Codesign fixes and notarization support #307
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes both having no entitlements file and signing the wrong path in `codesign` fixes fvarrui#306
Also rework codesigning to follow the same pattern as jpackage, which matches the official guidelines of only explicitly signing executable code (dylibs and executables), properly wrapping the jdk in a macOS bundle, and only attaching entitlements/hardened runtime to executables. This combination of changes ensures that signing works even without preserving filesystem extended attributes, as tends to happen when zipping application bundles, because Mach-O files have signatures embedded in the file contents whereas all other file types have their signatures stored in FS extended attributes. (Non-code files do get signed, but only through the manifest on the bundle itself so the file doesn't need modification.) This has been tested on a clean macOS 13.2.1 VM that has gatekeeper using its default settings. The VM was disconnected from the internet after downloading to validate the notarization and stapling. The user is prompted to confirm opening an application that came from the internet, as one is with any properly signed and notarized application that was downloaded from the internet. fixes fvarrui#286
|
Hi @maths22! |
|
Dear guys, |
|
Hi @treimers!!! |
|
Hi @fvarrui, |
|
Ok, it helped with our problem under Mac OS Catalina with error: Thank you very much guys! I am getting several error message during build Maybe ERROR in the output means that the message is written to "stderr"? Do you get these messages also? But good news are that it is working finally. Thanks! |
|
Best I can tell, |
|
Ah ok, thanks. I did understand now that [ERROR] is the log level. So these warnings are written with level "error". |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes both having no entitlements file and signing the wrong path
in
codesign.Add support for notarization.
Also rework codesigning to follow the same pattern as jpackage,
which matches the official guidelines of only explicitly signing
executable code (dylibs and executables), properly wrapping the jdk
in a macOS bundle, and only attaching entitlements/hardened runtime
to executables. This combination of changes ensures that signing
works even without preserving filesystem extended attributes, as
tends to happen when zipping application bundles, because Mach-O
files have signatures embedded in the file contents whereas all
other file types have their signatures stored in FS extended
attributes. (Non-code files do get signed, but only through the
manifest on the bundle itself so the file doesn't need
modification.)
This has been tested on a clean macOS 13.2.1 VM that has gatekeeper
using its default settings. The VM was disconnected from the
internet after downloading to validate the notarization and
stapling. The user is prompted to confirm opening an application
that came from the internet, as one is with any properly signed
and notarized application that was downloaded from the internet.
fixes #306
fixes #286