650237efb0
The macOS installer accepted any bundle that passed `codesign --verify` and whose `Info.plist` said `com.cryptic-apps.hopper-web-4`. An ad-hoc signed bundle with that identifier satisfies both, so a substituted DMG could be copied to ~/Applications and launched. Verify a pinned code requirement instead, covering the sealed bundle identifier and the signing team together, and report a distinct `publisher_verification_failed` code so a vendor key change is not confused with a corrupt package. |
||
|---|---|---|
| .. | ||
| acceptance | ||
| boundary | ||
| composition | ||
| conformance | ||
| evaluation | ||
| fixtures | ||
| process-global | ||
| support | ||
| ciTestSequencer.ts | ||
| processOwnershipRunner.ts | ||