Skip to content

Add entitlements to roslyn apphosts#3052

Merged
mmitche merged 2 commits intodotnet:release/10.0.1xxfrom
jkoritzinsky:roslyn-apphost
Oct 23, 2025
Merged

Add entitlements to roslyn apphosts#3052
mmitche merged 2 commits intodotnet:release/10.0.1xxfrom
jkoritzinsky:roslyn-apphost

Conversation

@jkoritzinsky
Copy link
Member

Fixes dotnet/runtime#120967

This has the existing entitlements that Roslyn has always used.

@jkoritzinsky
Copy link
Member Author

/backport to main

@github-actions
Copy link
Contributor

Started backporting to main: https://github.com/dotnet/dotnet/actions/runs/18728375732

@github-actions
Copy link
Contributor

@jkoritzinsky backporting to "main" failed, the patch most likely resulted in conflicts:

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Add entitlements to roslyn apphosts
.git/rebase-apply/patch:37: trailing whitespace.
    
warning: 1 line adds whitespace errors.
Using index info to reconstruct a base tree...
M	src/sdk/src/Layout/redist/targets/GenerateLayout.targets
Falling back to patching base and 3-way merge...
Auto-merging src/sdk/src/Layout/redist/targets/GenerateLayout.targets
CONFLICT (content): Merge conflict in src/sdk/src/Layout/redist/targets/GenerateLayout.targets
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Add entitlements to roslyn apphosts
Error: The process '/usr/bin/git' failed with exit code 128

Please backport manually!

@dotnet-policy-service dotnet-policy-service bot requested a review from a team October 22, 2025 20:11
Copy link
Member

@jeffschwMSFT jeffschwMSFT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

approved

@mmitche mmitche enabled auto-merge (squash) October 22, 2025 20:16
@jkoritzinsky
Copy link
Member Author

/azp run dotnet-unified-build-full

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@jkoritzinsky jkoritzinsky disabled auto-merge October 22, 2025 20:29
@jkoritzinsky
Copy link
Member Author

Let's wait until the mac legs run on the unified-build-full pipeline before merging, just to be sure things are working right.

@mmitche mmitche enabled auto-merge (squash) October 22, 2025 21:28
@jkoritzinsky
Copy link
Member Author

/azp run dotnet-unified-build-full

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mmitche
Copy link
Member

mmitche commented Oct 23, 2025

I'm pretty sure this froze on both arm64 adn x64 before it even got past aspnetcore. No idea why. We aren't normally running the full build in the open so deserves investigation but I am going to merge for now.

@mmitche mmitche disabled auto-merge October 23, 2025 01:41
@mmitche mmitche merged commit fd92bc9 into dotnet:release/10.0.1xx Oct 23, 2025
49 of 62 checks passed
EnableMacOSCodeSign="$(SharedFrameworkRid.StartsWith('osx'))" />

<Exec Command="codesign --sign - --entitlements '$(MSBuildProjectDirectory)/roslyn-entitlements.plist' %(_RoslynAppHost.RootDir)%(_RoslynAppHost.Directory)%(_RoslynAppHost.Filename)$(ExeExtension)"
Condition="$(SharedFrameworkRid.StartsWith('osx'))" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do other apphosts (like dotnet.exe) get the entitlements? Shouldn't CreateAppHost task take care of that?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we add them during the dotnet/runtime build: https://github.com/dotnet/runtime/blob/9bcdd873eb4b93934ae34328845599f63253d32a/src/native/corehost/dotnet/CMakeLists.txt#L28-L30

but I just noticed this is missing the -f/--force option and the official build fails due to that

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't CreateAppHost task take care of that?

Ideally yes (dotnet/runtime#113707), that's why it worked before, but we ran into issues: dotnet/runtime#119824

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we add them during the dotnet/runtime build:

That's for the dotnet apphost only, right? What about any other customer app which uses apphosts, wouldn't they need entitlements to work on macOS as well?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally yes (dotnet/runtime#113707), that's why it worked before, but we ran into issues: dotnet/runtime#119824

I see, thanks!

<key>com.apple.security.cs.debugger</key>
<true/>
<key>com.apple.security.get-task-allow</key>
<true/>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@agocke @jkoritzinsky re-reading dotnet/runtime#119429 (comment) I'm a bit confused now whether the swift issue was because of com.apple.security.get-task-allow and if we'd hit the same in roslyn given we set this?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is what's on dotnet, so I think these should be fine:

[Dict]
	[Key] com.apple.security.cs.allow-dyld-environment-variables
	[Value]
		[Bool] true
	[Key] com.apple.security.cs.allow-jit
	[Value]
		[Bool] true
	[Key] com.apple.security.cs.debugger
	[Value]
		[Bool] true
	[Key] com.apple.security.cs.disable-library-validation
	[Value]
		[Bool] true
	[Key] com.apple.security.get-task-allow
	[Value]
		[Bool] true

akoeplinger added a commit that referenced this pull request Oct 23, 2025
The build currently fails with:
> /Users/runner/work/1/s/src/sdk/artifacts/bin/redist/Release/net10.0/Roslyn/bincore/csc: is already signed

Follow-up to #3052

This makes the codesign command now match what we do in dotnet/runtime: https://github.com/dotnet/runtime/blob/9bcdd873eb4b93934ae34328845599f63253d32a/eng/native/functions.cmake#L736
@jaredpar
Copy link
Member

This has the existing entitlements that Roslyn has always used.

We are entitled to these entitlements.

@akoeplinger
Copy link
Member

@jkoritzinsky can you please port this and #3069 to main? thanks

@jkoritzinsky
Copy link
Member Author

Once #2425 is ported to main, then we can port these.

Better yet, @jjonescz when you port #2425 to main, can you include this PR and #3069 in the port?

jjonescz pushed a commit to jjonescz/dotnet that referenced this pull request Oct 31, 2025
jjonescz pushed a commit to jjonescz/dotnet that referenced this pull request Oct 31, 2025
The build currently fails with:
> /Users/runner/work/1/s/src/sdk/artifacts/bin/redist/Release/net10.0/Roslyn/bincore/csc: is already signed

Follow-up to dotnet#3052

This makes the codesign command now match what we do in dotnet/runtime: https://github.com/dotnet/runtime/blob/9bcdd873eb4b93934ae34328845599f63253d32a/eng/native/functions.cmake#L736
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

8 participants