Verify signed LLDB-MI macOS artifacts

[Sean McManus (sean-mcmanus)]

Summary

Adds post-sign verification for the final macOS x86_64 and arm64 LLDB-MI archives. The verification checks the expected payload path and architecture, requires a valid strict non-ad-hoc code signature with an authority chain, confirms the debugger entitlements are unchanged, and proves a modified binary is rejected.

Both producers select native Python 3.11 because the pinned LLVM 13 build still requires distutils, which newer hosted-image Python versions no longer provide. The arm64 producer now uses the supported macOS-15-arm64 hosted image instead of the inactive private M1 pool. The pipeline explicitly selects each Python architecture, validates the PATH-selected interpreter before the expensive build, and binds LLVM's Python discovery to that interpreter and its sys.prefix.

The pinned LLVM source also receives three upstream compatibility fixes:

• 81fc5f7 removes obsolete duplicate C++ limit macros that current SWIG rejects while generating LLDB's Python wrapper.
• 73e15b5 includes the cstdio header where SBFile declares its FILE * constructor, as required by current Xcode headers.
• f0a25fe makes the FileSP output typemap compatible with SWIG 4.1 and later move semantics.

The pinned lldb-mi project declares a CMake 3.4 policy level. Its configure step now supplies CMake 4's documented external minimum policy version of 3.5 and exits immediately on configuration failure instead of falling through to a misleading missing build.ninja error.

Why

The build applies an ad-hoc signature to carry debugger entitlements before MicroBuild replaces it. A successful signing task alone does not prove that the published ZIP contains the intended replacement signature or that the entitlements survived signing and packaging. Verifying the final artifacts catches signing-target, packaging, and post-sign corruption regressions before release.

Validation

• Parsed the Azure Pipelines templates and validated both architecture expansions and job dependencies.
• Previewed the final expanded pipeline with native x64/arm64 Python 3.11 selection, all three exact LLVM backports, CMake 4 policy handling, and both post-sign verification steps.
• Ran bash -n and ShellCheck on the expanded validation scripts and compatibility blocks.
• Ran git diff --check.
• Non-release pipeline run 20260825.9 is validating both final signed artifacts on the current merged result.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

[Copilot]

Pull request overview

Adds post-sign validation for packaged macOS LLDB-MI artifacts.

Changes:

• Names the signing job and adds a dependent verification job.
• Validates archive layout, architecture, signature chain, entitlements, and tamper rejection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.