mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
_verify_bundle_linkage's host-library scan only matched files by .so/.dylib name suffix, so a shipped executable (Contents/MacOS/*) or a Python.framework payload with a host-linked dependency but no matching suffix could slip through unchecked — the same class of bug #10135 was added to catch. Detect Mach-O executables/libraries by content via `file` instead (same pattern the codesign step in this file already uses), regardless of extension or executable permission bits, so readable non-executable dylibs are covered too.