Merge branch 'main' into belt-printer

scripts/appimage_lib_policy.sh

@@ -23,7 +23,13 @@ appimage_is_host_library() {
 }
 
 appimage_is_elf_file() {
-    file -b "$1" 2>/dev/null | grep -q '^ELF '
+    # Read the four-byte ELF magic rather than asking file(1): this runs once per candidate, and an
+    # AppDir holds thousands of them (the bundled Python runtime alone is ~5k files, none of them
+    # ELF). Two processes per call made this ~14 s of a ~95 s image build on its own.
+    local magic
+    [[ -f "$1" && -r "$1" ]] || return 1
+    IFS= read -r -n 4 -d '' magic < "$1" 2>/dev/null
+    [[ $magic == $'\177ELF' ]]
 }
 
 appimage_list_direct_dependencies() {

scripts/clang_tidy_diff.py

@@ -311,11 +311,12 @@ def main():
         for path in fixed:
             print(f"    {path}")
     if failed and fixed:
-        print(f"\nclang-tidy still fails on {len(failed)} file(s); the findings above are what --fix could not add.")
+        print(f"\nclang-tidy still fails on {len(failed)} file(s); the findings above are what --fix could not fix.")
         return 1
     if failed:
         print(f"\nclang-tidy failed on {len(failed)} file(s). Add the includes it names, or apply its "
-              "suggestions locally with scripts/run_clang_tidy.sh --fix (scripts\\run_clang_tidy.ps1 -Fix on Windows).")
+              "suggestions locally with scripts/run_clang_tidy.sh --fix (scripts\\run_clang_tidy.ps1 -Fix on Windows). "
+              "Other findings need a manual fix.")
         return 1
     print("clang-tidy passed.")
     return 0

scripts/disable_validation.entitlements

@@ -4,5 +4,10 @@
 <dict>
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
+    <!-- The Bambu network plug-in's code protector rewrites one of its own signed code pages
+         after loading. Under the hardened runtime macOS kills the process when that page is
+         paged back in; this lets it run, as Bambu Studio's signature does. -->
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
 </dict>
 </plist>