Sign dmg on macOS with packager #2946

molnard · 2020-01-08T12:46:50Z

This PR integrates the mac signing into our existing packager procedure.

Following facts adds complexity and somethings to keep in mind:

Mac signing and notarization can only be made on macintosh.
Creating MSI for windows installation can only be made on windows.
Binaries for all platforms have to be compiled on the same OS to ensure deterministic build - preferably on windows.

After this PR packing procedure will change:

Run the packager.
Copy Wasabi-osx-1.1.1.1.zip from windows to macOS desktop.
Run the packager on macOS.
Copy the final dmg from mac to windows back to dist library.
Run the packager in DoSign mode.
Ready to upload release.

Fixes: #958
Fixes: #2696
Related: #726

molnard · 2020-01-08T14:40:40Z

My App works fine before codesign.
After codesign I cannot start the app. I go to the executable file and try to run directly and I get the following error:
Failed to create CoreCLR, HRESULT: 0x80004005

Details of the error:
export COREHOST_TRACE=1
https://gist.github.com/molnard/9c9227df804eea2773e70b4aca8a0588

UPDATE
Spent several hours without results, so I decided to try another mac. I used the same code, same source and it is generating a working app after signing. So I created another user profile on my mac and now it is working stable.

molnard · 2020-01-09T09:52:44Z

Guys here is something to test. USE ONLY FOR TESTING, and this is a temporary link!

https://github.com/molnard/WalletWasabi/releases/download/macsign/Wasabi-1.1.10.2.dmg

Please test it and let me know ur impressions!
@lontivero @danwalmsley @simonebovi

Test vectors:

Gatekeeper should pass.
Are there any dialogs still during the installation?
Starting Wasabi for the first time right after the installation? Is it working or only for the second time?

DO NOT FORGET TO REINSTALL THE LATEST STABLE VERSION AFTER TESTING!

ghost · 2020-01-09T10:45:51Z

Hi @molnard,
weird behavior here.

No Gatekeeper or any other dialog/error message during the installation.

However, after the first right click to Wasabi.app -> Open, the app closes automatically after few seconds. The second time and onwards everything works fine though.

Hope this helps.

molnard · 2020-01-09T15:50:02Z

On @lontivero mac there is still a popup without the Open button. So I investigated and got this:
EDIT: I mistakenly wrote context:preliminary-signature => context:primary-signature
spctl -a -t open --context context:preliminary-signature -v Wasabi-1.1.10.2.dmg

Wasabi-1.1.10.2.dmg: accepted
source=Notarized Developer ID

codesign -dv --verbose=4 Wasabi-1.1.10.2.dmg

Executable=/Users/release/Desktop/Wasabi-1.1.10.2.dmg
Identifier=Wasabi-1
Format=disk image
CodeDirectory v=20200 size=296 flags=0x10000(runtime) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=3fbd3e3b3873d201ed9cb915d8336636f62f34d3
CandidateCDHashFull sha256=3fbd3e3b3873d201ed9cb915d8336636f62f34d35111e26e839fe39a612e5570
Hash choices=sha256
CMSDigest=3fbd3e3b3873d201ed9cb915d8336636f62f34d35111e26e839fe39a612e5570
CMSDigestType=2
Page size=none
CDHash=3fbd3e3b3873d201ed9cb915d8336636f62f34d3
Signature size=8977
Authority=Developer ID Application: zkSNACKs Ltd. (L233B2JQ68)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=2020. Jan 9. 15:40:01
Info.plist=not bound
TeamIdentifier=L233B2JQ68
Sealed Resources=none
Internal requirements count=1 size=168

https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG18

lontivero · 2020-01-09T16:58:09Z

Just for the record.

Download the .dmg file
Double-click on it
Get error message "Can’t be opened because Apple cannot check it for malicious software"
Close the error message.
Right-click on .dmg file, select Open in the context menu
The installer opens fine without error.
Search Wasabi in the Spotlight search and open it.
An small window appears saying "Verifying Wasabi"
A new popup windows appears with message "“Wasabi Wallet” is an app downloaded from the Internet. Are you sure you want to open it?"
Press Ok and wasabi opens just well.

molnard · 2020-01-09T19:21:28Z

According to our depenedency-policy (no dependencies) and @MitchellCash's suggestion tomorrow I will try to remove create-dmg dep and use mac's hdiutil.

molnard · 2020-01-10T10:18:04Z

Started the preparation of App Store deployment. I will do in a separate PR but what needs to be fixed for that in the APP should be done now.
I use the command:
xcrun altool --validate-app -f "Wasabi Wallet.zip" -t osx

Do not use -deep option at signing. It is not recommended
Use sandbox on executables. bitcoind, hwi, wassabee
Remove the 4th version number
~~The application bundle does not contain an icon in ICNS format, containing both a 512x512 and a 512x512@2x image.~~
Remove [Minimum OS version] (https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html) causing: The Info.plist indicates an iOS app, but submitting a pkg or mpkg.
~~Create pkg for App Store Distribution~~
~~Use altool to upload to App Store~~
~~Check general list of to do~~
~~Remove create-dmg dependency~~

lontivero

Mostly questions.

WalletWasabi.Documentation/Guides/MacOsSigning.md

WalletWasabi.Packager/Content/Osx/App/Contents/Info.plist

WalletWasabi.Packager/MacSignTools.cs

lontivero · 2020-01-10T18:39:50Z

WalletWasabi.Packager/MacSignTools.cs

+				RedirectStandardOutput = true,
+			}))
+			{
+				process.WaitForExit();


It could be convenient to check the ErrorCode before continuing.

lontivero · 2020-01-10T18:44:02Z

WalletWasabi.Packager/MacSignTools.cs

+					Arguments = $"altool --notarization-info \"{uploadId}\" -u \"{appleId}\" -p \"{password}\"",
+					RedirectStandardError = true,
+				});
+				process.WaitForExit();


Here again I would check the ErrorCode. I know we are checking the standard output but if there is a problem it doesn't make sense to wait those 4 seconds.

WalletWasabi.Packager/MacSignTools.cs

molnard · 2020-01-11T14:20:15Z

@think222 I have sandboxed Wasabi. However now I get:

Do you have any idea how to solve this?

Process:               wassabee [4789]
Path:                  /Users/USER/Desktop/*/Wasabi Wallet.app/Contents/MacOS/wassabee
Identifier:            zksnacks.wasabiwallet
Version:               1.1.10 (1.1.10)
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           wassabee [4789]
User ID:               503

Date/Time:             2020-01-11 15:18:25.259 +0100
OS Version:            Mac OS X 10.15.2 (19C57)
Report Version:        12
Anonymous UUID:        C79F51FE-2AE6-9768-EC91-1F5E7F1D04DC

Sleep/Wake UUID:       BB9059D0-3639-4983-88B1-DB72F40089CF

Time Awake Since Boot: 8200 seconds
Time Since Wake:       6000 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Application Specific Information:
abort() called
rdar://problem/28724618 Couldn't create connection object
<rdar://problem/28724618> Process unable to create connection because the sandbox denied the right to lookup com.apple.coreservices.launchservicesd and so this process cannot talk to launchservicesd.
XPC_ERROR_CONNECTION_INVALID from launchservice
_RegisterApplication(), unable to get application ASN from launchservicesd, and this application requires an ASN, so aborting.  error=#-1.
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x00007fff6993e7fa __pthread_kill + 10
1   libsystem_pthread.dylib       	0x00007fff69a00bc1 pthread_kill + 432
2   libsystem_c.dylib             	0x00007fff698c5a1c abort + 120

entitlements file for executables:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.cs.allow-jit</key>
	<true/>
	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
	<true/>
	<key>com.apple.security.cs.allow-dyld-environment-variables</key>
	<true/>
	<key>com.apple.security.cs.disable-library-validation</key>
	<true/>
	<key>com.apple.security.app-sandbox</key>
	<true/>
	<key>com.apple.security.application-groups</key>
	<array>
		<string>L233B2JQ68</string>
	</array>
	<key>com.apple.security.network.client</key>
	<true/>
	<key>com.apple.security.network.server</key>
	<true/>
	<key>com.apple.security.inherit</key>
	<true/>
</dict>
</plist>

molnard · 2020-01-11T14:37:09Z

I am using: Developer ID Application: zkSNACKs Ltd. (L233B2JQ68)

Maybe something to do with this: https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW29

molnard · 2020-01-13T10:08:59Z

Opened an issue about this here: https://forums.developer.apple.com/message/401928

nopara73 · 2020-01-13T19:40:32Z

It doesn't let me see the forums without registration, which it doesn't let me do due to "unkown error", so try to keep us up to date.

danwalmsley · 2020-01-20T19:11:27Z

@molnard iv been informed by @kekekeks that latest OSX not only requires app bundle to be signed, but also notorised by Apple in order for them to run without issue, is this the missing step?

It involves sending the bundle to apple for them to check it.

molnard · 2020-01-21T10:26:40Z

Yes, I did that and it is working. I have also added the thing called sandbox which is also required. Wasabi signed and notarized properly without any issues BUT when try to run it I get this. I am sure it is related to sandboxing. Anyway thx I am open to any idea.

rdar://problem/28724618 Couldn't create connection object
<rdar://problem/28724618> Process unable to create connection because the sandbox denied the right to lookup com.apple.coreservices.launchservicesd and so this process cannot talk to launchservicesd.
XPC_ERROR_CONNECTION_INVALID from launchservice
_RegisterApplication(), unable to get application ASN from launchservicesd, and this application requires an ASN, so aborting.  error=#-1.

…TextMustContainWhitespace to true

…DocMustBeUsedWithInheritingClass to true

Co-Authored-By: Lucas Ontivero <lontivero@users.noreply.github.com>

This reverts commit f7f5094.

This reverts commit 7b29534.

molnard · 2020-01-31T22:08:54Z

I am getting into a serious githell... :D

nopara73 · 2020-02-01T13:29:29Z

It's ok, this PR will have to be broken down to <XXL PRs anyway. So you may want to start with that.

nopara73 requested review from danwalmsley and lontivero January 9, 2020 13:26

nopara73 mentioned this pull request Jan 9, 2020

Update libdmg-hfsplus build instructions to build a specific commit #2948

Closed

This was referenced Jan 10, 2020

Create macOS icon file (icns) correcly #2951

Closed

Remove create-dmg dependency from mac Packager #2952

Closed

lontivero requested changes Jan 10, 2020

View reviewed changes

molnard mentioned this pull request Jan 21, 2020

Wasabi pop up don’t have permission, NOT the OS #2938

Closed

nopara73 added 10 commits January 22, 2020 19:20

Set DocumentationTextMustContainWhitespace to false and Documentation…

4c2a105

…TextMustContainWhitespace to true

Set DocumentationMustMeetCharacterPercentage to false

78e22f3

DocumentationHeadersMustNotContainBlankLines

d003d4f

Set DocumentationHeadersMustNotContainBlankLines to false

cc7eca5

Set IncludedDocumentationXPathDoesNotExist to true

fb5a641

Set IncludeNodeDoesNotContainValidFileAndPath to true and set Inherit…

37f4d04

…DocMustBeUsedWithInheritingClass to true

Set ElementDocumentationMustBeSpelledCorrectly to true

3abac56

Set CurlyBracketsMustNotBeOmitted to true

c029c23

Add some curly brackets

ca9ff18

Set ElementsMustBeSeparatedByBlankLine to true

8aafeab

molnard and others added 22 commits January 31, 2020 22:58

Extract methods

6878f22

proper file cleaup

e8b04a4

small mods

55a0dd9

add extra entitlements

b6a23a6

Better words, more proper permissions

da92fe9

Update WalletWasabi.Packager/MacSignTools.cs

d3e47b4

Co-Authored-By: Lucas Ontivero <lontivero@users.noreply.github.com>

fix comment

90a3b29

Update WalletWasabi.Packager/MacSignTools.cs

0d76947

Co-Authored-By: Lucas Ontivero <lontivero@users.noreply.github.com>

use symbolic

0cfa212

Fix error

47a903b

Update the icon

a55950d

Remove inheritance from entitlements

c4b3190

Fix packing

a8665f6

Zip dmg

59d4d3a

Revert "Update WalletWasabi.Packager/MacSignTools.cs"

cfaeb2d

This reverts commit f7f5094.

Revert "Revert "Update WalletWasabi.Packager/MacSignTools.cs""

ce52ffe

This reverts commit 7b29534.

update files

8eebcaa

new icon

c4c7e96

Put back sandbox entitlement

b51846d

Enable notarization of app

699a7c3

Restructure wassabee folder with symlinks

8876f48

Merge branch 'signmacos' of https://github.com/molnard/WalletWasabi

3c2a106

molnard added 3 commits February 4, 2020 07:59

Improve signing

59e9919

clean the symlink stuff

93ad39e

remove unused

1842e35

molnard mentioned this pull request Feb 4, 2020

Sign dmg on macOS with packager re #3041

Merged

molnard closed this Feb 4, 2020

molnard deleted the signmacos branch April 12, 2020 10:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign dmg on macOS with packager #2946

Sign dmg on macOS with packager #2946

molnard commented Jan 8, 2020 •

edited

molnard commented Jan 8, 2020 •

edited

molnard commented Jan 9, 2020 •

edited

ghost commented Jan 9, 2020

molnard commented Jan 9, 2020 •

edited

lontivero commented Jan 9, 2020

molnard commented Jan 9, 2020 •

edited

molnard commented Jan 10, 2020 •

edited

lontivero left a comment

lontivero Jan 10, 2020

lontivero Jan 10, 2020

molnard commented Jan 11, 2020

molnard commented Jan 11, 2020 •

edited

molnard commented Jan 13, 2020 •

edited

nopara73 commented Jan 13, 2020

danwalmsley commented Jan 20, 2020

molnard commented Jan 21, 2020

molnard commented Jan 31, 2020

nopara73 commented Feb 1, 2020

Sign dmg on macOS with packager #2946

Sign dmg on macOS with packager #2946

Conversation

molnard commented Jan 8, 2020 • edited

molnard commented Jan 8, 2020 • edited

molnard commented Jan 9, 2020 • edited

ghost commented Jan 9, 2020

molnard commented Jan 9, 2020 • edited

lontivero commented Jan 9, 2020

molnard commented Jan 9, 2020 • edited

molnard commented Jan 10, 2020 • edited

lontivero left a comment

Choose a reason for hiding this comment

lontivero Jan 10, 2020

Choose a reason for hiding this comment

lontivero Jan 10, 2020

Choose a reason for hiding this comment

molnard commented Jan 11, 2020

molnard commented Jan 11, 2020 • edited

molnard commented Jan 13, 2020 • edited

nopara73 commented Jan 13, 2020

danwalmsley commented Jan 20, 2020

molnard commented Jan 21, 2020

molnard commented Jan 31, 2020

nopara73 commented Feb 1, 2020

molnard commented Jan 8, 2020 •

edited

molnard commented Jan 8, 2020 •

edited

molnard commented Jan 9, 2020 •

edited

molnard commented Jan 9, 2020 •

edited

molnard commented Jan 9, 2020 •

edited

molnard commented Jan 10, 2020 •

edited

molnard commented Jan 11, 2020 •

edited

molnard commented Jan 13, 2020 •

edited