Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add kernel critical extension bypass #501

Merged
merged 1 commit into from
Nov 8, 2024

Conversation

tecimovic
Copy link
Contributor

The certificate files I got from Apple for my project also contain another critical extension: "devid_kernel".
I added a bypass for it, same way as there was previously there a bypass for "devid_execute".

@tecimovic
Copy link
Contributor Author

@wagoodman : I can't seem to "request review by reviewers"....

Are you guys actually maintaining this as an open-source thingy, accepting PRs? Is there a chance of my change ending on the mainline?

I ask because:
1.) If the answer is yes, then I can just wait for you to accept/merge this in, and keep using curl from the main upstream, killing my fork.
2.) If the answer is no, then I'll rework my CI to use my fork, which has a tiny commit on it that I really need.

Either way is ok, I'd obviously prefer to not rely on my fork, if I don't have to, but not a big deal......

@spiffcs
Copy link
Contributor

spiffcs commented Oct 17, 2024

@tecimovic this LGTM I think the only thing we need left here is is sign off for the DCO check:

In your local branch, run: git rebase HEAD~1 --signoff
Force push your changes to overwrite the branch: git push --force-with-lease <your-base>

If you get that fixed I can then get this 🟢 and merged

@tecimovic
Copy link
Contributor Author

@spiffcs Thank you!

I did all that now, I think it's now just complaining about the "approving review".
Much appreciated!

@spiffcs
Copy link
Contributor

spiffcs commented Oct 17, 2024

Nice - looks like this is just blocked on #500 -- I'll see if I can ask @wagoodman today, but he's got a lot going on right now. If I have some spare cycles I can also look at the PR that fixes these fixtures

@tecimovic
Copy link
Contributor Author

Thank you, much appreciated! Also a lot of thanks to having this project in the first place! The whole thing of "You need a Mac to sign things for a Mac" was terribly annoying in my world for many years.....

I'll be happy to pick this up as soon as it merges, and my urgency is NOT on the "TODAY!" scale. No problem waiting for few days... Nobody needs to loose sleep today over it! :)

@wagoodman wagoodman added enhancement New feature or request and removed blocked labels Nov 8, 2024
Copy link
Contributor

@wagoodman wagoodman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I confirmed the additional oid from http://www.apple.com/certificateauthority/Apple_Developer_ID_CPS/

Signed-off-by: Timotej Ecimovic <[email protected]>
Signed-off-by: Timotej Ecimovic <[email protected]>
@wagoodman
Copy link
Contributor

forced pushed a rebase since the test fixtures have been fixed 🎉

@wagoodman wagoodman enabled auto-merge (squash) November 8, 2024 17:52
@wagoodman wagoodman changed the title Add another critical extension bypass. Add kernel critical extension bypass Nov 8, 2024
@wagoodman wagoodman merged commit 08c622f into anchore:main Nov 8, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants