add bundle-install design spec (.app directory bundles)#198
Merged
Conversation
…alls Design doc for #145 phase A (maintainer sign-off before implementation): `bundle_root_in_archive`/`bundle_install_path` builder API, whole-tree stash-and-rollback swap with `MoveAll` semantics, same-filesystem staging, preflight interaction, non-goals (.deb/.msi recipe-only, no signing/notarizing, no escalation), test strategy, and the open API questions. Also records that zip symlink entries are currently extracted as regular files (a standalone bug for .app framework symlinks; see BNDL-4-2).
jaemk
force-pushed
the
260718.bundle-install-spec
branch
from
July 20, 2026 01:49
b20f38a to
2b3fcb1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Design spec for #145 phase A (directory bundles, macOS
.app), for sign-off before implementation. Docs only, no code changes.specs/bundle-install.md: builder API (bundle_root_in_archive+bundle_install_path, macOS default detection via the.appancestor ofcurrent_exe()), pipeline (verify -> extract to same-filesystem staging -> whole-tree stash-and-rollback swap withMoveAllsemantics -> exe-aside for the running image), Managing around sudo or missing permissions #112 preflight interaction, error/rollback guarantees, non-goals, and testing strategy including the manual macOS matrix CI cannot cover.Extract::extract_into: unix permission bits are already preserved for zip (masked to 0o777, tested), so the issue thread's manualunix_mode()handling is not needed; and zip symlink entries were extracted as regular files containing the target text, which corrupts.appframework symlinks and the publisher's code signature. That bug is fixed in fix zip symlink extraction, clean up cfg-gated test imports #199 (BNDL-4-2 records the resolved behavior)..deb/.msistay a docs-only recipe (noinstall_packagehelper); restart-after-swap composes with the existingrestartmodule.The sign-off surface is the "Open questions" section: setter naming, mutual-exclusion semantics, macOS default detection, non-macOS in-bundle swaps, no-copy-fallback staging, the
verify_binarytarget in bundle mode, error variant names, and App Translocation handling (Q8, the standalone symlink fix, is resolved by #199).