Daniel/meeting-assistant
1
0
Fork 0
forked from Manuel/meeting-assistant
Code Pull Requests Actions Activity Open in Coder

ci: prepare source-bound native macOS build and tests under TCG

Browse Source
This commit is contained in:
dh
2026-10-04 10:56:46 +02:00
parent c01ae13185
commit 17fb74dd74
9 changed files with 1495 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/ci/macos-native-disk-guard.sh
+33
View File
@@ -0,0 +1,33 @@
#!/bin/bash
# Apple pre-.NET boot seam, sourced in Recovery and on installed first boot.
# A match requires the exact run-owned emulated serial, one whole writable 64-GiB disk.
verify_owned_disk() {
local disk="$1" state="$2" token="$3" info serial matches bytes
[[ "$disk" =~ ^/dev/disk[0-9]+$ && "$token" =~ ^[0-9a-f]{32}$ ]] || return 1
[ "$(cat "$state/run.owner" 2>/dev/null)" = "$token" ] || return 1
serial="${token:0:20}"
/usr/sbin/diskutil list physical > "$state/disk-list-current.log" 2>&1 || return 1
/usr/bin/grep -Eq "^$disk[[:space:]].*physical" "$state/disk-list-current.log" || return 1
/usr/sbin/diskutil info "$disk" > "$state/disk-info-current.log" 2>&1 || return 1
info=$(cat "$state/disk-info-current.log")
printf '%s\n' "$info" | /usr/bin/grep -Eq '^[[:space:]]*Whole:[[:space:]]*Yes' || return 1
printf '%s\n' "$info" | /usr/bin/grep -Eq '^[[:space:]]*(Read-Only (Media|Device)|(Media|Device) Read-Only):[[:space:]]*Yes' && return 1
printf '%s\n' "$info" | /usr/bin/grep -Eq '^[[:space:]]*(Read-Only (Media|Device)|(Media|Device) Read-Only):[[:space:]]*No' || return 1
bytes=$(printf '%s\n' "$info" | /usr/bin/sed -nE 's/^[[:space:]]*Disk Size:.*\(([0-9]+) Bytes\).*/\1/p')
[ "$bytes" = 68719476736 ] || return 1
/usr/sbin/ioreg -r -c IOBlockStorageDevice -l -w 0 > "$state/disk-ownership-ioreg.log" 2>&1 || return 1
matches=$(/usr/bin/awk -v expected="$serial" -v disk="${disk#/dev/}" '
function finish_root() { if (serialCount == 1 && serial == expected && ownedDisk) found++ }
/^\+-o/ { finish_root(); serial=""; serialCount=0; ownedDisk=0 }
/"Serial Number"[[:space:]]*=[[:space:]]*"/ {
serialCount++; serial=$0; sub(/^.*"Serial Number"[[:space:]]*=[[:space:]]*"/, "", serial); sub(/".*$/, "", serial); sub(/[[:space:]]+$/, "", serial)
}
/"BSD Name"[[:space:]]*=[[:space:]]*"/ {
name=$0; sub(/^.*"BSD Name"[[:space:]]*=[[:space:]]*"/, "", name); sub(/".*$/, "", name)
if (name == disk) ownedDisk=1
}
END { finish_root(); print found+0 }
' "$state/disk-ownership-ioreg.log")
[ "$matches" = 1 ] || return 1
printf '[owned-disk] %s serial=%s bytes=%s\n' "$disk" "$serial" "$bytes"
}