Verify signed LLDB-MI macOS artifacts

[Sean McManus (sean-mcmanus)]

Summary

Adds post-sign verification for the final macOS x86_64 and arm64 LLDB-MI archives. The verification checks the expected payload path and architecture, requires a valid strict non-ad-hoc code signature with an authority chain, confirms the debugger entitlements are unchanged, and proves a modified binary is rejected.

The production pipeline is restricted to successful builds from refs/heads/main. Feature and pull-request refs cannot run its producer, signing, or post-sign verification stages.

The dormant producers are updated for maintained hosted environments: native Python 3.11 on macOS-15 and macOS-15-arm64, CMake 4 policy compatibility, and targeted compatibility updates for pinned LLVM 13 and current SWIG.

Why

The build applies an ad-hoc signature to carry debugger entitlements before MicroBuild replaces it. A successful signing task alone does not prove that the published ZIP contains the intended replacement signature or that the entitlements survived signing and packaging. Verifying the final artifacts catches signing-target, packaging, and post-sign corruption regressions before release.

Production signing is not valid PR validation. The signing and post-sign checks therefore run only after reviewed code reaches main; branch review relies on static pipeline validation and the repository's ordinary GitHub checks.

Compatibility

• 81fc5f7 removes obsolete duplicate C++ limit macros rejected by current SWIG.
• 73e15b5 includes the cstdio header required by current Xcode headers.
• f0a25fe updates the FileSP output typemap for SWIG 4.1 and later move semantics.
• Guarded transformations based on 984354f replace Python 2 PyInt_* APIs with Python 3 PyLong_* APIs and require that none remain.

Validation

• Parsed the Azure Pipelines templates and validated both architecture expansions and job dependencies.
• Exercised the guarded Python 3 migration against the actual pinned LLVM binding files.
• Previewed the current pipeline through Azure and verified that both production stages require refs/heads/main while post-sign verification still depends on signing.
• Verified both producer architectures through unsigned artifact publication during investigation; no production signing result is claimed for the PR branch.
• Ran bash -n, ShellCheck, and git diff --check.

Post-sign validation remains intentionally deferred to the first trusted main run containing this change.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

[Copilot]

Pull request overview

Adds post-sign validation for packaged macOS LLDB-MI artifacts.

Changes:

• Names the signing job and adds a dependent verification job.
• Validates archive layout, architecture, signature chain, entitlements, and tamper rejection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.