mirror of
https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli.git
synced 2026-09-28 13:14:08 +08:00
玉澜
f37bb1cee6
Review on #1446 flagged that the publication gate parsed only the first __DATA_CONST flags word of an otool -l capture, so a universal library with a healthy first slice and a broken later slice would still ship. Replace the inline one-shot awk with scripts/release/extract-data-const- flags.awk, a state machine that emits one flags word per __DATA_CONST segment in every slice (segname is only honored directly after cmdsize, so section entries can never contribute), and fail closed if any entry lacks SG_READ_ONLY. Add a regression test driven by real otool captures: broken/healthy v1.0.62 thin binaries, the vendored universal runtime dylib, and a universal sample whose last slice is broken — the exact case the old parser wrongly passed. Also remove MACOSX_DEPLOYMENT_TARGET from the --exec ambient pass-through so the container always receives the single unconditional 11.0 pin from compiler_env.