Use the managed signer to remove the code signature from singlefile bundles #110063
Conversation
|
Tagging subscribers to this area: @vitek-karas, @agocke |
|
Tagging subscribers to this area: @agocke, @vitek-karas, @VSadov |
Was it due to some unintentional refactoring? SingleFile was a no-diff in #108992 because it required follow-up work. I understand that ultimately we want to use managed codesign everywhere, just trying to understand do we know what went wrong? |
Nothing went wrong, we would only end up with an invalid signature if we merge the SDK PR (dotnet/sdk#45019) before this. HostWriter.CreateAppHost would create a signed SingleFile host on Windows or Linux, but then Bundler wouldn't remove it before creating the bundle, since it only does signing tasks with |
| // Note: We're comparing file paths both on the OS we're running on as well as on the target OS for the app | ||
| // We can't really make assumptions about the file systems (even on Linux there can be case insensitive file systems | ||
| // and vice versa for Windows). So it's safer to do case sensitive comparison everywhere. | ||
| var relativePathToSpec = new Dictionary<string, FileSpec>(StringComparer.Ordinal); | ||
|
|
||
| long headerOffset = 0; | ||
| using (BinaryWriter writer = new BinaryWriter(File.OpenWrite(bundlePath))) | ||
| using (FileStream bundle = File.Open(bundlePath, FileMode.Open, FileAccess.ReadWrite)) | ||
| using (BinaryWriter writer = new BinaryWriter(bundle)) |
There was a problem hiding this comment.
BinaryWriter will close the stream on dispose. Now that we're disposing of the stream ourselves, I expect we want to use the overload that allows specifying to leave it open.
| newLength ??= new FileInfo(bundlePath).Length; | ||
| bundle.SetLength(newLength.Value); |
There was a problem hiding this comment.
Updating the length should only be needed if TryRemoveCodesign returns true, right? Can we move this up into a conditional based on that?
| .Execute(expectedToFail: !shouldCodesign); | ||
| if (!RuntimeInformation.IsOSPlatform(OSPlatform.OSX)) | ||
| { | ||
| SigningTests.IsSigned(bundledApp).Should().BeFalse(); |
There was a problem hiding this comment.
Shouldn't this be based on shouldCodeSign?
There was a problem hiding this comment.
Oh, this is because the signing still goes through codesign itself / is macOS-only for now, right? Can you add a comment?
- Add comment why single file hosts aren't signed on non-mac yet - Set length of file only if the signature is removed
When working on using the managed Mac signer in the SDK on non-mac hosts, I found that since the bundler uses codesign to remove the signature, we end up with an invalid signature for single file osx executables. This PR updates the bundler to use the managed signer to remove the signature.
Signing bundles requires a little more thought and effort since the headers/load commands need to be updated to include the bundle data in the file. This will be done in a separate PR.
Part of #110055.