René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Code-sign and notarize all binaries on macOS","articleBody":"# Summary of the new feature/enhancement\r\n\r\nStarting on macOS Catalina, all native binaries (command-line and GUI application), as well as all .pkg installer files, must be both code-signed and notarized by Apple, or the system will refuse to run them. Notarizing the .pkg file is easy, since it is already being signed. Notarizing the `pwsh` command-line tool, as well as the `PowerShell.app` wrapper application, will be harder. Note that while notarization is optional on macOS Mojave, it is still supported on that version. We do not (and, IMHO, should not) wait for Catalina's release to start work on this important change.\r\n\r\n# Proposed technical implementation details\r\n\r\nWe will need to do the following:\r\n\r\n1. Code-sign the `pwsh` apphost binary with a Developer ID certificate. For notarization to succeed, we must also enable Hardened Runtime on that binary by passing the `-o runtime` flag to the signing tool. We must also use an entitlements file (the correct contents of which are attached at the end of this issue), or else Hardened Runtime will disallow the binary from jitting code or loading third-party dynamic libraries.\r\n2. Code-sign all `*.dylib` files with the Developer ID certificate that is used to sign the apphost binary. No other special steps are required here.\r\n3. Code-sign the `*.app` launcher with the same Developer ID certificate, and enable Hardened Runtime on it as well. While no entitlements are required for the launcher app, we must rewrite the launcher's main executable (which is currently a shell script) in Objective-C, as the macOS code signing process does not support applications with shell scripts as main executables.\r\n4. Notarize all dylibs, the apphost binary, and the launcher app before including them into the installer. You can use `xcrun altool` and `xcrun stapler` to do this.\r\n5. Notarize the `*.pkg` installer once it has been signed.\r\n\r\nNote that the code-signing process is completely independent of the .NET build process, and can easily be run on a .NET CLI-generated apphost binary, as long as the apphost binary in question has been stamped with the appropriate path before it is signed. (After signing, any changes to the binary will invalidate the signature and render the file un-runnable.)\r\n\r\n### Entitlements for `pwsh` tool\r\n\r\n```xml\r\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\r\n\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e\r\n\u003cplist version=\"1.0\"\u003e\r\n\u003cdict\u003e\r\n\t\u003ckey\u003ecom.apple.security.cs.allow-unsigned-executable-memory\u003c/key\u003e\r\n\t\u003ctrue/\u003e\r\n\t\u003ckey\u003ecom.apple.security.cs.disable-library-validation\u003c/key\u003e\r\n\t\u003ctrue/\u003e\r\n\u003c/dict\u003e\r\n\u003c/plist\u003e\r\n```","author":{"url":"https://github.com/wjk","@type":"Person","name":"wjk"},"datePublished":"2019-07-12T14:39:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":10},"url":"https://github.com/10141/PowerShell/issues/10141"}