diff options
| author | fanquake <fanquake@gmail.com> | 2024-01-11 10:00:31 +0000 |
|---|---|---|
| committer | fanquake <fanquake@gmail.com> | 2024-01-11 10:03:09 +0000 |
| commit | 522b8370d92a8815537b402f43951b45ed0fe7ad (patch) | |
| tree | 16dac88180d1ae17067e479221d210af489d9acc /contrib | |
| parent | fcacbab4878e10946c518970b630e7dccbbd2d45 (diff) | |
| parent | 4fdd836db92e789c98b9e68398ca931a968cc9c3 (diff) | |
| download | bitcoin-522b8370d92a8815537b402f43951b45ed0fe7ad.tar.xz | |
Merge bitcoin/bitcoin#29127: Use hardened runtime on macOS release builds.
4fdd836db92e789c98b9e68398ca931a968cc9c3 Use hardened runtime on macOS release builds. (Mark Friedenbach)
Pull request description:
The Apple notary service requires submitted app bundles to be configured to use the hardened runtime libraries. This is configured at signing time, and supported by the signapple tool Bitcoin Core uses for reproduceable signed binaries. We simply need to pass "--hardened-runtime" when the signature is created. Once attached to the bundle, the resulting codesigned binary can be successfully submitted to the Apple binary notarization service by any Apple Developer.
This partially resolves #15774. The release maintainer, or any authorized Apple Developer, will need to run `xcrun notarytool` to prevent gatekeeper warnings on macOS. Using `xcrun staple` to generate a binary that doesn't call home on first launch would be bonus, but at least this would massively improve the user experience.
ACKs for top commit:
fanquake:
ACK 4fdd836db92e789c98b9e68398ca931a968cc9c3 - we can move ahead with this, and figure out notarisation / stapling as a followup.
Tree-SHA512: 7b8ba50030fb230d44bd63d12ed082537e8eaaa61396114c5df715f8dd6772fd8d84b00dc819f88d9a463996c2170a84981fce1bde7f7999b4bdb914fbcdfdac
Diffstat (limited to 'contrib')
| -rwxr-xr-x | contrib/macdeploy/detached-sig-create.sh | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/contrib/macdeploy/detached-sig-create.sh b/contrib/macdeploy/detached-sig-create.sh index 626381cf43..097a7c35ee 100755 --- a/contrib/macdeploy/detached-sig-create.sh +++ b/contrib/macdeploy/detached-sig-create.sh @@ -24,7 +24,7 @@ fi rm -rf ${TEMPDIR} mkdir -p ${TEMPDIR} -${SIGNAPPLE} sign -f --detach "${TEMPDIR}/${OUTROOT}" "$@" "${BUNDLE}" +${SIGNAPPLE} sign -f --detach "${TEMPDIR}/${OUTROOT}" "$@" "${BUNDLE}" --hardened-runtime tar -C "${TEMPDIR}" -czf "${OUT}" . rm -rf "${TEMPDIR}" |