From 651811cc090937457956643dd2c454df77eb141b Mon Sep 17 00:00:00 2001
From: J Logan <john_logan@apple.com>
Date: Mon, 27 Apr 2026 11:32:00 -0700
Subject: [PATCH] Fix "not installing shadowed plugin" startup log noise.
 (#1451)

- Closes #1450.
- If we require that bundle-packaged installs must populate a
Unix-structured `bin` and `libexec`, we don't need the code that
searches the app bundle install root. As it stands, we enumerate both
the app bundle and the Linux paths, meaning we're looking at the same
plugins (in different paths) twice.
---
 Package.swift                                      | 3 ---
 Sources/APIServer/APIServer+Start.swift            | 4 ----
 Sources/ContainerCommands/System/SystemStart.swift | 4 +++-
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/Package.swift b/Package.swift
index 17ecc14f..f4cad9e0 100644
--- a/Package.swift
+++ b/Package.swift
@@ -319,9 +319,6 @@ let package = Package(
             dependencies: [
                 .product(name: "ArgumentParser", package: "swift-argument-parser"),
                 .product(name: "Logging", package: "swift-log"),
-                .product(name: "GRPCCore", package: "grpc-swift-2"),
-                .product(name: "GRPCNIOTransportHTTP2", package: "grpc-swift-nio-transport"),
-                .product(name: "GRPCProtobuf", package: "grpc-swift-protobuf"),
                 .product(name: "Containerization", package: "containerization"),
                 "ContainerLog",
                 "ContainerPlugin",
diff --git a/Sources/APIServer/APIServer+Start.swift b/Sources/APIServer/APIServer+Start.swift
index b89283c9..991bab64 100644
--- a/Sources/APIServer/APIServer+Start.swift
+++ b/Sources/APIServer/APIServer+Start.swift
@@ -184,9 +184,6 @@ extension APIServer {
             _ = FileManager.default.fileExists(atPath: pluginsURL.path, isDirectory: &directoryExists)
             let userPluginsURL = directoryExists.boolValue ? pluginsURL : nil
 
-            // plugins built into the application installed as a macOS app bundle
-            let appBundlePluginsURL = Bundle.main.resourceURL?.appending(path: "plugins")
-
             // plugins built into the application installed as a Unix-like application
             let installRootPluginsURL =
                 installRoot
@@ -197,7 +194,6 @@ extension APIServer {
 
             let pluginDirectories = [
                 userPluginsURL,
-                appBundlePluginsURL,
                 installRootPluginsURL,
             ].compactMap { $0 }
 
diff --git a/Sources/ContainerCommands/System/SystemStart.swift b/Sources/ContainerCommands/System/SystemStart.swift
index 2fa7749f..f4dd37a7 100644
--- a/Sources/ContainerCommands/System/SystemStart.swift
+++ b/Sources/ContainerCommands/System/SystemStart.swift
@@ -72,7 +72,9 @@ extension Application {
         public init() {}
 
         public func run() async throws {
-            // Without the true path to the binary in the plist, `container-apiserver` won't launch properly.
+            // Resolve the symlink to get the true binary path before writing the launchd plist.
+            // Gatekeeper / amfid validates code signatures relative to the enclosing .app bundle
+            // hierarchy; launching via a symlink outside the bundle fails that check.
             // TODO: Can we use the plugin loader to bootstrap the API server?
             let executableUrl = CommandLine.executablePathUrl
                 .deletingLastPathComponent()