From e1544795321007170b2e1687025489e83a522d84 Mon Sep 17 00:00:00 2001
From: DKChan <524912269@qq.com>
Date: Tue, 3 Nov 2026 04:33:31 +0800
Subject: [PATCH] =?UTF-8?q?=E5=B7=A5=E7=A8=8B(ci=E8=BF=9C=E7=AB=AF?=
 =?UTF-8?q?=E5=8C=96=C2=B7=E4=BF=AE=E5=A4=8D):=20Godot=E5=AE=89=E8=A3=85?=
 =?UTF-8?q?=E6=94=B9=E6=95=B4bundle=E5=BD=A2=E6=80=81=E2=80=94=E2=80=94?=
 =?UTF-8?q?=E5=AE=98=E6=96=B9=E7=AD=BE=E5=90=8D=E5=B0=81bundle=20Info.plis?=
 =?UTF-8?q?t,=E6=8A=BD=E8=A3=B8=E4=BA=8C=E8=BF=9B=E5=88=B6=E8=A2=ABtaskgat?=
 =?UTF-8?q?ed=E5=88=A4Code=20Signature=20Invalid=20SIGKILL(=E5=AE=9E?=
 =?UTF-8?q?=E8=AF=81:codesign=20invalid=20Info.plist+bundle=E5=BD=A2?=
 =?UTF-8?q?=E6=80=81rc=3D0);=20=E8=A3=85/usr/local/lib/Godot=5Fci.app+/usr?=
 =?UTF-8?q?/local/bin/godot=E5=8C=85=E8=A3=85=E8=BD=AC=E5=8F=91;=20Pillow?=
 =?UTF-8?q?=E5=AE=89=E8=A3=85=E5=8A=A0-H=E4=BF=AEsudo=20-u=E7=9A=84HOME?=
 =?UTF-8?q?=E6=B1=A1=E6=9F=93(=E7=BC=93=E5=AD=98=E8=AF=AF=E5=86=99?=
 =?UTF-8?q?=E8=B0=83=E7=94=A8=E8=80=85=E7=9B=AE=E5=BD=95)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tools/ci/mac_setup.sh | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/tools/ci/mac_setup.sh b/tools/ci/mac_setup.sh
index 6577a9ae..05720df7 100644
--- a/tools/ci/mac_setup.sh
+++ b/tools/ci/mac_setup.sh
@@ -80,7 +80,9 @@ PYEOF
 	log "自动登录已配置：开机直接进入 ${CI_USER} 图形会话（日常使用=快速用户切换到本人账户）"
 fi
 
-# ── 3. Godot macOS 版 → /usr/local/bin/godot ──
+# ── 3. Godot macOS 版 → 完整 .app 装 /usr/local/lib ＋ /usr/local/bin/godot 包装转发 ──
+# 纪律：官方签名封 bundle 的 Info.plist——从 .app 抽裸二进制会被 taskgated 判
+# 「Code Signature Invalid」SIGKILL（2026-11-03 实证），必须整 bundle 安装保持签名校验路径。
 if /usr/local/bin/godot --version >/dev/null 2>&1 && /usr/local/bin/godot --version 2>/dev/null | grep -q "$GODOT_VER"; then
 	log "Godot ${GODOT_VER} 已在位，跳过"
 else
@@ -88,7 +90,7 @@ else
 	SRC_ZIP="/Users/${INVOKER}/godot-linux/Godot_v${GODOT_VER}-stable_macos.universal.zip"
 	if [ -n "$GODOT_ZIP" ] && [ -s "$GODOT_ZIP" ]; then
 		ZIP="$GODOT_ZIP"; log "使用本地 zip: $ZIP"
-	elif [ -s "$SRC_ZIP" ]; then
+	elif [ -z "$GODOT_ZIP" ] && [ -s "$SRC_ZIP" ]; then
 		ZIP="$SRC_ZIP"; log "复用已下载 zip: $ZIP"
 	else
 		ZIP="$(mktemp "${TMPDIR:-/tmp}/godot_mac_XXXXXX")"   # macOS BSD mktemp 禁 X 后带后缀
@@ -106,8 +108,14 @@ else
 	TMPD="$(mktemp -d)"
 	unzip -tq "$ZIP" >/dev/null   # 双保险：本地复用的 zip 同样验结构
 	unzip -q -o "$ZIP" -d "$TMPD"
-	install -m 0755 "${TMPD}/Godot.app/Contents/MacOS/Godot" /usr/local/bin/godot
-	xattr -dr com.apple.quarantine /usr/local/bin/godot 2>/dev/null || true
+	rm -rf "/usr/local/lib/Godot_ci.app"
+	cp -R "${TMPD}/Godot.app" "/usr/local/lib/Godot_ci.app"
+	xattr -dr com.apple.quarantine "/usr/local/lib/Godot_ci.app" 2>/dev/null || true
+	cat > /usr/local/bin/godot <<'EOF'
+#!/bin/bash
+exec /usr/local/lib/Godot_ci.app/Contents/MacOS/Godot "$@"
+EOF
+	chmod 0755 /usr/local/bin/godot
 	rm -rf "$TMPD"
 	log "Godot 已装：$(/usr/local/bin/godot --version 2>/dev/null | head -1)"
 fi
@@ -142,8 +150,8 @@ fi
 if sudo -u "$CI_USER" python3 -c "import PIL" >/dev/null 2>&1; then
 	log "Pillow 已在位（ci-runner），跳过"
 else
-	log "为 ci-runner 安装 Pillow（阿里源）"
-	sudo -u "$CI_USER" python3 -m pip install --user pillow \
+	log "为 ci-runner 安装 Pillow（阿里源；-H 修 HOME——sudo -u 默认保留调用者 HOME 会写错缓存目录）"
+	sudo -H -u "$CI_USER" python3 -m pip install --user pillow \
 		-i https://mirrors.aliyun.com/pypi/simple/ --quiet \
 		|| die "Pillow 安装失败"
 fi