-
Notifications
You must be signed in to change notification settings - Fork 5.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
deno compile binaries cannot be code signed (macOS, Windows) #11154
Comments
Ref #575 |
Notably this is preventing us from bundling Additionally this prevented us from adding |
to be distributed so that mac users can run eden without gatekeeper blocking it. (Signing does not yet work for Deno executables) denoland/deno#11154 denoland/deno#17753 denoland/deno#986
How did you get the "pkgx" binary that macOS skips and allows to run if signing via codesign crashes? |
We sign with |
It looks like the current deno compile implementation simply appends data to the deno binary (like a self-extracting ZIP). Trouble is, since this data isn't integrated as part of the actual executable data, it isn't possible to sign the resulting binary.
For example, on macOS you can't sign the binary:
Or on Windows signing appears to work, but the signature is appended to become the last thing in the file, so the binary acts like a plain old deno binary again:
Note: Singing the deno binary first also wouldn't help, since modifying the file (appending data) would invalidate the signature by necessity.
In order to be able to sign the binary on macOS, the data would have to be added to the executable as something it recognized, such as a new segment.
I did some research on what it would take to do this on macOS recently, and it's not too hard with a little know-how. All you really have to do is insert a new segment, shift the
__LINKEDIT
load command down, adjust a few other commands that point to it, and read the segment at run-time.I've seen similar things done on Windows too, so I'm fairly certain a similar solution for Windows is possible. Putting it in the EXE's resources might also be an option (resource editing would also enable #8912).
The text was updated successfully, but these errors were encountered: