mirrors/Mole
1
0
Fork 0
mirror of https://github.com/tw93/Mole.git synced 2026-03-22 15:00:07 +00:00
Code Activity

fix: preserve gatekeeper state in optimize

Browse Source
This commit is contained in:
Tw93
2026-03-22 19:36:54 +08:00
parent 0c71ee9363
commit 1b98041e0f
2 changed files with 8 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
bin/optimize.sh
View File

@@ -312,11 +312,8 @@ collect_security_fix_actions() {
SECURITY_FIXES+=("firewall|Enable macOS firewall") SECURITY_FIXES+=("firewall|Enable macOS firewall")
fi fi
fi fi
if [[ "${GATEKEEPER_DISABLED:-}" == "true" ]]; then # Gatekeeper state is intentionally user-managed. Optimize may report it,
if ! is_whitelisted "gatekeeper"; then # but it must not change the user's "Anywhere" preference.
SECURITY_FIXES+=("gatekeeper|Enable Gatekeeper, app download protection")
fi
fi
if touchid_supported && ! touchid_configured; then if touchid_supported && ! touchid_configured; then
if ! is_whitelisted "check_touchid"; then if ! is_whitelisted "check_touchid"; then
SECURITY_FIXES+=("touchid|Enable Touch ID for sudo") SECURITY_FIXES+=("touchid|Enable Touch ID for sudo")
@@ -370,16 +367,6 @@ apply_firewall_fix() {
return 1 return 1
} }
apply_gatekeeper_fix() {
if sudo spctl --master-enable 2> /dev/null; then
echo -e " ${GREEN}${ICON_SUCCESS}${NC} Gatekeeper enabled"
GATEKEEPER_DISABLED=false
return 0
fi
echo -e " ${GRAY}${ICON_WARNING}${NC} Failed to enable Gatekeeper"
return 1
}
apply_touchid_fix() { apply_touchid_fix() {
if "$SCRIPT_DIR/bin/touchid.sh" enable; then if "$SCRIPT_DIR/bin/touchid.sh" enable; then
return 0 return 0
@@ -400,9 +387,6 @@ perform_security_fixes() {
firewall) firewall)
apply_firewall_fix && ((applied++)) apply_firewall_fix && ((applied++))
;; ;;
gatekeeper)
apply_gatekeeper_fix && ((applied++))
;;
touchid) touchid)
apply_touchid_fix && ((applied++)) apply_touchid_fix && ((applied++))
;; ;;

6
tests/optimize.bats
View File

@@ -141,6 +141,12 @@ EOF
[[ "$output" == *"Font cache cleared"* ]] [[ "$output" == *"Font cache cleared"* ]]
} }
@test "optimize does not auto-fix Gatekeeper anymore" {
run grep -n "spctl --master-enable\\|SECURITY_FIXES+=([\"']gatekeeper|" "$PROJECT_ROOT/bin/optimize.sh"
[ "$status" -eq 1 ]
}
@test "opt_font_cache_rebuild skips when Firefox helpers are running" { @test "opt_font_cache_rebuild skips when Firefox helpers are running" {
run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc <<'EOF' run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc <<'EOF'
set -euo pipefail set -euo pipefail