From 735d990901e9f20ddfe92424c0ef61a642153a62 Mon Sep 17 00:00:00 2001
From: sechmachine <97589681+sechmachine727@users.noreply.github.com>
Date: Thu, 13 Aug 2026 00:47:26 +0700
Subject: [PATCH] fix(core): normalize framework file modes

---
 core/scripts/build-xcframework.sh |  1 +
 core/tests/packaging.sh           | 55 ++++++++++++++++++++-----------
 2 files changed, 36 insertions(+), 20 deletions(-)

diff --git a/core/scripts/build-xcframework.sh b/core/scripts/build-xcframework.sh
index d0ff133..de575d4 100755
--- a/core/scripts/build-xcframework.sh
+++ b/core/scripts/build-xcframework.sh
@@ -1,5 +1,6 @@
 #!/bin/sh
 set -eu
+umask 022
 PATH=/usr/bin:/bin:/usr/sbin:/sbin
 export PATH
 
diff --git a/core/tests/packaging.sh b/core/tests/packaging.sh
index 2f23390..d26d4a8 100755
--- a/core/tests/packaging.sh
+++ b/core/tests/packaging.sh
@@ -47,7 +47,7 @@ expect_path_rejected "outside the repository" \
     --output "$WORK/repository-alias/core/forbidden-output" \
     --target-dir "$WORK/parents/repository-alias-target"
 
-"$BUILDER" --output "$WORK/one" --target-dir "$WORK/target-one"
+(umask 022 && "$BUILDER" --output "$WORK/one" --target-dir "$WORK/target-one")
 mkdir "$WORK/hostile-bin"
 mkdir -p "$WORK/hostile-cargo-home" "$WORK/hostile-home/.cargo"
 ln -s /usr/bin/false "$WORK/hostile-bin/cargo"
@@ -61,25 +61,28 @@ cat >"$WORK/hostile-home/.cargo/config.toml" <<'EOF'
 [build]
 rustc = "/usr/bin/false"
 EOF
-env \
-    AR=/usr/bin/false \
-    CARGO_BUILD_RUSTC=/usr/bin/false \
-    CARGO_BUILD_RUSTC_WRAPPER=/usr/bin/false \
-    CARGO_ENCODED_RUSTFLAGS=--cfghostile \
-    CARGO_HOME="$WORK/hostile-cargo-home" \
-    CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/usr/bin/false \
-    CC=/usr/bin/false \
-    DEVELOPER_DIR="$WORK/hostile-xcode" \
-    HOME="$WORK/hostile-home" \
-    PATH="$WORK/hostile-bin:/usr/bin:/bin" \
-    RUSTC=/usr/bin/false \
-    RUSTC_WRAPPER=/usr/bin/false \
-    RUSTFLAGS=--cfg=hostile \
-    RUSTUP_HOME="$WORK/hostile-rustup-home" \
-    RUSTUP_TOOLCHAIN=bogus \
-    "$BUILDER" \
-    --output "$WORK/parent-alias/two" \
-    --target-dir "$WORK/parents/target-two"
+(
+    umask 077
+    env \
+        AR=/usr/bin/false \
+        CARGO_BUILD_RUSTC=/usr/bin/false \
+        CARGO_BUILD_RUSTC_WRAPPER=/usr/bin/false \
+        CARGO_ENCODED_RUSTFLAGS=--cfghostile \
+        CARGO_HOME="$WORK/hostile-cargo-home" \
+        CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/usr/bin/false \
+        CC=/usr/bin/false \
+        DEVELOPER_DIR="$WORK/hostile-xcode" \
+        HOME="$WORK/hostile-home" \
+        PATH="$WORK/hostile-bin:/usr/bin:/bin" \
+        RUSTC=/usr/bin/false \
+        RUSTC_WRAPPER=/usr/bin/false \
+        RUSTFLAGS=--cfg=hostile \
+        RUSTUP_HOME="$WORK/hostile-rustup-home" \
+        RUSTUP_TOOLCHAIN=bogus \
+        "$BUILDER" \
+        --output "$WORK/parent-alias/two" \
+        --target-dir "$WORK/parents/target-two"
+)
 
 framework_one="$WORK/one/VerseVDICore.xcframework"
 framework_two="$WORK/physical-parent/two/VerseVDICore.xcframework"
@@ -185,6 +188,18 @@ sha256_file() {
 canonical_tree "$framework_one" >"$WORK/one.tree"
 canonical_tree "$framework_two" >"$WORK/two.tree"
 cmp "$WORK/one.tree" "$WORK/two.tree"
+canonical_tree "$WORK/one" >"$WORK/one.output-tree"
+canonical_tree "$WORK/physical-parent/two" >"$WORK/two.output-tree"
+cmp "$WORK/one.output-tree" "$WORK/two.output-tree"
+for directory in \
+    "$WORK/one" \
+    "$WORK/target-one" \
+    "$framework_one" \
+    "$WORK/physical-parent/two" \
+    "$WORK/parents/target-two" \
+    "$framework_two"; do
+    test "$(stat -f '%Sp' "$directory")" = drwxr-xr-x
+done
 test "$(sha256_file "$library_one")" = "$(sha256_file "$library_two")"
 
 source_epoch=$(git -C "$ROOT" show -s --format=%ct HEAD)