-
Notifications
You must be signed in to change notification settings - Fork 96
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Traverse archives #231
Conversation
I just tried this out, my latest run didn't have the previous issues but did have this come up during notarization: {
"logFormatVersion": 1,
"jobId": "22d77294-edb5-493c-9790-3e4afca0c58d",
"status": "Invalid",
"statusSummary": "Archive contains critical validation errors",
"statusCode": 4000,
"archiveFilename": "myApp.zip",
"uploadDate": "2020-07-19T08:03:15Z",
"sha256": "e418a864cea75096b9ddeb085e96c828c4f855279c051db0446cbb00352b969d",
"ticketContents": null,
"issues": [
{
"severity": "error",
"code": null,
"path": "myApp.zip/myApp.app/Contents/MacOS/myApp-app",
"message": "The binary is not signed.",
"docUrl": null,
"architecture": "x86_64"
},
{
"severity": "error",
"code": null,
"path": "myApp.zip/myApp.app/Contents/MacOS/myApp-app",
"message": "The signature does not include a secure timestamp.",
"docUrl": null,
"architecture": "x86_64"
},
{
"severity": "error",
"code": null,
"path": "myApp.zip/myApp.app/Contents/MacOS/myApp-app",
"message": "The executable does not have the hardened runtime enabled.",
"docUrl": null,
"architecture": "x86_64"
}
]
} It seems everything but the final executable is being signed? I'm not sure. Another thing to note, I think this option, though really useful in certain circumstances, is quite expensive. This last run added a significant amount of time to the signing process and I believe it's because running code-sign on every archive file's contents just takes a long time. As this is an opt-in feature that most people will probably not need to use perhaps it make sense for the option to either be boolean, or to take a glob pattern or array of archives that could be specified by the user. |
It looks like on that executable binary we have the following issues...
I'm not very sure where the first issue comes from as everything should be signed... But for the second one we can probably resolve it by adding the For the third issue, it seems like that the app bundle wasn't signed with hardened runtime enabled (there's the option Perhaps with these two tweaks, the first problem will disappear? 👌 The latest commit should give us a pattern matching behavior with the
Let me know how if the secure timestamp & the runtime hardening do the work 😺 PS: Due to work-related restrictions, I may need to start taking a break from maintaining this repository starting this upcoming week. I'll try to find someone from the Electron org to have this merged in case we don't get to finish it by the end of Sunday. |
942acd3
to
a78b4fd
Compare
Any update on getting this merged (along with the other PR that fixes spaces in filenames)? I'm having a hard time doing deep signing (#240) and I think those two PRs together should fix it... |
I'm running into the same issue. Anything that can be done to move this PR forward? |
Conflicting with the rewrite, if this change is still applicable please raise a new pull request. Apologies for the conflicts |
Resolves #229