Skip to content

MachO: downgrade codesigning failures to a warning#275

Merged
woodruffw merged 1 commit intoHomebrew:masterfrom
mistydemeo:downgrade_codesigning_failures
Nov 4, 2020
Merged

MachO: downgrade codesigning failures to a warning#275
woodruffw merged 1 commit intoHomebrew:masterfrom
mistydemeo:downgrade_codesigning_failures

Conversation

@mistydemeo
Copy link
Copy Markdown
Contributor

This turned out to cause problems with certain exotic dylibs. Leaving this a warning should be safer instead.

refs Homebrew/brew#8922

@SMillerDev
Copy link
Copy Markdown
Member

We might also want to make the "resigning" output debug/verbose only. I thought it was pretty unexpected that it was resigning everything (as a normal user)

Copy link
Copy Markdown
Member

@MikeMcQuaid MikeMcQuaid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think all the lib/macho/tools.rb MachO.codesign! calls should be removed and done in the Homebrew/brew side instead. This would allow they to be done conditionally based on platform there and exceptions handled accordingly and differently depending on the call site.

@@ -56,6 +56,6 @@ def self.codesign!(filename)
"--preserve-metadata=entitlements,requirements,flags,runtime",
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this use quiet_system or some equivalent that doesn't show the output to users?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might be tough in just ruby-macho, since it doesn't have access to quiet_system or the other Homebrew helpers. We could use Open3 or another stdlib module to control the output streams here, though.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could use Open3 or another stdlib module to control the output streams here, though.

👍🏻

This turned out to cause problems with certain exotic dylibs. We should allow
this to be caught by the consumer for recovery.

refs Homebrew/brew#8922
@woodruffw
Copy link
Copy Markdown
Member

LGTM!

@woodruffw woodruffw merged commit 030559a into Homebrew:master Nov 4, 2020
@mistydemeo mistydemeo deleted the downgrade_codesigning_failures branch November 4, 2020 04:44
@Homebrew Homebrew locked as resolved and limited conversation to collaborators Dec 15, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants