From e7a0451a548cb8002b5ca6b00e9a61ae74facd26 Mon Sep 17 00:00:00 2001 From: Brandon McAnsh Date: Sun, 23 Aug 2026 19:58:40 -0400 Subject: [PATCH] fix(scanner): stamp opencv2 with a released SDK MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 4.12.0 rebuild in #630 was made with the only Xcode on the build machine, a 27.0 beta, so both framework slices carry LC_BUILD_VERSION sdk 27.0. The App Store rejects any binary stamped above the newest released SDK (ITMS-90512), which took out 2026.8.3 build 500 — and would take out every release until fixed, since this sits on main. Restamp both slices to 26.1, the sdk the shipping 2026.8.2 framework carried, with vtool. Nothing else in the binary changes and the frameworks are unsigned, so there is nothing to re-sign. Also refuse to build the framework at all under a too-new SDK. This script's output is committed and shipped as-is, so a beta Xcode here surfaces as a failed submission weeks later, long after whoever ran it has moved on. --- .../ios-arm64/opencv2.framework/opencv2 | Bin 11537520 -> 11537520 bytes .../opencv2.framework/opencv2 | Bin 28998072 -> 28998072 bytes CodeScanner/Scripts/build_opencv.sh | 29 ++++++++++++++++++ 3 files changed, 29 insertions(+) diff --git a/CodeScanner/Frameworks/opencv2.xcframework/ios-arm64/opencv2.framework/opencv2 b/CodeScanner/Frameworks/opencv2.xcframework/ios-arm64/opencv2.framework/opencv2 index 5f5c6fd3d7194e387d082ec825a540cfc0194760..ad94acfb7a401d2092fa2923254d85882ca14830 100755 GIT binary patch delta 576 zcmWO2=UR>d0D$55ONm6NNEFG=NJT{Y2+7_QvUkX;jCh0x4SPgnB&!lvSAIK`4xvNn z`*EMZJ<#$$W+38EQaF^|n;hnAjZVx7f*>U#Dk2CHf*_RoH={4N9tla543TJw zk)aYR!(_O`$q0#;kupjWWVDQtv63iBk}Tt7yrjqkNtKB*Nzx=;Cd(Abkg1X>(`35L zkeM<|X3HGOlDRTZ=F0-fmW7fdxsoS~WU=JS5?Lw*vP_msp{$T13Cl`ZCB?E@*2r2Z zk#$lk>t%y%lufc(w#Zi5Cfj9)?37)yTlUCaDU)*9C;R1qRLDU&B!}gQ9F=2oTu#VI zIVGp%jGUE9IVb1kf>g;xxg?k6id>aysgYW_CfDVL+>|=GCATH=e@E)&uH2LRqCAj? z@<X%G_y{gVIy delta 589 zcmWmAXIIVv0EY4Z(~y-!i3$%9DXWZ(cqo!=itHJg*%@&O7m+QB><|%7=Xl*m>Ld7j z@w?8s-`@RgeTn^{-)XT(ac_F8J1JTi1VJcOnUW>hGFHaPc!|mc znJ76jNhV9KOp&RQC(|Tf3S_#>keM<|W=o+I$sCz0^JKmh%K}*_i)68s$P!s9F4*l^60-+N51x$!qD5H}Y2A$$R-AALWyD Z%4hi^U!_aF$#?0NAM#Ur{_?B79LMqBFDa??(37%@kS#5!WGNy`cG;KGqO6q=iAc7Ptl27iWQme8%VV}? z-xssejM>bXVaBXx#?1ROXa1dY&+GlyJ?Gwk?)TO_xZ_%b3aiD;tn{!rJ648!#@f3F z8iwHoM;L~iVVEro1F~~1tv6X(o3KLz*rOpF;D|Xb*36Ku7qX6FQ>{e9;x%&>cO{6MpCge*_>9LFkP>=!;;4AQb%& zhW;3Uff$5vL|`z6AQD3{3{e=45g3V4h{kA)!B~vLcuc@VOhODMV+y8X8m40gW?~j* zV-8{whq;JH0uqsgc}PYI=3@aCVi6W&2~v@UbSy;%mSH(oAQLOG3Rzf)`S5;k1NQ+OKB;8{F}Iy{dT z@FHHq%XkH^;x)XEH}EFj!rOQU@8Uh&!29?BAL1i?j8AYAw@{By@fmL8b9{j>@fE(t z9ejgtaTnj=d)&i){D2?v06*bp{DNQc8-B+_{DD957arm7eBOQm6g#DXVy`qbZ43d^ z-pBN{d4xNd<&L)cCu__)) zbH!8fQd%f2l~xKjFN$uXv{l+E?Gy2?WsnlCL@0xmAxfk&R2im3DZ`Z!%1C9D60M9@ z#wcTzamsjQf-+H=q{Jwbl_|{YGNmAx1$x4bc zUs<3mR2C_Vl_g55lBT39OO*^|nX+72p=2s6l~qcXvRcVj)+lS09A%xdUddH9D0#|8 zWs|a5*`jP!@|A7Mc4dcBpzKr%m0ikiWskB~*{AGRij)J&LFJHgSUI8;D#CzVsmX{Ag#qnuUBm2=8@<$`iisZcH{mz7GTO1Yv`D_2chQFM)Yug*J!f8G4| zcQ*{{!<#O4hMDAJ*x4I~9m_BhO3K`8&CuZdoc}f%#?q8UeyMR8@yUq^M!8c}y`?%b pD=6abjlp5AY4`n$AJv6AU$4l^jlFfdFulNPtu<{{>ov19@gFjruZ$t#BfAm1V&;MMk5+A7=y7Ghggiq1jJz?CSfw-F$GgG4GEZz8JLM# zn2kA@i+M=Id@Mi`79trbNJSdbu?UN?1WS>DOk`mhmSY80VimHn8f&l?>yU$7*L#V`I9Klgk;TWoM z94BxRr*IlIID@mO#W|eE1zbcOF5xoj(SR$sifd>@6RzVCJc`HgI4o$!6L=C&;b}aB z8+aDa;d#7(7x5Bq;$^&oSMeHN#~XMPZ{cmcgLm;B-p2>{5Fg7(>jf|Pzruo9w#D*crK%0MMd30DRwgOvznh%!_erbH^kl_+I|GEy0(j8>wR7-fty zRvD+nD&v(2N}MuLnWRis;*}}NRAriypiEb0C^MB=%4}thGFO?WBr5Zj1xk{#P)Sx& zlvE{6NmmvriXioNigH!CW?Cv@8_hd6 z{6cll>#}FK-Mi&zWtb_xhLw$BSn(J};?Ww{CNn%FCqM1KZ%AfVaz;{iun`d!9aj`} tGqA+(VR^2VN9g@ZpJtD0ztjiu4haqRdH$tdZcV1e%k8>ZmCSsG@h?&ct=<3t diff --git a/CodeScanner/Scripts/build_opencv.sh b/CodeScanner/Scripts/build_opencv.sh index 546f02f6d..bcd3cae4a 100755 --- a/CodeScanner/Scripts/build_opencv.sh +++ b/CodeScanner/Scripts/build_opencv.sh @@ -81,6 +81,35 @@ check_dependencies() { # Check cmake version (need 3.18.5+) CMAKE_VERSION=$(cmake --version | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+') log "Found cmake version: $CMAKE_VERSION" + + check_sdk_version +} + +# The App Store rejects any binary whose LC_BUILD_VERSION sdk exceeds the newest +# released SDK (ITMS-90512), and the framework this script produces is committed +# and shipped as-is — so a beta Xcode here becomes a failed submission weeks +# later, long after the person who ran it has moved on. Refuse up front instead. +# +# Raise MAX_ALLOWED_SDK when Apple starts accepting a newer one; overriding via +# the environment is for the case where that has happened and this constant has +# not caught up yet. +MAX_ALLOWED_SDK="${MAX_ALLOWED_SDK:-26.5}" + +check_sdk_version() { + local sdk_version + sdk_version=$(xcrun --sdk iphoneos --show-sdk-version 2>/dev/null) || \ + error "Could not read the iphoneos SDK version from the active Xcode" + + log "Found iOS SDK version: $sdk_version" + + # Sort the two and see which lands last; equal versions are fine. + if [ "$sdk_version" != "$MAX_ALLOWED_SDK" ] && \ + [ "$(printf '%s\n%s\n' "$sdk_version" "$MAX_ALLOWED_SDK" | sort -V | tail -1)" = "$sdk_version" ]; then + error "Active Xcode has iOS SDK $sdk_version, above the App Store's maximum of $MAX_ALLOWED_SDK. + A framework built here would be rejected with ITMS-90512 (Invalid sdk value). + Switch to a release Xcode first: sudo xcode-select -s /Applications/Xcode_.app + Current: $(xcodebuild -version 2>/dev/null | head -1) at $(xcode-select -p)" + fi } get_latest_opencv_version() {