Skip to content

Commit 919fd33

Browse files
authored
Merge pull request #980 from ychin/hardened-runtime-entitlement-scripting-language
Fix hardened runtime entitlement for scripting languages and add app signing scripts
2 parents 047b3e2 + c088f64 commit 919fd33

4 files changed

Lines changed: 130 additions & 1 deletion

File tree

src/MacVim/MacVim.entitlements

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.automation.apple-events</key>
6+
<true/>
7+
<key>com.apple.security.cs.disable-library-validation</key>
8+
<true/>
9+
<key>com.apple.security.get-task-allow</key>
10+
<true/>
11+
</dict>
12+
</plist>

src/MacVim/scripts/notarize-dmg

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/bin/zsh
2+
3+
# Utility script to submit an app for notarization by Apple. It will wait for
4+
# the notarization to succeed, and then staple the results to the target DMG
5+
# file.
6+
7+
if [[ $# == 0 ]]; then
8+
echo "Usage: sign-developer-id <MacVim_dmg> <entitlements_file>"
9+
exit -1
10+
fi
11+
12+
set -e
13+
14+
if [[ $ALTOOL_USERNAME == '' || $ALTOOL_PASSWORD == '' ]]; then
15+
echo 'Need to set ALTOOL_USERNAME and ALTOOL_PASSWORD in environment variables'
16+
exit -1
17+
fi
18+
19+
set -e
20+
21+
macvim_dmg=$1
22+
23+
# Step 1: Submit app to Apple's servers for notarization
24+
set -x
25+
notarize_submit_uuid=$(xcrun altool --notarize-app --primary-bundle-id "org.vim.macvim" --file ${macvim_dmg} --username "${ALTOOL_USERNAME}" --password "${ALTOOL_PASSWORD}" | grep "RequestUUID" | sed -E "s/RequestUUID = (.*)/\1/")
26+
set +x
27+
28+
if [[ ${notarize_submit_uuid} == "" ]]; then
29+
echo "Failed to submit for notarization!"
30+
exit -1
31+
fi
32+
if ! [[ ${notarize_submit_uuid} =~ "^[a-f0-9\-]*$" ]]; then
33+
echo "Request UUID format error!"
34+
exit -1
35+
fi
36+
37+
# Step 2: Wait for notarization to success or fail by continuously querying
38+
# Apple's servers for status updates
39+
echo "Notarization request UUID: ${notarize_submit_uuid}"
40+
printf "Waiting for notarization results..."
41+
42+
counter=0
43+
while sleep 30; do
44+
notarize_results=$(xcrun altool --notarization-info ${notarize_submit_uuid} --username "${ALTOOL_USERNAME}" --password "${ALTOOL_PASSWORD}")
45+
notarize_status=$(echo $notarize_results | grep "Status:" | sed -E "s/^.*Status: (.*)/\1/")
46+
47+
if ((++counter > 60)); then
48+
echo "Notarization timeout!"
49+
exit -1
50+
fi
51+
52+
if [[ $notarize_status == "in progress" ]]; then
53+
printf "."
54+
continue
55+
elif [[ $notarize_status == "success" ]]; then
56+
printf "\n"
57+
echo "Notarization Success!\n"
58+
echo $notarize_results
59+
break
60+
else
61+
printf "\n"
62+
exit -1
63+
fi
64+
done
65+
66+
# Step 3: Staple the notarization info to the DMG so that an offline user can
67+
# verify that it is notarized.
68+
set -x
69+
xcrun stapler staple ${macvim_dmg}
70+
71+
# Just print out extra info for reference
72+
echo "--------------------"
73+
codesign -d --verbose=2 ${macvim_dmg}
74+
spctl -a -t open --context context:primary-signature -v ${macvim_dmg}
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/sh
2+
3+
# Utility script to sign MacVim with a valid Developer ID with hardened runtime
4+
# along with a provided entitlments file. This script requires a Developer ID
5+
# cert already installed on the computer.
6+
7+
# Use the following to verify:
8+
# codesign -d --verbose=4 --entitlements - <MacVim_app>
9+
10+
if [[ $# == 0 || $# == 1 ]]; then
11+
echo "Usage: sign-developer-id <MacVim_app> <entitlements_file>"
12+
exit -1
13+
fi
14+
15+
set -e
16+
17+
macvim_path=$1
18+
entitlements=$2
19+
20+
if [[ $macvim_path =~ dmg ]]; then
21+
set -x
22+
codesign -f -s "Developer ID Application" -o runtime --timestamp $macvim_path
23+
else
24+
# Sign bottom-up to make sure everything is signed. Note: --deep doesn't
25+
# catch certain edge cases like the files in Resources, hence the need to
26+
# manually sign them before signing the main app.
27+
set -x
28+
codesign -f -s "Developer ID Application" -o runtime --deep --timestamp $macvim_path/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app
29+
codesign -f -s "Developer ID Application" -o runtime --deep --timestamp $macvim_path/Contents/Library/QuickLook/QLStephen.qlgenerator/Contents/MacOS/QLStephen
30+
codesign -f -s "Developer ID Application" -o runtime --deep --timestamp --entitlements $entitlements $macvim_path
31+
fi

src/Makefile

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3620,16 +3620,21 @@ $(APPDIR)/Contents:
36203620

36213621
##############################################################################
36223622
### MacVim GUI
3623-
.PHONY: macvim macvim-dmg macvimclean
3623+
.PHONY: macvim macvim-dmg macvimclean macvim-signed macvim-dmg-release
36243624

36253625
RELEASEDIR = MacVim/build/Release
36263626
DMGDIR = MacVim/build/dmg
36273627
DMGFILE = MacVim.dmg
3628+
ENTITLEMENTS = MacVim/MacVim.entitlements
36283629

36293630
macvim: $(VIMTARGET)
36303631
xcodebuild -project MacVim/MacVim.xcodeproj $(XCODEFLAGS)
36313632

3633+
macvim-signed:
3634+
MacVim/scripts/sign-developer-id $(RELEASEDIR)/MacVim.app $(ENTITLEMENTS)
3635+
36323636
macvim-dmg:
3637+
rm -rf $(DMGDIR)
36333638
mkdir -p $(DMGDIR)
36343639
cp -a $(RELEASEDIR)/MacVim.app $(DMGDIR)/
36353640
rm -rf $(RELEASEDIR)/$(DMGFILE)
@@ -3648,6 +3653,13 @@ macvimclean:
36483653
rm -rf MacVim/build MacVim/qlstephen/build xxd/xxd.dSYM; \
36493654
fi
36503655

3656+
# Create a release DMG image that is signed and notaraized
3657+
macvim-dmg-release: macvim-signed macvim-dmg
3658+
MacVim/scripts/sign-developer-id $(RELEASEDIR)/MacVim.dmg $(ENTITLEMENTS)
3659+
MacVim/scripts/notarize-dmg $(RELEASEDIR)/MacVim.dmg
3660+
echo "--------------------"
3661+
echo "Release MacVim built!"
3662+
36513663

36523664
###############################################################################
36533665
### (automatically generated by 'make depend')

0 commit comments

Comments
 (0)