deno compile binaries cannot be code signed (macOS, Windows)

[AlexanderOMara]

It looks like the current deno compile implementation simply appends data to the deno binary (like a self-extracting ZIP). Trouble is, since this data isn't integrated as part of the actual executable data, it isn't possible to sign the resulting binary.

For example, on macOS you can't sign the binary:

$ deno compile https://deno.land/std@0.79.0/examples/cat.ts
Check https://deno.land/std@0.79.0/examples/cat.ts
Bundle https://deno.land/std@0.79.0/examples/cat.ts
Compile https://deno.land/std@0.79.0/examples/cat.ts
Emit cat
$ sudo codesign -s- cat
cat: main executable failed strict validation

Or on Windows signing appears to work, but the signature is appended to become the last thing in the file, so the binary acts like a plain old deno binary again:

PS Microsoft.PowerShell.Core\FileSystem::\\vmware-host\Shared Folders\deno> Set-AuthenticodeSignature .\cat.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert)


    Directory: \\vmware-host\Shared Folders\deno


SignerCertificate                         Status                         Path
-----------------                         ------                         ----
1920E80F7BCC0A083ED26CA2CD2A7CFB5B9FA5C6  Valid                          cat.exe


PS Microsoft.PowerShell.Core\FileSystem::\\vmware-host\Shared Folders\deno> .\cat
Deno 1.11.2
exit using ctrl+d or close()
>

Note: Singing the deno binary first also wouldn't help, since modifying the file (appending data) would invalidate the signature by necessity.

In order to be able to sign the binary on macOS, the data would have to be added to the executable as something it recognized, such as a new segment.

I did some research on what it would take to do this on macOS recently, and it's not too hard with a little know-how. All you really have to do is insert a new segment, shift the __LINKEDIT load command down, adjust a few other commands that point to it, and read the segment at run-time.

I've seen similar things done on Windows too, so I'm fairly certain a similar solution for Windows is possible. Putting it in the EXE's resources might also be an option (resource editing would also enable #8912).

[kitsonk]

Ref #575

[mxcl]

Notably this is preventing us from bundling pkgx with our .app since it means the notorization fails.

Additionally this prevented us from adding pkgx to Homebrew since their automation requires code signing for M1/M2 chips.

[chudnyi]

Notably this is preventing us from bundling tea/cli with tea/gui (our .app) since it means the notorization fails.

Additionally this prevented us from adding tea/cli to Homebrew since their automation requires code signing for M1/M2 chips.

How did you get the "pkgx" binary that macOS skips and allows to run if signing via codesign crashes?

[mxcl]

We sign with || true (lol) which leaves a somewhat signed binary. The main trick we are using is that installing things via curl bypasses gatekeeper.