Preserve entitlements in MacOS signer

src/installer/managed/Microsoft.NET.HostModel/AppHost/HostWriter.cs

@@ -151,12 +151,12 @@ void RewriteAppHost(MemoryMappedFile mappedFile, MemoryMappedViewAccessor access
                             RewriteAppHost(memoryMappedFile, memoryMappedViewAccessor);
                             if (isMachOImage)
                             {
+                                MachObjectFile machObjectFile = MachObjectFile.Create(memoryMappedViewAccessor);
                                 if (enableMacOSCodeSign)
                                 {
-                                    MachObjectFile machObjectFile = MachObjectFile.Create(memoryMappedViewAccessor);
-                                    appHostLength = machObjectFile.CreateAdHocSignature(memoryMappedViewAccessor, destinationFileName);
+                                    appHostLength = machObjectFile.AdHocSignFile(memoryMappedViewAccessor, destinationFileName);
                                 }
-                                else if (MachObjectFile.RemoveCodeSignatureIfPresent(memoryMappedViewAccessor, out long? length))
+                                else if (machObjectFile.RemoveCodeSignatureIfPresent(memoryMappedViewAccessor, out long? length))
                                 {
                                     appHostLength = length.Value;
                                 }
@@ -190,84 +190,6 @@ void RewriteAppHost(MemoryMappedFile mappedFile, MemoryMappedViewAccessor access
             }
         }
 
-        /// <summary>
-        /// Set the current AppHost as a single-file bundle.
-        /// </summary>
-        /// <param name="appHostPath">The path of Apphost template, which has the place holder</param>
-        /// <param name="bundleHeaderOffset">The offset to the location of bundle header</param>
-        /// <param name="macosCodesign">Whether to ad-hoc sign the bundle as a Mach-O executable</param>
-        public static void SetAsBundle(
-            string appHostPath,
-            long bundleHeaderOffset,
-            bool macosCodesign = false)
-        {
-            byte[] bundleHeaderPlaceholder = {
-                // 8 bytes represent the bundle header-offset
-                // Zero for non-bundle apphosts (default).
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                // 32 bytes represent the bundle signature: SHA-256 for ".net core bundle"
-                0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38,
-                0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32,
-                0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18,
-                0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae
-            };
-
-            // Re-write the destination apphost with the proper contents.
-            RetryUtil.RetryOnIOError(() =>
-            {
-                string tmpFile = null;
-                try
-                {
-                    // MacOS keeps a cache of file signatures. To avoid using the cached value,
-                    // we need to create a new inode with the contents of the old file, sign it,
-                    // and copy it the original file path.
-                    tmpFile = Path.GetTempFileName();
-                    using (FileStream newBundleStream = new FileStream(tmpFile, FileMode.Create, FileAccess.ReadWrite))
-                    {
-                        using (FileStream oldBundleStream = new FileStream(appHostPath, FileMode.Open, FileAccess.Read))
-                        {
-                            oldBundleStream.CopyTo(newBundleStream);
-                        }
-
-                        long bundleSize = newBundleStream.Length;
-                        long mmapFileSize = macosCodesign
-                            ? bundleSize + MachObjectFile.GetSignatureSizeEstimate((uint)bundleSize, Path.GetFileName(appHostPath))
-                            : bundleSize;
-                        using (MemoryMappedFile memoryMappedFile = MemoryMappedFile.CreateFromFile(newBundleStream, null, mmapFileSize, MemoryMappedFileAccess.ReadWrite, HandleInheritability.None, leaveOpen: true))
-                        using (MemoryMappedViewAccessor accessor = memoryMappedFile.CreateViewAccessor(0, 0, MemoryMappedFileAccess.ReadWrite))
-                        {
-                            BinaryUtils.SearchAndReplace(accessor,
-                                                        bundleHeaderPlaceholder,
-                                                        BitConverter.GetBytes(bundleHeaderOffset),
-                                                        pad0s: false);
-
-                            if (MachObjectFile.IsMachOImage(accessor))
-                            {
-                                var machObjectFile = MachObjectFile.Create(accessor);
-                                if (machObjectFile.HasSignature)
-                                    throw new AppHostMachOFormatException(MachOFormatError.SignNotRemoved);
-
-                                bool wasBundled = machObjectFile.TryAdjustHeadersForBundle((ulong)bundleSize, accessor);
-                                if (!wasBundled)
-                                    throw new InvalidOperationException("The single-file bundle was unable to be created. This is likely because the bundled content is too large.");
-
-                                if (macosCodesign)
-                                    bundleSize = machObjectFile.CreateAdHocSignature(accessor, Path.GetFileName(appHostPath));
-                            }
-                        }
-                        newBundleStream.SetLength(bundleSize);
-                    }
-                    File.Copy(tmpFile, appHostPath, overwrite: true);
-                    Chmod755(appHostPath);
-                }
-                finally
-                {
-                    if (tmpFile is not null)
-                        File.Delete(tmpFile);
-                }
-            });
-        }
-
         /// <summary>
         /// Check if the an AppHost is a single-file bundle
         /// </summary>
@@ -331,7 +253,7 @@ private static byte[] GetSearchOptionBytes(DotNetSearchOptions searchOptions)
             return searchOptionsBytes;
         }
 
-        private static void Chmod755(string pathName)
+        internal static void Chmod755(string pathName)
         {
             if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
                 return;

src/installer/managed/Microsoft.NET.HostModel/AssemblyAttributes.cs

@@ -14,3 +14,14 @@
         + "398c454307e8e33b8426143daec9f596"
         + "836f97c8f74750e5975c64e2189f45de"
         + "f46b2a2b1247adc3652bf5c308055da9")]
+[assembly: InternalsVisibleTo("HostActivation.Tests, PublicKey="
+        + "00240000048000009400000006020000"
+        + "00240000525341310004000001000100"
+        + "b5fc90e7027f67871e773a8fde8938c8"
+        + "1dd402ba65b9201d60593e96c492651e"
+        + "889cc13f1415ebb53fac1131ae0bd333"
+        + "c5ee6021672d9718ea31a8aebd0da007"
+        + "2f25d87dba6fc90ffd598ed4da35e44c"
+        + "398c454307e8e33b8426143daec9f596"
+        + "836f97c8f74750e5975c64e2189f45de"
+        + "f46b2a2b1247adc3652bf5c308055da9")]

src/installer/managed/Microsoft.NET.HostModel/Bundle/Bundler.cs

@@ -13,6 +13,7 @@
 using System.Text;
 using Microsoft.NET.HostModel.AppHost;
 using Microsoft.NET.HostModel.MachO;
+#nullable enable
 
 namespace Microsoft.NET.HostModel.Bundle
 {
@@ -42,9 +43,9 @@ public Bundler(string hostName,
                        BundleOptions options = BundleOptions.None,
                        OSPlatform? targetOS = null,
                        Architecture? targetArch = null,
-                       Version targetFrameworkVersion = null,
+                       Version? targetFrameworkVersion = null,
                        bool diagnosticOutput = false,
-                       string appAssemblyName = null,
+                       string? appAssemblyName = null,
                        bool macosCodesign = true)
         {
             _tracer = new Trace(diagnosticOutput);
@@ -182,7 +183,7 @@ private static bool IsAssembly(string path, out bool isPE)
                 try
                 {
                     PEReader peReader = new PEReader(file);
-                    CorHeader corHeader = peReader.PEHeaders.CorHeader;
+                    CorHeader? corHeader = peReader.PEHeaders.CorHeader;
 
                     isPE = true; // If peReader.PEHeaders doesn't throw, it is a valid PEImage
                     return corHeader != null;
@@ -273,80 +274,149 @@ public string GenerateBundle(IReadOnlyList<FileSpec> fileSpecs)
                 _tracer.Log($"Ovewriting existing File {bundlePath}");
             }
 
-            BinaryUtils.CopyFile(hostSource, bundlePath);
-
-            // Note: We're comparing file paths both on the OS we're running on as well as on the target OS for the app
-            // We can't really make assumptions about the file systems (even on Linux there can be case insensitive file systems
-            // and vice versa for Windows). So it's safer to do case sensitive comparison everywhere.
-            var relativePathToSpec = new Dictionary<string, FileSpec>(StringComparer.Ordinal);
-
             long headerOffset = 0;
-            using (FileStream bundle = File.Open(bundlePath, FileMode.Open, FileAccess.ReadWrite))
-            using (BinaryWriter writer = new BinaryWriter(bundle, Encoding.Default, leaveOpen: true))
+            string destinationDirectory = new FileInfo(bundlePath).Directory?.FullName ?? "";
+            if (!Directory.Exists(destinationDirectory))
             {
-                if (_target.IsOSX)
+                Directory.CreateDirectory(destinationDirectory);
+            }
+            using (FileStream bundleStream = File.Open(bundlePath, FileMode.Create, FileAccess.ReadWrite))
+            {
+                using (FileStream hostSourceStream = File.OpenRead(hostSource))
                 {
-                    MachObjectFile.RemoveCodeSignatureIfPresent(bundle);
+                    hostSourceStream.CopyTo(bundleStream);
                 }
-                bundle.Position = bundle.Length;
-                foreach (var fileSpec in fileSpecs)
+                EmbeddedSignatureBlob? signatureBlob = null;
+                if (_target.IsOSX)
                 {
-                    string relativePath = fileSpec.BundleRelativePath;
-
-                    if (IsHost(relativePath))
+                    long? newLength = null;
+                    using (MemoryMappedFile bundleMap = MemoryMappedFile.CreateFromFile(bundleStream, null, bundleStream.Length, MemoryMappedFileAccess.ReadWrite, HandleInheritability.None, leaveOpen: true))
+                    using (MemoryMappedViewAccessor viewAccessor = bundleMap.CreateViewAccessor())
                     {
-                        continue;
+                        MachObjectFile file = MachObjectFile.Create(viewAccessor);
+                        signatureBlob = file.EmbeddedSignatureBlob;
+                        file.RemoveCodeSignatureIfPresent(viewAccessor, out newLength);
                     }
-
-                    if (ShouldIgnore(relativePath))
+                    if (newLength.HasValue)
                     {
-                        _tracer.Log($"Ignore: {relativePath}");
-                        continue;
+                        bundleStream.SetLength(newLength.Value);
                     }
+                }
+                using (BinaryWriter writer = new BinaryWriter(bundleStream, Encoding.Default, leaveOpen: true))
+                {
+                    // Note: We're comparing file paths both on the OS we're running on as well as on the target OS for the app
+                    // We can't really make assumptions about the file systems (even on Linux there can be case insensitive file systems
+                    // and vice versa for Windows). So it's safer to do case sensitive comparison everywhere.
+                    var relativePathToSpec = new Dictionary<string, FileSpec>(StringComparer.Ordinal);
+                    bundleStream.Position = bundleStream.Length;
+                    foreach (var fileSpec in fileSpecs)
+                    {
+                        string relativePath = fileSpec.BundleRelativePath;
 
-                    FileType type = InferType(fileSpec);
+                        if (IsHost(relativePath))
+                        {
+                            continue;
+                        }
 
-                    if (ShouldExclude(type, relativePath))
-                    {
-                        _tracer.Log($"Exclude [{type}]: {relativePath}");
-                        fileSpec.Excluded = true;
-                        continue;
-                    }
+                        if (ShouldIgnore(relativePath))
+                        {
+                            _tracer.Log($"Ignore: {relativePath}");
+                            continue;
+                        }
 
-                    if (relativePathToSpec.TryGetValue(fileSpec.BundleRelativePath, out var existingFileSpec))
-                    {
-                        if (!string.Equals(fileSpec.SourcePath, existingFileSpec.SourcePath, StringComparison.Ordinal))
+                        FileType type = InferType(fileSpec);
+
+                        if (ShouldExclude(type, relativePath))
                         {
-                            throw new ArgumentException($"Invalid input specification: Found entries '{fileSpec.SourcePath}' and '{existingFileSpec.SourcePath}' with the same BundleRelativePath '{fileSpec.BundleRelativePath}'");
+                            _tracer.Log($"Exclude [{type}]: {relativePath}");
+                            fileSpec.Excluded = true;
+                            continue;
                         }
 
-                        // Exact duplicate - intentionally skip and don't include a second copy in the bundle
-                        continue;
-                    }
-                    else
-                    {
-                        relativePathToSpec.Add(fileSpec.BundleRelativePath, fileSpec);
-                    }
+                        if (relativePathToSpec.TryGetValue(fileSpec.BundleRelativePath, out var existingFileSpec))
+                        {
+                            if (!string.Equals(fileSpec.SourcePath, existingFileSpec.SourcePath, StringComparison.Ordinal))
+                            {
+                                throw new ArgumentException($"Invalid input specification: Found entries '{fileSpec.SourcePath}' and '{existingFileSpec.SourcePath}' with the same BundleRelativePath '{fileSpec.BundleRelativePath}'");
+                            }
 
-                    using (FileStream file = File.OpenRead(fileSpec.SourcePath))
-                    {
-                        FileType targetType = _target.TargetSpecificFileType(type);
-                        (long startOffset, long compressedSize) = AddToBundle(bundle, file, targetType);
-                        FileEntry entry = BundleManifest.AddEntry(targetType, file, relativePath, startOffset, compressedSize, _target.BundleMajorVersion);
-                        _tracer.Log($"Embed: {entry}");
+                            // Exact duplicate - intentionally skip and don't include a second copy in the bundle
+                            continue;
+                        }
+                        else
+                        {
+                            relativePathToSpec.Add(fileSpec.BundleRelativePath, fileSpec);
+                        }
+
+                        using (FileStream file = File.OpenRead(fileSpec.SourcePath))
+                        {
+                            FileType targetType = _target.TargetSpecificFileType(type);
+                            (long startOffset, long compressedSize) = AddToBundle(bundleStream, file, targetType);
+                            FileEntry entry = BundleManifest.AddEntry(targetType, file, relativePath, startOffset, compressedSize, _target.BundleMajorVersion);
+                            _tracer.Log($"Embed: {entry}");
+                        }
                     }
+
+                    // Write the bundle manifest
+                    headerOffset = BundleManifest.Write(writer);
+                    _tracer.Log($"Header Offset={headerOffset}");
+                    _tracer.Log($"Meta-data Size={writer.BaseStream.Position - headerOffset}");
+                    _tracer.Log($"Bundle: Path={bundlePath}, Size={bundleStream.Length}");
                 }
 
-                // Write the bundle manifest
-                headerOffset = BundleManifest.Write(writer);
-                _tracer.Log($"Header Offset={headerOffset}");
-                _tracer.Log($"Meta-data Size={writer.BaseStream.Position - headerOffset}");
-                _tracer.Log($"Bundle: Path={bundlePath}, Size={bundle.Length}");
+                var bundleName = Path.GetFileName(bundlePath);
+                SetAsBundle(bundleName, bundleStream, headerOffset, signatureBlob);
+
+                HostWriter.Chmod755(bundlePath);
+
+                return bundlePath;
             }
+        }
 
-            HostWriter.SetAsBundle(bundlePath, headerOffset, _macosCodesign);
+        private void SetAsBundle(string bundleName, FileStream bundleStream, long headerOffset, EmbeddedSignatureBlob? signatureBlob)
+        {
+
+            byte[] bundleHeaderPlaceholder = {
+                    // 8 bytes represent the bundle header-offset
+                    // Zero for non-bundle apphosts (default).
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    // 32 bytes represent the bundle signature: SHA-256 for ".net core bundle"
+                    0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38,
+                    0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32,
+                    0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18,
+                    0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae
+                };
+            long bundleSize = bundleStream.Length;
+            long signedSize = bundleSize + MachObjectFile.GetSignatureSizeEstimate((uint)bundleSize, bundleName);
+            bundleStream.SetLength(signedSize);
+
+            // Re-write the destination apphost with the proper contents.
+            RetryUtil.RetryOnIOError(() =>
+            {
+                using (MemoryMappedFile bundleMap = MemoryMappedFile.CreateFromFile(bundleStream, null, bundleStream.Length, MemoryMappedFileAccess.ReadWrite, HandleInheritability.None, leaveOpen: true))
+                using (MemoryMappedViewAccessor accessor = bundleMap.CreateViewAccessor(0, 0, MemoryMappedFileAccess.ReadWrite))
+                {
+                    BinaryUtils.SearchAndReplace(accessor,
+                                                bundleHeaderPlaceholder,
+                                                BitConverter.GetBytes(headerOffset),
+                                                pad0s: false);
+
+                    if (_target.IsOSX)
+                    {
+                        var machObjectFile = MachObjectFile.Create(accessor);
+                        bool wasBundled = machObjectFile.TryAdjustHeadersForBundle((ulong)bundleSize, accessor);
+                        if (!wasBundled)
+                            throw new InvalidOperationException("The single-file bundle was unable to be created. This is likely because the bundled content is too large.");
+
+                        if (_macosCodesign)
+                        {
+                            signedSize = machObjectFile.AdHocSignFile(accessor, bundleName, signatureBlob);
+                        }
+                    }
+                }
+            });
 
-            return bundlePath;
+            bundleStream.SetLength(signedSize);
         }
     }
 }