Redline updater hardening: signed-update verification, atomic install + revert, update visibility, notarization pipeline (MMDB-2681) #24

Merged
kua-agent merged 7 commits from feat/updater-hardening-20260905 into main 2026-09-05 06:07:06 +00:00
Showing only changes of commit 8a12ed0a54 - Show all commits
+1 -1
View File
@@ -359,7 +359,7 @@ SPCTL_STATUS=$?
set -e set -e
echo "${SPCTL_OUTPUT}" echo "${SPCTL_OUTPUT}"
if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then
if [[ "${NOTARIZED}" == "true" ]]; then if [[ "${NOTARIZED}" -eq 1 ]]; then
echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2 echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2
exit 1 exit 1
fi fi