Skip to content

Preserve entitlements in MacOS signer #115800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
jtschuster wants to merge 40 commits into from
Closed

Preserve entitlements in MacOS signer #115800

jtschuster wants to merge 40 commits into from

Conversation

@jtschuster
Copy link
Member

@jtschuster jtschuster commented May 20, 2025 •
edited
Loading

Preserve entitlements in the manages Mach-O signer for both regular apphost and singlefilehost.

Adds entitlements to singlefilehost during the build.

Refactors the signature blob types to be classes that implement IBlob. The various named blobs derive from SimpleBlob or SuperBlob (except for CodeDirectoryBlob which is more complex). SimpleBlob and SuperBlob provide methods for accessing info about the blobs and writing to a file. IMachFile is used for writing to allow reading and writing from/to a Stream or MemoryMappedViewAccessor.

The CodeSignature class was replaced with just the EmbeddedSignatureBlob, a SuperBlob containing other relevant signature blobs. Methods from the CodeSignature class were move to the relevant blob class.

HostWriter.SetAsBundle was moved to the Bundle class to avoid having to remap the memory mapped file multiple times. Since the host destination stream is never closed between creating the bundle and SetAsBundle / Signing the bundle, we don't need to create a new copy with a new inode to sign and replace the existing bundle.

cc @dotnet/appmodel

@jtschuster
Use managed signer for bundles
5800a18
@jtschuster
Fix tests and write out symtab
0555c08 
- Write out the updated symtab command when writing Mach-O file
- Pass macosCodesign through to test CreateAppHost methods
- Remove redundant `codesign` checks
- Warn when bundler is told to sign the bundle for a non-macos target
@jtschuster
Fix test failures
416e029 
- Allow macosCodesign to be true for non-mac bundles
- Allow some padding between string table and signature
@jtschuster
Flip comparison
81e5cf1
@jtschuster
Add comment to TryAdjustHeadersForBundle, and throw if it returns false
5dd384f
@jtschuster
Don't memory-map file if it's not a Mach-O, remove unused file.
031fe60
@jtschuster
Fix typo, restructure IsSigned check.
7ee6a45
@jtschuster
PR Feedback: Fomatting and comments
ec5b478
@jtschuster
PR feedback:
5c381c7 
- Use the same memory-mapped file instance for placeholder replacement
  and signing
- formatting changes
@jtschuster
Create new file for macos signing, update LINKEDIT.VMSize to fit sign…
e6fec41 
…ature
@jtschuster
Merge branch 'main' into ManagedSignBundles
11893bd
@jtschuster
Merge branch 'main' into ManagedSignBundles
c6d3c55
@jtschuster
PR feedback
163a8e1
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Managed…
443b151 
…SignBundles
@jtschuster
Remove old file that's not needed
32c8bb0
@jtschuster
Merge branch 'ManagedSignBundles' of https://github.com/jtschuster/ru…
d50db43 
…ntime into ManagedSignBundles
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Managed…
2b2f820 
…SignBundles
@jtschuster
Use constant for alignments
ef1cb02
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Managed…
c249fe5 
…SignBundles
@jtschuster
Wip
ae704e7
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Managed…
90834fa 
…SignBundles
@jtschuster
revert dotnet.sh
ca9532b
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Managed…
82834c6 
…SignBundles
@jtschuster
Wip
dbc3fe5
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Managed…
2b6446a 
…SignBundles
@jtschuster
Ensure entitlements are preserved
c79f117
@github-actions github-actions bot added the area-HostModel Microsoft.NET.HostModel issues label May 20, 2025
@dotnet-policy-service
Copy link
Contributor

dotnet-policy-service bot commented May 20, 2025

Tagging subscribers to this area: @vitek-karas, @agocke
See info in area-owners.md if you want to be subscribed.

@jtschuster jtschuster requested a review from Copilot May 20, 2025 20:09
@jtschuster jtschuster linked an issue Jun 3, 2025 that may be closed by this pull request
Codesigning the apphost on macOS should preserve entitlements #113707
Closed
@jtschuster jtschuster requested a review from Copilot June 3, 2025 20:37
Copilot AI reviewed Jun 3, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR refactors the Mach-O signing code to use class-based blob types, preserves entitlements (and DER entitlements) during signing, and streamlines how bundles and signatures are applied.

  • Introduce new BlobMagic entries for Entitlements and DerEntitlements.
  • Convert signature blob structs to an OO hierarchy (Blob, SimpleBlob, SuperBlob, etc.).
  • Update Bundler and HostWriter to preserve existing entitlements and avoid remapping files unnecessarily.

Reviewed Changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.

File Description
src/installer/managed/Microsoft.NET.HostModel/MachO/Enums/BlobMagic.cs Add Entitlements and DerEntitlements magic constants.
src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/LinkEditCommand.cs Rename struct to LinkEditLoadCommand.
src/installer/managed/Microsoft.NET.HostModel/Bundle/Bundler.cs Refactor bundle creation to use streams and memory‐mapped file; preserve entitlements.
src/installer/managed/Microsoft.NET.HostModel/AppHost/HostWriter.cs Consolidate signature handling and update method visibility.
Comments suppressed due to low confidence (3)

src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/LinkEditCommand.cs:15

  • The file name 'LinkEditCommand.cs' no longer matches the updated struct name 'LinkEditLoadCommand'; consider renaming the file to 'LinkEditLoadCommand.cs' for consistency.
internal struct LinkEditLoadCommand

src/installer/managed/Microsoft.NET.HostModel/Bundle/Bundler.cs:281

  • The 'relativePathToSpec' dictionary is declared but never used; consider removing this variable to clean up unused code.
var relativePathToSpec = new Dictionary<string, FileSpec>(StringComparer.Ordinal);

src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/Blobs/EmbeddedSignatureBlob.cs:170

  • This new method for calculating signature size and preserving entitlements could benefit from dedicated unit tests to validate size calculations across scenarios, including with and without existing entitlements.
internal static unsafe long GetSignatureSize(uint fileSize, string identifier, EmbeddedSignatureBlob? existingSignature, byte? hashSize = null)

@jtschuster jtschuster marked this pull request as ready for review June 3, 2025 21:37
This was referenced Jun 4, 2025
Open
Closed
This was referenced Jun 4, 2025
Closed
Closed
agocke
agocke reviewed Jun 4, 2025
View reviewed changes
This was referenced Jun 6, 2025
Closed
Closed
jtschuster added 3 commits June 9, 2025 17:08
@jtschuster
Don't abuse inheritance, add Stream file abstraction
a427944 
- Don't use multiple levels of inheritance for blobs
- Add IMachOFileReader/Writer to abstract Stream and MemoryMappedViewAccessor based files
- Use IMachOFileReader/Writer as the interface for reading/writing to the disk for MachO files and blobs
@jtschuster
Update reading BigEndian values
2fb3cb6
@jtschuster
Merge branch 'main' of https://github.com/dotnet/runtime into Preserv…
f37a9f7 
…eEntitlements
@jtschuster jtschuster requested a review from agocke June 10, 2025 21:16
This was referenced Jun 11, 2025
Open
Open
@jtschuster jtschuster mentioned this pull request Jun 11, 2025
Merged
@jtschuster jtschuster marked this pull request as draft June 12, 2025 18:17
@build-analysis build-analysis bot mentioned this pull request Jun 12, 2025
Open
@jtschuster
Copy link
Member Author

jtschuster commented Jul 2, 2025

Superceded by #116566

@jtschuster jtschuster closed this Jul 2, 2025
@github-actions github-actions bot locked and limited conversation to collaborators Aug 2, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@elinor-fung elinor-fung elinor-fung left review comments

Copilot code review Copilot Copilot left review comments

@jkoritzinsky jkoritzinsky Awaiting requested review from jkoritzinsky

@agocke agocke Awaiting requested review from agocke

Assignees

@jtschuster jtschuster

Labels

area-HostModel Microsoft.NET.HostModel issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Codesigning the apphost on macOS should preserve entitlements

3 participants

@jtschuster @agocke @elinor-fung