Kaoru0822andClaude Opus 5.5
25ca63f231
inspect_signature reduced the CodeDirectory to a hardened-runtime boolean and never verified the signature. It now also reports: - the parsed CodeDirectory: version, flags decoded from their numeric value (runtime, library-validation, restrict, kill, adhoc, linker-signed, unknown bits in hex), code and special slot counts, location, hash type, platform identifier, runtime version, and executable-segment flags; - sealed resources (version, rules, files, or none); - a local `codesign --verify --strict` result on the opened bundle or Mach-O, with diagnostics and the sorted nested code it validated; - whether a notarization ticket is stapled at Contents/CodeResources, with its digest. The ticket and Apple's records are not checked because that needs the network; - derived security facets with their supporting evidence: library validation, DYLD_* handling, debugger attach, executable-memory policy, and App Sandbox. Facets stay unknown when flags or aggregate entitlements are unavailable. verify:code-signature re-signs copies of the clang-built fixture with real codesign (ad hoc, hardened runtime, hardened runtime with relaxing entitlements, library,restrict). It also checks a platform binary and a tampered bundle, with CLI/MCP parity, and runs in the macOS CI job. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
10 lines
294 B
TypeScript
10 lines
294 B
TypeScript
/** Generated from package.json and package-lock.json; do not edit. */
|
|
export const PACKAGE_METADATA = {
|
|
name: "rea-agents",
|
|
version: "4.1.0", // x-release-please-version
|
|
serverSdkVersion: "2.3.1",
|
|
clientSdkVersion: "2.3.1",
|
|
coreSdkVersion: "2.3.1",
|
|
skillVersion: "28",
|
|
} as const;
|