            // The generate tap can be dropped while the dashboard is still
+            // settling after the stage transition; retry once before failing.
+            if calGenerate.waitForExistence(timeout: 2) {
+                calGenerate.tap()
+            }
             XCTAssertTrue(layout.waitForExistence(timeout: 25))
         }
+    }
 
     /// A failing calibration targen surfaces the error through the
     /// wizard notice and restores the original basename (issue #80).

project.yml

@@ -19,6 +19,7 @@ targets:
       - path: Resources
         excludes:
           - ICCery.entitlements
+          - ICCery.Debug.entitlements
           - Argyll
       - path: Resources/Argyll
         type: folder
@@ -62,6 +63,15 @@ targets:
         OTHER_SWIFT_FLAGS: ["$(inherited)", "-strict-concurrency=minimal"]
         MACOSX_DEPLOYMENT_TARGET: "12.0"
         ARCHS: "$(ARCHS_STANDARD)"
+      # Debug builds sign ad-hoc; hardened-runtime library validation would
+      # reject the embedded ICCeryCore package framework (no Team ID) when
+      # the test host launches (run 31992, #119). DISABLE_LIBRARY_VALIDATION
+      # does not inject the entitlement on Xcode 14.2, so use a dedicated
+      # Debug entitlements file. Release keeps validation and links the
+      # package statically anyway.
+      configs:
+        Debug:
+          CODE_SIGN_ENTITLEMENTS: Resources/ICCery.Debug.entitlements
 
   ICCeryCoreTests:
     type: bundle.unit-test

scripts/ensure-host-tools.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# scripts/ensure-host-tools.sh
+#
+# Bootstrap host tools needed by CI on the macOS 12 runner:
+#   - xcodegen: pinned prebuilt release from GitHub (Homebrew's current
+#     formula requires Xcode 15.3, which cannot be installed on macOS 12).
+#   - dmgbuild: via pip3 (used by scripts/package-release.sh).
+#
+# Safe to run repeatedly: existing tools are left alone.
+
+set -eu
+
+XCODEGEN_VERSION="2.38.0"
+INSTALL_ROOT="${XCODEGEN_HOME:-$HOME/.local/xcodegen/$XCODEGEN_VERSION}"
+
+echo "==> Ensuring dmgbuild"
+python3 -c "import dmgbuild" 2>/dev/null || pip3 install dmgbuild
+
+if command -v xcodegen >/dev/null 2>&1; then
+    echo "==> xcodegen already on PATH: $(xcodegen --version)"
+else
+    echo "==> Installing xcodegen $XCODEGEN_VERSION (prebuilt)"
+    TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+    ZIP="$TMP/xcodegen-$XCODEGEN_VERSION.zip"
+    curl -fL --retry 3 \
+        "https://github.com/yonaskolb/XcodeGen/releases/download/$XCODEGEN_VERSION/xcodegen.zip" \
+        -o "$ZIP"
+    rm -rf "$INSTALL_ROOT"
+    mkdir -p "$INSTALL_ROOT"
+    # Zip contains xcodegen/{bin/xcodegen,share/xcodegen/SettingPresets};
+    # XcodeGen resolves its presets relative to the binary, so keep the tree.
+    unzip -q "$ZIP" -d "$INSTALL_ROOT"
+    BIN_DIR="$INSTALL_ROOT/xcodegen/bin"
+    chmod +x "$BIN_DIR/xcodegen"
+    if [ -n "${GITHUB_PATH:-}" ]; then
+        echo "$BIN_DIR" >> "$GITHUB_PATH"
+    fi
+    PATH="$BIN_DIR:$PATH"
+    echo "==> Installed: $("$BIN_DIR/xcodegen" --version)"
+fi