The one -Niu 650237efb0 fix(setup): pin Hopper's macOS publisher identity before install (#2481) ...

The macOS installer accepted any bundle that passed `codesign --verify`
and whose `Info.plist` said `com.cryptic-apps.hopper-web-4`. An ad-hoc
signed bundle with that identifier satisfies both, so a substituted DMG
could be copied to ~/Applications and launched.

Verify a pinned code requirement instead, covering the sealed bundle
identifier and the signing team together, and report a distinct
`publisher_verification_failed` code so a vendor key change is not
confused with a corrupt package.

2026-10-13 14:40:04 +08:00

..

macosHopperPublisherVerification.test.ts

fix(setup): pin Hopper's macOS publisher identity before install (#2481)

2026-10-13 14:40:04 +08:00