From f822dcb23c631837d7484ff2cc47efb0adead3cb Mon Sep 17 00:00:00 2001 From: Valentin Klein Date: Wed, 14 Oct 2026 22:56:10 +0200 Subject: [PATCH] macOS packaging: strip extended attributes before signing and verify the DMG's app strictly (#525) (#527) hdiutil makehybrid -hfs gave every file and folder in the image a com.apple.FinderInfo, so WordCraft.app failed codesign --verify --deep --strict inside the released DMG and after copying it out with ditto. - Build the DMG with hdiutil create -srcfolder -fs HFS+ -format UDZO (retried: attaching a device is flaky on CI runners). - Clear extended attributes on the bundle before signing. - After signing the DMG, mount it read-only and strictly verify the app inside it and a ditto copy of it (plus spctl when notarizing), so the release job fails if this regresses. Co-authored-by: Claude Opus 5.5 --- packaging/macos/dmg/README.md | 10 ++++-- packaging/macos/package.sh | 64 +++++++++++++++++++++++++++++++---- 2 files changed, 65 insertions(+), 9 deletions(-) diff --git a/packaging/macos/dmg/README.md b/packaging/macos/dmg/README.md index 32dc268bd..e473b1628 100644 --- a/packaging/macos/dmg/README.md +++ b/packaging/macos/dmg/README.md @@ -2,8 +2,14 @@ What Finder shows when the DMG opens: a 660 × 400 pt background with the app icon and the `Applications` link side by side. `package.sh` copies these files into the image; nothing here is -generated at build time, so the DMG still builds with `hdiutil makehybrid` (no mounted device, no -Finder scripting on CI, nothing extra installed in the signing job). +generated at build time, so the DMG builds with a plain `hdiutil create -srcfolder` (no Finder +scripting on CI, nothing extra installed in the signing job). + +Nothing in this step may touch `WordCraft.app`: `codesign --verify --deep --strict` rejects any +`com.apple.FinderInfo` or resource fork on the bundle. `hdiutil makehybrid -hfs`, which built the +image before, put a FinderInfo on every file in it, so the released app failed that check (#525). +`package.sh` clears extended attributes before signing and, after building the DMG, mounts it +read-only and checks the app inside it, and a `ditto` copy of it, with `--strict`. | File | What | |---|---| diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh index b57b69d7b..1250c237d 100755 --- a/packaging/macos/package.sh +++ b/packaging/macos/package.sh @@ -111,6 +111,10 @@ sed -e "s/@VERSION@/$VERSION/g" -e "s/@SHORT_VERSION@/$SHORT_VERSION/g" \ plutil -lint "$APP/Contents/Info.plist" printf 'APPL????' >"$APP/Contents/PkgInfo" +# codesign --strict rejects extended attributes such as com.apple.FinderInfo or a resource fork +# ("Finder information, or similar detritus not allowed"); a source file copied in can carry them. +# Clear them before signing; nothing after this point may write xattrs onto the bundle (#525). +xattr -cr "$APP" # Sign inside-out: nested code first, then the bundle itself (no --deep on the final signature). # Today the only nested code is the main executable; frameworks/helpers would be signed here too. sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/MacOS/WordCraft" @@ -135,15 +139,61 @@ ln -s /Applications "$STAGE/Applications" mkdir -p "$STAGE/.background" cp "$HERE/dmg/background.tiff" "$STAGE/.background/background.tiff" cp "$HERE/dmg/dmg-layout.DS_Store" "$STAGE/.DS_Store" -rm -f "$DMG" "$WORK/raw.dmg" -# makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`, -# which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions. -# The volume name has no version: .DS_Store finds the background through an alias that includes it. -hdiutil makehybrid -hfs -hfs-volume-name "WordCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE" -hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG" -rm -f "$WORK/raw.dmg" +rm -f "$DMG" +# Retries an hdiutil verb that attaches a device: on CI runners it fails now and then with +# "Resource busy". Usage: hdiutil_retry ; five tries with growing pauses. +hdiutil_retry() { + local attempt + for attempt in 1 2 3 4 5; do + if hdiutil "$@"; then + return 0 + fi + if [ "$attempt" = 5 ]; then + echo "error: hdiutil $1 failed 5 times" >&2 + return 1 + fi + warn "hdiutil $1 failed (attempt $attempt of 5); retrying in $((attempt * 10))s" + sleep $((attempt * 10)) + done +} +# `hdiutil create -srcfolder` copies the staged files as they are. The previous +# `makehybrid -hfs` + `convert` gave every file and folder in the image a com.apple.FinderInfo +# (Finder location -1,-1), so the signed app failed `codesign --verify --deep --strict` inside the +# mounted DMG and after copying it out (#525). The volume name has no version: .DS_Store finds the +# background through an alias that includes it. +hdiutil_retry create -srcfolder "$STAGE" -volname "WordCraft" -fs HFS+ -format UDZO \ + -imagekey zlib-level=9 -ov "$DMG" sign "$DMG" codesign --verify --strict --verbose=2 "$DMG" + +# Gate: the app inside the finished image, and a copy installed from it with ditto, must pass the +# same strict check as the app before packaging, so a container signature can't hide a damaged app +# signature (#525). Returns non-zero (set -e then stops the build) after detaching the image. +verify_dmg_app() { + local dmg="$1" mount="$WORK/dmg-check" copy="$WORK/dmg-check-copy" rc=0 + mkdir -p "$mount" "$copy" + hdiutil_retry attach -readonly -nobrowse -noautoopen -mountpoint "$mount" "$dmg" >/dev/null + echo "==> strict signature check of WordCraft.app inside $(basename "$dmg")" + codesign --verify --deep --strict --verbose=2 "$mount/WordCraft.app" || rc=1 + if [ "$rc" = 0 ]; then + ditto "$mount/WordCraft.app" "$copy/WordCraft.app" || rc=1 + fi + if [ "$rc" = 0 ]; then + echo "==> strict signature check of a ditto copy of it" + codesign --verify --deep --strict --verbose=2 "$copy/WordCraft.app" || rc=1 + fi + if [ "$rc" = 0 ] && [ "$NOTARIZE" = 1 ]; then + spctl --assess --type execute -vvv "$copy/WordCraft.app" || rc=1 + fi + if [ "$rc" != 0 ]; then + echo "error: WordCraft.app in $(basename "$dmg") fails strict verification; extended attributes:" >&2 + xattr -lr "$mount/WordCraft.app" >&2 || true + fi + hdiutil_retry detach "$mount" >/dev/null || hdiutil detach "$mount" -force >/dev/null || rc=1 + rm -rf "$copy" + return "$rc" +} +verify_dmg_app "$DMG" if [ "$NOTARIZE" = 1 ]; then notarize "$DMG" xcrun stapler staple "$DMG"