Terminal 1.0: a-Shell 2.3.2 full + worse_query + native plugin environment

scripts/build_dylib.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Build TerminalSBX.dylib for iOS arm64.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SDK="$(xcrun --sdk iphoneos --show-sdk-path)"
+mkdir -p "$ROOT/build"
+xcrun --sdk iphoneos clang \
+  -arch arm64 -miphoneos-version-min=15.0 -isysroot "$SDK" \
+  -dynamiclib -fobjc-arc -fmodules -fblocks -O2 \
+  -Wno-unused-parameter -Wno-arc-performSelector-leaks \
+  -framework Foundation -framework Security -framework UIKit -framework Metal \
+  -install_name @executable_path/Frameworks/TerminalSBX.dylib \
+  -o "$ROOT/build/TerminalSBX.dylib" "$ROOT/src/TerminalSBX.m"
+echo "$ROOT/build/TerminalSBX.dylib"

scripts/ent.plist

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>application-identifier</key><string>NL6UD7G49R.com.cert.account.t260930000125</string>
+<key>com.apple.developer.team-identifier</key><string>NL6UD7G49R</string>
+<key>com.apple.security.application-groups</key><array>
+<string>group.com.cert.account.t260930000125.01</string>
+<string>group.com.cert.account.t260930000125.02</string>
+<string>group.com.cert.account.t260930000125.03</string>
+<string>group.com.cert.account.t260930000125.04</string>
+<string>group.com.cert.account.t260930000125.05</string>
+</array>
+<key>keychain-access-groups</key><array><string>NL6UD7G49R.*</string></array>
+<key>com.apple.developer.nfc.readersession.formats</key><array><string>TAG</string></array>
+</dict></plist>

scripts/inject_dylib.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+"""Inject a weak LC_LOAD_DYLIB into the a-Shell main binary with LIEF."""
+import sys
+import lief
+
+if len(sys.argv) != 3:
+    raise SystemExit("usage: inject_dylib.py <main-binary> <dylib-path>")
+
+path, dylib = sys.argv[1], sys.argv[2]
+binary = lief.MachO.parse(path).at(0)
+if dylib in [lib.name for lib in binary.libraries]:
+    print("already present")
+    raise SystemExit(0)
+command = lief.MachO.DylibCommand.weak_lib(dylib)
+result = binary.add(command)
+binary.write(path)
+print(result)

scripts/sign_all.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# Reference signing pass: sign every framework with the same team, then the
+# app with the supplied entitlements and provisioning profile.
+#
+# Usage:
+#   IDENTITY=... KEYCHAIN=... PROFILE=... ./sign_all.sh work/Terminal.app
+set -euo pipefail
+APP="${1:-work/Terminal.app}"
+IDENTITY="${IDENTITY:?set IDENTITY}"
+KEYCHAIN="${KEYCHAIN:-$HOME/Library/Keychains/login.keychain-db}"
+ENT="${ENT:-scripts/ent.plist}"
+PROFILE="${PROFILE:?set PROFILE}"
+
+find "$APP/Frameworks" "$APP/usr" "$APP/Library" -type f \
+  \( -name '*.dylib' -o -name '*.so' -o -perm -111 \) -print0 2>/dev/null |
+while IFS= read -r -d '' f; do
+  file -b "$f" | grep -q 'Mach-O' || continue
+  codesign --force --sign "$IDENTITY" --keychain "$KEYCHAIN" --timestamp=none "$f"
+done
+
+find "$APP/Frameworks" -type d -name '*.framework' -print |
+  awk '{ print length($0) "\t" $0 }' | sort -rn | cut -f2- |
+while IFS= read -r fw; do
+  codesign --force --sign "$IDENTITY" --keychain "$KEYCHAIN" --timestamp=none "$fw"
+done
+
+for appex in "$APP"/PlugIns/*.appex; do
+  [ -d "$appex" ] || continue
+  cp "$PROFILE" "$appex/embedded.mobileprovision"
+  codesign --force --sign "$IDENTITY" --keychain "$KEYCHAIN" \
+    --entitlements "$ENT" --generate-entitlement-der --timestamp=none "$appex"
+done
+
+cp "$PROFILE" "$APP/embedded.mobileprovision"
+codesign --force --sign "$IDENTITY" --keychain "$KEYCHAIN" \
+  --entitlements "$ENT" --generate-entitlement-der --timestamp=none "$APP"
+codesign --verify --strict --verbose=2 "$APP"