Preserve entitlements in MacOS signer

[jtschuster]

Preserve entitlements in the manages Mach-O signer for both regular apphost and singlefilehost.

Adds entitlements to singlefilehost during the build.

Refactors the signature blob types to be classes that implement IBlob. The various named blobs derive from SimpleBlob or SuperBlob (except for CodeDirectoryBlob which is more complex). SimpleBlob and SuperBlob provide methods for accessing info about the blobs and writing to a file. IMachFile is used for writing to allow reading and writing from/to a Stream or MemoryMappedViewAccessor.

The CodeSignature class was replaced with just the EmbeddedSignatureBlob, a SuperBlob containing other relevant signature blobs. Methods from the CodeSignature class were move to the relevant blob class.

HostWriter.SetAsBundle was moved to the Bundle class to avoid having to remap the memory mapped file multiple times. Since the host destination stream is never closed between creating the bundle and SetAsBundle / Signing the bundle, we don't need to create a new copy with a new inode to sign and replace the existing bundle.

cc @dotnet/appmodel

[dotnet-policy-service]

Tagging subscribers to this area: @vitek-karas, @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull Request Overview

This PR refactors the Mach-O signing code to use class-based blob types, preserves entitlements (and DER entitlements) during signing, and streamlines how bundles and signatures are applied.

• Introduce new BlobMagic entries for Entitlements and DerEntitlements.
• Convert signature blob structs to an OO hierarchy (Blob, SimpleBlob, SuperBlob, etc.).
• Update Bundler and HostWriter to preserve existing entitlements and avoid remapping files unnecessarily.

Reviewed Changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.

File	Description
src/installer/managed/Microsoft.NET.HostModel/MachO/Enums/BlobMagic.cs	Add Entitlements and DerEntitlements magic constants.
src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/LinkEditCommand.cs	Rename struct to LinkEditLoadCommand.
src/installer/managed/Microsoft.NET.HostModel/Bundle/Bundler.cs	Refactor bundle creation to use streams and memory‐mapped file; preserve entitlements.
src/installer/managed/Microsoft.NET.HostModel/AppHost/HostWriter.cs	Consolidate signature handling and update method visibility.

Comments suppressed due to low confidence (3)

src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/LinkEditCommand.cs:15

• The file name 'LinkEditCommand.cs' no longer matches the updated struct name 'LinkEditLoadCommand'; consider renaming the file to 'LinkEditLoadCommand.cs' for consistency.

internal struct LinkEditLoadCommand

src/installer/managed/Microsoft.NET.HostModel/Bundle/Bundler.cs:281

• The 'relativePathToSpec' dictionary is declared but never used; consider removing this variable to clean up unused code.

var relativePathToSpec = new Dictionary<string, FileSpec>(StringComparer.Ordinal);

src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/Blobs/EmbeddedSignatureBlob.cs:170

• This new method for calculating signature size and preserving entitlements could benefit from dedicated unit tests to validate size calculations across scenarios, including with and without existing entitlements.

internal static unsafe long GetSignatureSize(uint fileSize, string identifier, EmbeddedSignatureBlob? existingSignature, byte? hashSize = null)

[jtschuster]

Superceded by #116566