Skip to content

fix(shared-core): keep symlinks in the macOS XCFramework zip - #1422

Merged
bmc08gt merged 1 commit into
code/cashfrom
fix/shared-core-macos-symlinks
Sep 5, 2026
Merged

fix(shared-core): keep symlinks in the macOS XCFramework zip#1422
bmc08gt merged 1 commit into
code/cashfrom
fix/shared-core-macos-symlinks

Conversation

@bmc08gt

@bmc08gt bmc08gt commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

KMMBridge's zipXCFramework task is a bare Gradle Zip task, and Gradle's Zip/CopySpec machinery dereferences symlinks instead of storing them. A macOS framework bundle is built entirely from symlinks — Versions/Current -> A, and the top-level Headers/Modules/Resources/binary each symlinking into Versions/Current/* — so the archive KMMBridge produces for the macOS slice ships three literal duplicate copies of the same content instead of the real bundle layout. iOS framework bundles are flat, which is why this was invisible until the macOS targets landed (#1402).

The published 0.5.0 release confirms it: unzipping the release asset and listing the macOS slice shows Versions/Current, Headers, Modules, Resources, and the binary as full duplicated files rather than symlinks. Any consumer that builds and codesigns against the macOS slice fails with code object is not signed at all on the nested framework, because codesign's recursive bundle signing needs the real symlinked structure.

KMMBridge 1.2.1 is still the newest release (checked the Gradle Plugin Portal and GitHub releases) and its issue tracker has nothing open about this, so there is no upstream fix to pick up. This reconfigures the existing zipXCFramework task: once KMMBridge's own zip runs, doLast deletes the result and re-zips the same source directory with zip -y, which stores symlinks as symlinks instead of following them. The reconfiguration only touches the task when KMMBridge registers it (matching {}), so it stays a no-op on any build where publishing is not enabled.

Verified locally by running :kmp:shared-core:zipXCFramework directly (placeholder local.properties and spmRepoDir, no real publish) and extracting the resulting archive: the macOS slice now has real symlinks (Headers -> Versions/Current/Headers, Current -> A, etc.) instead of duplicated files.

This unblocks a 0.5.1 release of flipcash-shared-core-spm — needed before code-ios-app#725 can adopt shared mnemonic derivation against a macOS-capable build.

KMMBridge's zipXCFramework task is a bare Gradle Zip task, and Gradle's
Zip/CopySpec machinery dereferences symlinks instead of storing them. A
macOS framework bundle is built entirely from symlinks (Versions/Current
-> A, and Headers/Modules/Resources/binary each pointing into
Versions/Current/*), so the archive KMMBridge produced for the macOS
slice shipped three duplicate copies of the same content instead of the
real bundle layout. iOS bundles are flat, which is why this went
unnoticed until the macOS targets landed (#1402).

Confirmed against the published 0.5.0 release: unzipping it and listing
the macOS slice shows Versions/Current, Headers, Modules, Resources, and
the binary as full duplicated files rather than symlinks, which fails
codesign on anything that builds against that slice ("code object is
not signed at all" on the nested framework).

KMMBridge 1.2.1 is still the newest release and its tracker has nothing
open about this, so there's no upstream fix to pick up. Once KMMBridge's
own zipXCFramework runs, doLast deletes the result and re-zips the same
source directory with `zip -y`, which stores symlinks as symlinks. The
reconfiguration only touches the task when KMMBridge registers it, so
it's a no-op on any build where publishing isn't enabled.
@bmc08gt bmc08gt self-assigned this Sep 5, 2026
@github-actions github-actions Bot added the type: fix Bug fix label Sep 5, 2026
@bmc08gt
bmc08gt merged commit 53ce3b7 into code/cash Sep 5, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type: fix Bug fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant