From a28749fc4e8b42491a4e01b9beb64ec9a0e74d45 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 29 Jul 2026 17:04:30 +0200 Subject: [PATCH] fix(release): strip Mach-O with the tool that can actually do it The previous change generalised `--strip-all` to every platform. Apple's strip does not accept that flag, so the macOS build failed outright -- loudly, which was the lucky outcome. The unlucky version was already in the tree before that: `strip -x`. It succeeds and leaves 4058 symbols, which is precisely the state VirusTotal flagged on darwin-arm64 while the fully stripped ELF legs came back clean. Measured on that artifact: llvm-strip --strip-all 373 symbols CLEAN strip (no flags) 378 symbols equivalent strip -x -S 4058 symbols the FLAGGED state strip -X / -u -r 4058 symbols likewise So the flags are chosen per format, and a candidate that cannot do the job is a hard error rather than a silent fallback to a weaker strip. Verified on a PATH without llvm-strip, exactly as the runner has it: 373 symbols, codesign --verify --strict passes, the binary runs. Packaged and scanned before merge: darwin-arm64 0/60 and ui-darwin-arm64 0/61, both CLEAN -- the platform that was flagged on the previous release run. Signed-off-by: Martin Vogel --- scripts/package-release.sh | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/scripts/package-release.sh b/scripts/package-release.sh index bc2faa76e..6bc98c2be 100755 --- a/scripts/package-release.sh +++ b/scripts/package-release.sh @@ -113,21 +113,31 @@ NAME="codebase-memory-mcp${SUFFIX}-${GOOS}-${GOARCH}" strip_release_binary() { local binary="$1" [ -f "$binary" ] || return 0 - # --strip-all on every format, Mach-O included. + # The right flags differ per format, and the WRONG ones fail silently in + # the dangerous direction. Measured on the flagged darwin-arm64 artifact: # - # This first shipped as `strip -x` on Mach-O out of caution that a full - # strip could leave an image dyld will not load. That caution was wrong for - # this binary and it cost us a release cycle: -x retains external symbols -- - # 4058 of them -- so the macOS artifacts kept the very symbol table the ELF - # legs had just shed, and they were the only ones VirusTotal then flagged. - # Measured on the flagged darwin-arm64 artifact: --strip-all leaves 373 - # symbols, `codesign --verify` passes, the binary runs, and the scan goes - # from 1 malicious to 0/61 clean. + # llvm-strip --strip-all 373 symbols scanned CLEAN + # strip (no flags) 378 symbols equivalent + # strip -x -S 4058 symbols the state VirusTotal FLAGGED + # strip -X / -u -r 4058 symbols likewise + # + # Apple's strip returns success for `-x -S`, so a helper that just tries + # candidates until one exits 0 would quietly reship the flagged binary. + # GNU/LLVM `--strip-all` is not even accepted by Apple's strip, which is why + # generalising it to every platform broke the macOS build -- loudly, which + # was the lucky outcome. + # + # So: --strip-all where it is understood, plain `strip` for Mach-O, and a + # hard error when no candidate can do the job. Never a weaker fallback. local stripped="" for tool in "${STRIP:-}" llvm-strip strip; do [ -n "$tool" ] || continue command -v "$tool" >/dev/null 2>&1 || continue - "$tool" --strip-all "$binary" 2>/dev/null && stripped="$tool" + if "$tool" --strip-all "$binary" 2>/dev/null; then + stripped="$tool --strip-all" + elif [ "$GOOS" = "darwin" ] && "$tool" "$binary" 2>/dev/null; then + stripped="$tool" + fi [ -n "$stripped" ] && break done if [ -z "$stripped" ]; then