Fix macOS 10.15.4 codesigning crash#4564
Merged
phoerious merged 1 commit intorelease/2.5.4from Apr 9, 2020
Merged
Conversation
4b34e89 to
da7ba8a
Compare
Member
|
Concur with the version bump |
droidmonkey
approved these changes
Apr 9, 2020
Member
droidmonkey
left a comment
There was a problem hiding this comment.
That is some voodoo magic! Makes sense to only apply entitlements to the executable that needs it.
Member
Author
|
Yeah, and then there are entitlements and entitlements. Some can be set just like that, others need to be whitelisted by a provisioning profile. |
Member
|
I'm glad this is all thoroughly documented and doesn't require special Apple engineer intervention to figure out! 😏 |
Member
Author
|
Oh indeed, 'twas a walk in the park. |
The recent macOS security patch renders our codesigning "fix" of setting the sandbox entitlement to false twice unusable. This patch adds a full provisioning profile and adjusts the signing procedure to not include entitlements for Qt frameworks. The patch also changes the app and bundle ID, so granted accessibility privileges have to be granted again after installing the update. Fixes #4398 Fixes #4515
da7ba8a to
2271498
Compare
phoerious
added a commit
that referenced
this pull request
Apr 9, 2020
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The recent macOS security patch renders our codesigning "fix" of setting the sandbox entitlement to false twice unusable. This patch adds a full provisioning profile and adjusts the signing procedure to not include entitlements for Qt frameworks.
The patch also changes the app and bundle ID, so granted accessibility privileges have to be granted again after installing the update.
Fixes #4398
Fixes #4515
@droidmonkey Since this is an actual fix and not just a workaround or rebuild, I suggest we release it as 2.5.4 despite there not being any changes on other platforms. I believe the extent to which things were changed (including the bundle ID change, which was long overdue anyway) merits a version number upgrade.
Type of change
Checklist:
-DWITH_ASAN=ON. [REQUIRED]