ReviewOS

pantry-pm/pantry

Support app-only archives in native package materialization

#252
Closed chris opened this 6 days ago ·
6 days ago

The first automated Launchpad release successfully published a signed, notarized app archive through Pantry's scanned registry. A real pantry install --user --kind app launchpad then failed with InvalidPackageSource: the generic materializer recognized conventional package directories but not app-only payloads. Launchpad's initial catalog entry also incorrectly advertised its GUI executable as an exported CLI command.

Accept an app payload only when its bundle contains a non-empty Info.plist and a non-empty executable in Contents/MacOS. Preserve the complete bundle during materialization. Keep declared CLI program validation intact, and declare GUI-only packages with an empty programs list. Do not add fake CLI wrappers or disable validation.

Verification: retained materialization regression covering valid bundles, missing manifests, non-executable and empty binaries, and rejection when a CLI package's declared program is missing. Repeat installation from the public Launchpad registry artifact, then verify its signature, Gatekeeper acceptance, and stapled notarization ticket. Release the core fix through the normal Pantry patch workflow.

6 days ago

Released in v0.11.140. The public Pantry CLI reports revision 9d249bb and successfully installed Launchpad 1.0.1 Build 14 using the normal pantry install --user --kind app launchpad command. The resulting ~/Applications/Launchpad.app passed codesign verification, Gatekeeper assessment as Notarized Developer ID, and stapler validation. The retained materialization regression also confirms that an app bundle cannot satisfy a missing declared CLI program.

Sign in to comment on this issue.