fix(desktop): accept PragSys-signed runtime binaries

[WellDunDun]

What changed

• Generate the runtime manifest from one exact signing-mutable path allowlist.
• Include the two Desktop executables and DuckDB native binaries rewritten by macOS signing.
• Keep all other runtime files pinned to their pre-sign size and SHA-256.

Root cause

macOS code signing rewrites Mach-O files after the runtime manifest is generated. The packaged app therefore rejected its own valid PragSys-signed runtime and opened recovery instead of the dashboard.

Safety

The exception is active only after the complete app bundle passes strict platform signature verification. Installed runtime copies must still byte-match the verified signed source.

Verification

• Desktop tests: 102 passed
• Desktop typecheck and targeted lint/format: passed
• Real post-signature manifest simulation: strict pre-sign check rejected; verified signing mode accepted
• Packaged DuckDB sidecar smoke: passed

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6ee1f53e-be57-4c06-959a-105171e960ba

📥 Commits

Reviewing files that changed from the base of the PR and between ca89211 and 87e9005.

📒 Files selected for processing (4)

• .changeset/fix-signed-duckdb-manifest.md
• apps/desktop/scripts/build-sidecar.ts
• apps/desktop/src/main/runtime-install.test.ts
• apps/desktop/src/main/runtime-integrity.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved macOS code-signing support for bundled native components.
  • Preserved strict verification that packaged native binaries match their source versions.
  • Added safeguards to reject unapproved runtime files and invalid signing configurations.

• Tests

  • Expanded runtime integrity coverage for report workers and DuckDB binaries.
  • Added checks for approved signing paths and mismatched or unauthorized native files.

Walkthrough

The runtime manifest now marks approved report-worker and DuckDB binaries as signing-mutable. Runtime validation requires one primary executable, rejects unapproved mutable paths, and verifies signed native binaries against the source runtime.

Changes

Runtime integrity

Layer / File(s)	Summary
Approved mutable runtime paths apps/desktop/src/main/runtime-integrity.ts	The validator defines approved signing-mutable paths, requires one primary executable, and limits permission checks to recognized runtime executables.
Signing-aware manifest generation apps/desktop/scripts/build-sidecar.ts	The sidecar build script classifies each normalized runtime path with isSigningMutableRuntimePath.
Runtime integrity fixtures and release metadata apps/desktop/src/main/runtime-install.test.ts, .changeset/fix-signed-duckdb-manifest.md	Tests cover report-worker and DuckDB binaries, allowlist rejection, mutable settings rejection, and source matching. The changeset records a patch release.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• selftune-dev/selftune#146: Both changes update sidecar manifest handling for bundled DuckDB native binaries.

Sequence Diagram(s)

sequenceDiagram
  participant SidecarBuild
  participant RuntimeIntegrity
  participant RuntimeInstaller
  SidecarBuild->>RuntimeIntegrity: classify normalized runtime paths
  RuntimeIntegrity->>RuntimeInstaller: validate approved mutable paths
  RuntimeInstaller->>RuntimeIntegrity: compare signed native binaries with source runtime

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the required conventional commit format and accurately describes the runtime binary signing fix.
Description check	✅ Passed	The description clearly explains the macOS signing issue, the allowlist-based fix, safety constraints, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/v0.3.3-macos-smoke-origin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}