Upload diagnostic.sh

diagnostic.sh

@@ -105,20 +105,60 @@ if [ -d "$MEDIACORE_PATH" ]; then
         plugin_name=$(basename "$plugin_bundle" .plugin)
         plugin_modified=$(stat -f "%Sm" -t "%Y-%m-%d %H:%M" "$plugin_bundle" 2>/dev/null || echo "unknown")
         plugin_size=$(du -sh "$plugin_bundle" 2>/dev/null | cut -f1 || echo "?")
+        plugin_perms=$(stat -f "%Sp" "$plugin_bundle" 2>/dev/null || echo "?")
+        plugin_owner=$(stat -f "%Su:%Sg" "$plugin_bundle" 2>/dev/null || echo "?")
 
         # Check if binary exists
         binary_path="$plugin_bundle/Contents/MacOS/$plugin_name"
         if [ -f "$binary_path" ]; then
             arch=$(lipo -archs "$binary_path" 2>/dev/null || echo "?")
-            log "$PASS $plugin_name"
+            binary_perms=$(stat -f "%Sp" "$binary_path" 2>/dev/null || echo "?")
+
+            # Check code signing
+            codesign_check=$(codesign -dv --verbose=2 "$plugin_bundle" 2>&1)
+            if echo "$codesign_check" | grep -q "Authority="; then
+                signer=$(echo "$codesign_check" | grep "Authority=" | head -1 | cut -d= -f2 | cut -c1-40)
+                sign_status="$PASS"
+            elif echo "$codesign_check" | grep -q "Signature=adhoc"; then
+                signer="ad-hoc"
+                sign_status="$WARN"
+            elif echo "$codesign_check" | grep -q "TeamIdentifier="; then
+                # Signed but no Authority line (Developer ID)
+                team=$(echo "$codesign_check" | grep "TeamIdentifier=" | cut -d= -f2)
+                signer="Team: $team"
+                sign_status="$PASS"
+            else
+                signer="unsigned"
+                sign_status="$FAIL"
+            fi
+
+            # Check notarization
+            if echo "$codesign_check" | grep -q "Notarization Ticket"; then
+                notarized="yes"
+            else
+                notarized="no"
+            fi
+
+            # Check quarantine
+            quarantine_check=$(xattr -p com.apple.quarantine "$plugin_bundle" 2>/dev/null)
+            if [ -n "$quarantine_check" ]; then
+                qflag="$WARN quarantined"
+            else
+                qflag=""
+            fi
+
+            log "$sign_status $plugin_name $qflag"
             log "      Modified: $plugin_modified | Size: $plugin_size | Arch: $arch"
+            log "      Perms: $plugin_perms | Binary: $binary_perms | Owner: $plugin_owner"
+            log "      Signed: $signer | Notarized: $notarized"
         else
             log "$WARN $plugin_name (binary missing)"
             log "      Modified: $plugin_modified | Size: $plugin_size"
+            log "      Perms: $plugin_perms | Owner: $plugin_owner"
         fi
+        log ""
     done < <(find "$MEDIACORE_PATH" -maxdepth 2 -name "*.plugin" -type d 2>/dev/null | sort)
 
-    log ""
     log "Total plugins found: $PLUGIN_COUNT"
 else
     log "$WARN MediaCore directory not found: $MEDIACORE_PATH"
@@ -402,7 +442,7 @@ print_section "File Permissions & Ownership"
 PERM_ISSUES=0
 CURRENT_USER=$(whoami)
 
-log "${BLUE}Expected: owner=root or current user, readable by all${NC}"
+log "${BLUE}All files in plugin bundle:${NC}"
 log ""
 
 # Check each file and directory
@@ -417,58 +457,33 @@ while IFS= read -r item; do
     REL_PATH="${item#$PLUGIN_PATH}"
     [ -z "$REL_PATH" ] && REL_PATH="/"
 
+    # Determine status icon
+    HAS_ISSUE=0
+
     # Check if it's a directory or file
     if [ -d "$item" ]; then
         ITEM_TYPE="d"
         # Directories should be readable and executable (r-x) by all
         if [[ "$PERMS" != d*r?x*r?x*r?x* ]] && [[ "$PERMS" != d*r?x*r?x* ]]; then
-            # Check if at least owner can read/execute
-            if [[ "$PERMS" == d*r?x* ]]; then
-                # Owner can access, check if current user is owner
-                if [ "$OWNER" != "$CURRENT_USER" ] && [ "$OWNER" != "root" ]; then
-                    log "$WARN $REL_PATH"
-                    log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
-                    log "      ${YELLOW}May not be accessible to After Effects${NC}"
-                    PERM_ISSUES=$((PERM_ISSUES + 1))
-                fi
-            else
-                log "$FAIL $REL_PATH"
-                log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
-                log "      ${RED}Directory not readable/executable${NC}"
-                PERM_ISSUES=$((PERM_ISSUES + 1))
-            fi
+            HAS_ISSUE=1
         fi
     else
-        ITEM_TYPE="f"
-        # Files should be readable by all, executable if binary
-        FILENAME=$(basename "$item")
-
-        # Check if file is readable
+        # Files should be readable
         if [[ "$PERMS" != -*r* ]]; then
-            log "$FAIL $REL_PATH"
-            log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
-            log "      ${RED}File not readable${NC}"
-            PERM_ISSUES=$((PERM_ISSUES + 1))
+            HAS_ISSUE=1
         fi
-
         # Binary should be executable
-        if [ "$item" = "$BINARY_PATH" ]; then
-            if [[ "$PERMS" != -*x* ]]; then
-                log "$FAIL $REL_PATH"
-                log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
-                log "      ${RED}Binary not executable${NC}"
-                PERM_ISSUES=$((PERM_ISSUES + 1))
-            fi
+        if [ "$item" = "$BINARY_PATH" ] && [[ "$PERMS" != -*x* ]]; then
+            HAS_ISSUE=1
         fi
     fi
 
-    # Check for unusual owners (not root, not current user, not wheel/admin)
-    if [ "$OWNER" != "root" ] && [ "$OWNER" != "$CURRENT_USER" ] && [ "$OWNER" != "wheel" ]; then
-        # Only warn if we haven't already flagged this item
-        if [ $PERM_ISSUES -eq 0 ] || ! echo "$item" | grep -q "flagged"; then
-            log "$INFO $REL_PATH"
-            log "      Owner: $OWNER:$GROUP (unusual)"
-        fi
+    # Always show the file with its permissions
+    if [ $HAS_ISSUE -eq 1 ]; then
+        log "$FAIL $PERMS $OWNER:$GROUP $REL_PATH"
+        PERM_ISSUES=$((PERM_ISSUES + 1))
+    else
+        log "$PASS $PERMS $OWNER:$GROUP $REL_PATH"
     fi
 
 done < <(find "$PLUGIN_PATH" -print 2>/dev/null)