Repository navigation
Prepare PicFetch for the Mac App Store - #75
Conversation
Package both native runtimes, retain source grants across workers and OS handoffs, capture native window drops, and refresh saved bookmarks. Add signed artifact and production worker qualification with submission evidence and remaining release gates.
Check original Microsoft library signatures before re-signing, preserve exact upstream privacy/license inputs, and reject modified resources even after signing. Run portable packaging guards in CI and document the remaining Protobuf and submission requirements.
Qodana for Go11 new problems were found
💡 Qodana analysis was run in the pull request mode: only the changed files were checked Contact Qodana teamContact us at qodana-support@jetbrains.com
|
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da2df0ccea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review the latest head, 71fd577, including the manually approved CI signing workflow and the two addressed source-authority findings. Both findings have focused regression coverage; the local build and inspections pass. A fresh code and security review is required for this head. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 71fd5777b1
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review Please perform fresh code and security reviews on the latest head, 0a670e6. The security advisory is addressed by immutable action pins in both Apple candidate build and signing jobs, with a regression guard. The earlier two code findings are fixed and resolved. Local packaging tests, workflow lint and GoLand inspections pass; fresh CI is running for this commit. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please perform a fresh security-focused review of latest head e2ca161 as the separate security round of this review loop. The fresh code round is clean: #75 (comment). Assess current HTTP tile cache/response parsing, bounded retention, no-store/Vary wildcard behavior, request/session ownership and queued delivery retirement, plus the macOS Store clipboard/file-access changes in this PR. Report concrete actionable security defects against current code; this is a security-focused Codex review request through the advertised @codex review trigger. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2ca161925
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Final review round for tonight, latest head daf05af. Please review both code correctness/repository conventions and security of the current patch. The prior code round was clean on e2ca161; its separate security-focused round found queued decoded-pixel retention, now fixed and resolved in daf05af. Validate purgeable current-view delivery, bounded visible demand, cancellation/renderer/session ownership, HTTP caching grammar/freshness and no-store handling, and the Store clipboard/file-access changes. Focused map race suites, vet and weak-inclusive GoLand inspections pass. Ronin asked to stop after this final round; any newly validated findings will be recorded for tomorrow rather than starting another implementation cycle tonight. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: daf05af142
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please run a fresh code review on latest head bb0f77b after the positive Age overflow finding from daf05af was fixed and resolved. Review current code against repository conventions and the originating map HTTP cache/lifecycle requirements. Both map race suites, focused vet and weak-inclusive GoLand inspections pass. The earlier repeated-Expires disposition uses the permitted first-occurrence policy from RFC 9111 section 4.2.1. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb0f77b370
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please run a fresh code review on latest head 3da5f98 after the max-age overflow finding from bb0f77b was fixed and resolved. Review current code, originating requirements and repository conventions. Positive Age and valid max-age overflow now saturate consistently; malformed controls retain conservative handling. Both map race suites, focused vet and weak-inclusive GoLand inspections pass. Prior repeated-Expires disposition follows the permitted first-occurrence policy in RFC 9111 section 4.2.1. |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please perform a separate fresh security-focused review on latest head 3da5f98. The code round is clean: #75 (comment). Assess current HTTP tile caching/parser bounds, freshness and overflow behavior, no-store/Vary handling, view/session-owned pixel retention and queued delivery retirement, plus the Store clipboard/file-access changes in this PR. Report concrete actionable security defects against current code. This requests a security-focused Codex round through the advertised @codex review trigger. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Review loop completed for 3da5f98. The resumed loop fixed and pushed two confirmed findings:
Final evidence on the exact pushed head:
Implementation/regression history is in |
|
@codex review Please run a fresh code review of latest head b69171b against repository conventions and the originating requirements. Apple rejected the installed app because it displayed Fyne's default 0.0.1 despite Info.plist version 1.1.11. Both native executable slices now embed captured FyneApp.toml metadata through a staging-only Go overlay; marketing version stays 1.1.11 and the new candidate is build 484. Preserve checkout contents, identity/migrations/icon, deployment minima, private worker dispatch and Store sandbox boundaries. This also includes the owner's preceding OSM attribution/signing-wrapper commit since the last clean review. A real executable regression reproduced 0.0.1 before the fix, and now follows both the configured version/build and a future version outside the checkout. All 38 portable policy tests pass (10 native-only skips); all 14 native bundle-policy tests pass on the newly built universal app. Native About visibly shows Version 1.1.11 (Build 484). make verify-build and weak-inclusive GoLand inspections pass. The installer roundtrip will be qualified against the final permission-normalized signed candidate after this review loop. No upload/submission requested. Evidence: plans/2026-10-03-store-runtime-version.md. |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please run the separate fresh security-focused review of latest head b69171b. The code round is clean: #75 (comment). Assess the current Store packaging/runtime metadata and signing-wrapper changes, preservation of deployment/entitlement/private-worker boundaries and handling of generated source, plus the existing sandboxed file-access/clipboard and bounded HTTP tile-cache/lifecycle changes in this PR. Report concrete actionable security defects against current code. This is the security-focused Codex round through the advertised @codex review trigger. Local executable regression, universal bundle qualification, native About/version checks, native bundle guards, make verify-build and weak-inclusive changed-file GoLand inspections pass. Exact-head FOSSA statuses pass; fresh Qodana post-suppression SARIF identifies this commit and has the identical 11 previously assessed unused-export false positives, with production callers rechecked. Full CI and CodeQL are still running. The new signed candidate follows completion of these review gates. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
The version-fix review loop is complete on b69171b. Marketing version remains 1.1.11; the new candidate is build 484. The Store packager previously compiled raw executables and only stamped the bundle plist. It now embeds the captured Fyne metadata in both architecture slices through a staging-only overlay. About, release notes and installed-version consumers read that metadata; no label is hardcoded. The real executable regression reproduced 0.0.1 before the fix and now follows both the current and a future version outside the checkout. The checkout is unchanged by packaging. Exact-head gates:
Signed candidate produced by a successful full make apple-store-package invocation:
Native About visibly showed Version 1.1.11 (Build 484) in the pre-commit qualification app using the same metadata implementation. Direct desktop launch of the distribution-signed copy failed with macOS spawn error 163. The matching clean qualification process ran, but Computer Use could not locate its window; that test process was stopped. No cause for the distribution launch refusal or Apple-installed acceptance is claimed. Automatic approval rejected inspection through the shared bundle identifier because it could select another PicFetch copy; only explicit candidate-path retries/scoped process checks followed. The completion checklist and moved qualification record are staged locally ( |
Mark the Mac App Store 1.1.11 (build 484) initial release complete: move the App Store, map cache rights and runtime version plans to finished_refactorings with closing records, archive the detailed checklist in the plan, and keep one release-note item in todos.md. Open follow-ups now lead with App Store release automation with manual signing approval, followed by France availability, physical Intel/minimum-OS qualification and cross-volume folder moves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
What does this change do, and why?
Adds an experimental Mac App Store build of PicFetch while preserving the full feature set. The Store channel disables GitHub self-updates, carries user-selected file authority through opening, saved collections, edits and native actions, and runs HEIC/similarity work through embedded sandboxed XPC workers.
The local Make packaging route builds a universal app with pinned ARM/Intel ONNX runtimes, verifies upstream Microsoft signatures before local re-signing, and validates nested code, entitlements, architecture and resource seals. It retains exact Abseil privacy declarations and licenses, supplies copyright/category metadata, and rejects quarantine attributes. Single-image opening requests explicit folder access before sibling discovery across the picker, window drops and Open With. Folder approvals persist in app preferences and are resolved/renewed before reuse on fresh opens, including after relaunch; Ronin confirmed the relaunch workflow. Cancelling retains file-only access; existing folder grants and merge/replay inputs bypass the prompt. Multiple-file selections intentionally stay within the selected set. Late permission results cannot replace newer input. Metadata sorting acquires source authority for size, modified time and EXIF fallback. Worker requests retain original collection/query/cache identities while mapping file reads, version checks and previews to resolved moved-bookmark locations. A separate
make apple-store-package-signedroute validates configured Store identities/profile fields, signs nested code, builds an installer, and verifies its exact certificate and expanded app payload. It neither uploads nor installs. A main-only, manually dispatched CI workflow with immutable official-action pins now builds a candidate before a separate signing job imports temporary credentials. Theapple-store-signingenvironment requires Ronin's approval; its main-only policy and disabled administrator bypass were configured and read back. The ordered owner checklist lists the six environment secrets and three variables still needed. The implementation plan, privacy audit and submission draft record evidence and remaining work.This remains a draft: Protobuf/ONNX privacy coverage, complete GUI permission/relaunch workflows, physical Intel/minimum-OS testing and certificate-signed Store installer/submission validation are open. The local app is ad-hoc signed for qualification, not a submission artifact.
How was this tested?
Checklist
lang.L, with keys in every translation bundleARCHITECTURE.mdupdated for package and ownership changestodos.md