fish 4.9.0 dies abnormally

[skoch13]

Today I received an update for fish shell and it started to die abruptly:

user@computer ~ % /opt/homebrew/bin/fish            
zsh: killed     /opt/homebrew/bin/fish

I assume the reason is

user@computer ~ codesign -vvv --strict /opt/homebrew/bin/fish
/opt/homebrew/bin/fish: invalid signature (code or signature have been modified)
In architecture: arm64

The solution I found is

sudo codesign --force --deep --sign - /opt/homebrew/bin/fish

Is this brew issue?

[roele]

Most likely related to either fish shell binary signing itself or homebrew (if they build from source themselves). Did not run into this but i use fish as my default shell and 2 patch versions (4.9.1, 4.9.2) have been released since.

[skoch13]

just upgraded fish to 4.9.2 via mise bootstrap packages up the issue returned. have to reapply the workaround suggested.

[roele]

Ah that was the missing important clue, i do not install fish via mise. I am aware of issues with code signing or quarantine with casks installed via mise bootstrap but so far had no issues with formulas. It might be that brew does some ad-hoc code signing after installation, something mise most likely does not do (yet).

[skoch13]

Most probably, but it worked just fine prior to the recent update.

[qbedard]

From what I can tell, Homebrew re-signs everything it pours, but mise's brew backend re-signs only the Mach-O files its relocation pass modifies. That misses bin/fish, so macOS rejects the signature. For fish to work, it would need to re-sign the whole keg.

[nettlesh]

I think I fixed it. The issue is in the homebrew backend, fish’s fish, fish_indent, and fish_key_reader are hard links. The relocation modifies the shared binary, then only 1 path gets resigned making the other sigs invalid. macOS then kills fish on launch

PR will be up in a couple minutes, just running tests and building

Edit: PR is up #12988

@skoch13 PR was merged, it should be in the next release. You can build main and see if it solves your issue, but it resolved it on my end since I was hitting the same problem

[skoch13]

Thank you

[qbedard]

Heck yeah. Thanks!