fix: scan all Mach-O binaries for bundle linkage, not just .so/.dylib

[asheshv]

Summary

Follow-up to #10135 (merged). CodeRabbit flagged that _verify_bundle_linkage's scan only matched files by .so/.dylib name suffix, so a shipped executable (Contents/MacOS/*) or a Python.framework payload carrying a host-linked dependency but no matching suffix would slip through the check unnoticed — the exact class of bug #10135 was added to catch in the first place.

Fix

Detect Mach-O executables/libraries by content (via file), the same pattern the codesign step in this file already uses, instead of filtering by extension:

-    done < <(find "${BUNDLE_DIR}" \( -name '*.so' -o -name '*.dylib' \) -type f)
+    done < <(find "${BUNDLE_DIR}" -type f -perm +111 -exec file "{}" \; | \
+        grep -v "(for architecture" | \
+        grep -E "Mach-O executable|Mach-O 64-bit executable|Mach-O 64-bit bundle|Mach-O 64-bit dynamically linked shared library" | \
+        awk -F":" '{print $1}' | uniq)

Testing

macOS build script only, no runtime code paths affected. bash -n pkg/mac/build-functions.sh clean.

Summary by CodeRabbit

• Bug Fixes
  • Improved macOS bundle verification by expanding the set of inspected binaries to include Mach-O applications, bundles, and shared libraries, based on actual file types.
  • Enhanced detection of unintended build-environment library references during release validation by running dependency install-name checks against the newly identified set of relevant binaries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bcd5e72a-0f11-4d17-a459-1232146bce4b

📥 Commits

Reviewing files that changed from the base of the PR and between 6550983 and 93ae6c1.

📒 Files selected for processing (1)

• pkg/mac/build-functions.sh

---

Walkthrough

The macOS bundle linkage verification now discovers all bundle files, filters relevant Mach-O types, deduplicates paths, and checks dependency install names for forbidden build-host library prefixes.

Changes

macOS linkage verification

Layer / File(s)	Summary
Executable bundle scan pkg/mac/build-functions.sh	_verify_bundle_linkage replaces the .so/.dylib filename filter with bundle-wide file discovery, Mach-O type filtering, path deduplication, and dependency validation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• pgadmin-org/pgadmin4#10135: Modifies the same linkage-verification step and its otool -L dependency scan.

Suggested reviewers: dpage

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: expanding bundle linkage checks from .so/.dylib files to all Mach-O binaries.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/mac/build-functions.sh`:
- Around line 518-521: Update the find pipeline feeding the Mach-O verification
loop to remove the executable-permission predicate from `find "${BUNDLE_DIR}"`,
allowing readable non-executable libraries to reach `file` and the existing
Mach-O content filters while preserving the downstream filtering behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c523a6ec-6789-4dc3-8438-008e0dd225d5

📥 Commits

Reviewing files that changed from the base of the PR and between 1884356 and 6550983.

📒 Files selected for processing (1)

• pkg/mac/build-functions.sh