Latest clang in LLVM 17.0.2 may produce invalid code signatures on Apple Silicon macs

[daogilvie]

Output of brew config

HOMEBREW_VERSION: 4.1.15-30-gb085889
ORIGIN: https://github.com/Homebrew/brew
HEAD: b085889f5168c9ba7ac64f9c13534bcf820626bd
Last commit: 4 hours ago
Core tap origin: https://github.com/Homebrew/homebrew-core
Core tap HEAD: ee365a6d00d4964d1468bcd85f4a020de9d60bbd
Core tap last commit: 8 hours ago
Core tap branch: master
Core tap JSON: 13 Oct 14:31 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: nvim
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 15.0.0 build 1500
Git: 2.39.3 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.1.2 => /usr/bin/curl
macOS: 13.6-arm64
CLT: 15.0.0.0.1.1694021235
Xcode: 15.0
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some taps are not on the default git origin branch and may not receive
updates. If this is a surprise to you, check out the default branch with:
  git -C $(brew --repo daogilvie/old) checkout

Description of issue

Really weird one, but I've found that if I use the brew-provided llvm, binaries can (but don't necessarily) have malformed code signatures on my M1 mac! This isn't a problem with LLVM 16, and once I figured out what was happening it was easy enough to work around, but I don't have the first clue on where to look for more information, or to file an issue (if one is even warranted); any advice?

This presented itself because we have started using more Golang at work, and the final linker step invoked by go build in the toolchains I had installed used whatever clang was on the path. I'd forgotten that I'd previously put whatever the latest LLVM was into my path, so that I'd have the latest stable clang for other reasons. Some of my builds just stopped working, invalid signatures, and I didn't twig it happened after the upgrade to LLVM 17, but I've just spent the day digging through it all to figure this out 😂

Note: I do absolutely realise there is a warning about adding LLVM to the path in the formula, and I have simply removed it for now, but this is the first time it's caused me a problem.

[Bo98]

Hard to really say from this. Do you have a minimal reproducible example?

Go also has its own linker so it's difficult to deduce from this at which operation the code signature is breaking. For reference: in a normal C-only workflow, the "ad-hoc" code signature is produced automatically by Apple's ld linker (since Xcode 12), which is typically the last command invoked in producing the final executable.

[daogilvie]

I first noticed this when trying to compile vektra/mockery — I think the go linker tool actually hands off to either cc (in the case of homebrew go) or clang (in the case of asdf-installed go).

An excerpt from running go build -o withasdf -x -ldflags=-v in the root of that repo, looks like below. The excerpt starts when the go link tool is invoked, and ends with the invocation of the external tool (clang, in this case).

/Users/drum.ogilvie/.asdf/installs/golang/1.21.3/go/pkg/tool/darwin_arm64/link -o $WORK/b001/exe/a.out -importcfg $WORK/b001/importcfg.link -X=runtime.godebugDefault=panicnil=1 -buildmode=pie -buildid=Hu0qACRvmKvBqumA0he2/s7GkfbJbq6ar4NnDMBga/nappY8DX91BmkBc7rL7h/Hu0qACRvmKvBqumA0he2 -v -extld=clang $WORK/b001/_pkg_.a
/Users/drum.ogilvie/.asdf/installs/golang/1.21.3/go/pkg/tool/darwin_arm64/buildid -w $WORK/b001/exe/a.out # internal
# github.com/vektra/mockery/v2
HEADER = -H1 -T0x100001000 -R0x4000
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/03/035092c7604c8cad9e5fb07b964c0d5f61b8e6e5e2f2eef58c5386e93d76e8c3-d(_x001.o) from pkg net -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000000.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/03/035092c7604c8cad9e5fb07b964c0d5f61b8e6e5e2f2eef58c5386e93d76e8c3-d(_x002.o) from pkg net -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000001.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x001.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000002.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x002.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000003.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x003.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000004.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x004.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000005.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x005.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000006.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x006.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000007.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x007.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000008.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x008.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000009.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x009.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000010.o
host obj copy: /Users/drum.ogilvie/Library/Caches/go-build/90/90fcf1dc08bd1dce5333aae02dd001ec684bdd24205910c2d97113ec5d8eeffc-d(_x010.o) from pkg runtime/cgo -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000011.o
host obj copy: $WORK/b246/_pkg_.a(_x001.o) from pkg golang.org/x/tools/internal/fastwalk -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000012.o
host obj copy: $WORK/b246/_pkg_.a(_x002.o) from pkg golang.org/x/tools/internal/fastwalk -> /var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000013.o
host link: "clang" "-arch" "arm64" "-Wl,-headerpad,1144" "-o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-build3099504924/b001/exe/a.out" "-Qunused-arguments" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/go.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000000.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000001.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000002.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000003.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000004.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000005.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000006.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000007.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000008.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000009.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000010.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000011.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000012.o" "/var/folders/w9/5cx7x_sx1d9dmfpz0n_wd6d80000gp/T/go-link-2037885405/000013.o" "-lresolv" "-O2" "-g" "-O2" "-g" "-framework" "CoreFoundation" "-O2" "-g" "-framework" "CoreFoundation" "-framework" "Security"

The key thing to note here is that it uses clang, no prefix, so will pick whatever clang is on the path. When I don't put LLVM 17 on the path, this is Apple's clang, from their Command Line Tools, and all is well. It also works if I put LLVM 16 on the path.
The comparable output from homebrew's go is almost identical, except s/clang/cc

[daogilvie]

As a side note — simply re-signing the binary afterwards with codesign -s - or passing -ldflags=-s as per golang/go#11887 works too. I'm not an expert in any of this, so don't know where to begin really.

[SMillerDev]

Could you try downgrading your Xcode and seeing if that resolves it. I know Xcode 15 has a new linker that caused a bunch of issues

[daogilvie]

Could you try downgrading your Xcode and seeing if that resolves it. I know Xcode 15 has a new linker that caused a bunch of issues

The issue has been going on for a few months now, before the release of 15 IIRC, but it's completely possible I'm mis-remembering that; also to be clear, the problem goes away when I use Apple's clang, which presumably sits in the Xcode 15 toolchain 🤔
I'm happy to give this a go — it may be a little while because it is my work machine, and this problem no longer prevents me from doing my work 😂 I've also so far struggled to find anything older than 15 beta 8 on the downloads page, which is where the internet tells me I can download old versions. I'm not a mac developer, I'm a developer who uses a mac, so I literally never open or use Xcode myself.

[daogilvie]

I've not had a chance to revisit this, and I don't think I will any time soon. It sounds like a pretty niche problem, and I've worked around it to my satisfaction.
Thank you to the responders, I appreciate you taking the time 👍