Verify signed LLDB-MI macOS artifacts

[Sean McManus (sean-mcmanus)]

Summary

Adds post-sign verification for the final macOS x86_64 and arm64 LLDB-MI archives. The verification checks the expected payload path and architecture, requires a valid strict non-ad-hoc code signature with an authority chain, confirms the debugger entitlements are unchanged, and proves a modified binary is rejected.

Both producers select native Python 3.11 because the pinned LLVM 13 build still requires distutils, which newer hosted-image Python versions no longer provide. The arm64 producer now uses the supported macOS-15-arm64 hosted image instead of the inactive private M1 pool. The pipeline explicitly selects each Python architecture, validates the PATH-selected interpreter before the expensive build, and binds LLVM's Python discovery to that interpreter and its sys.prefix.

The pinned LLVM source also receives compatibility updates for current tools:

• 81fc5f7 removes obsolete duplicate C++ limit macros that current SWIG rejects while generating LLDB's Python wrapper.
• 73e15b5 includes the cstdio header where SBFile declares its FILE * constructor, as required by current Xcode headers.
• f0a25fe makes the FileSP output typemap compatible with SWIG 4.1 and later move semantics.
• Guarded transformations based on 984354f replace the pinned bindings' Python 2 PyInt_* APIs with Python 3 PyLong_* APIs and require that no PyInt_* references remain. This supports SWIG 4.5, which removed those compatibility aliases.

The pinned lldb-mi project declares a CMake 3.4 policy level. Its configure step supplies CMake 4's documented external minimum policy version of 3.5 and exits immediately on configuration failure instead of falling through to a misleading missing build.ninja error.

The signing job uses the active Windows MicroBuild pool used by current cpptools release pipelines. The legacy queue rejected this pipeline's authorization check after both unsigned artifacts had built successfully, preventing either signing or verification from starting.

Why

The build applies an ad-hoc signature to carry debugger entitlements before MicroBuild replaces it. A successful signing task alone does not prove that the published ZIP contains the intended replacement signature or that the entitlements survived signing and packaging. Verifying the final artifacts catches signing-target, packaging, and post-sign corruption regressions before release.

Validation

• Parsed the Azure Pipelines templates and validated both architecture expansions and job dependencies.
• Exercised the guarded Python 3 migration against the actual pinned LLVM binding files and verified no PyInt_* APIs remain.
• Previewed the final expanded pipeline with native x64/arm64 Python 3.11 selection, LLVM compatibility updates, CMake 4 policy handling, the active Windows signing pool, and both post-sign verification steps.
• Ran bash -n, ShellCheck, and git diff --check.
• Non-release pipeline run 20260901.2 is validating both final signed artifacts on the current merged result.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

[Copilot]

Pull request overview

Adds post-sign validation for packaged macOS LLDB-MI artifacts.

Changes:

• Names the signing job and adds a dependent verification job.
• Validates archive layout, architecture, signature chain, entitlements, and tamper rejection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.