qemu: ask to sign QEMU binary when the binary is not properly signed

[AkihiroSuda]

$ limactl start
INFO[0000] Using the existing instance "default"        
WARN[0000] QEMU binary "/usr/local/bin/qemu-system-x86_64" is not properly signed with the "com.apple.security.hypervisor" entitlement  error="failed to run [codesign --verify /usr/local/bin/qemu-system-x86_64]: exit status 1 (out=\"/usr/local/bin/qemu-system-x86_64: invalid signature (code or signature have been modified)\\nIn architecture: x86_64\\n\")"
? Try to sign "/usr/local/bin/qemu-system-x86_64" with the "com.apple.security.hypervisor" entitlement? (Y/n)
...

---

Workaround for:

• ⚠️ QEMU (homebrew) was broken on Intel: [hostagent] Driver stopped due to error: "signal: abort trap" (or "exit status 255") ... QEMU has already exited #1742

This workaround is needed because Homebrew's QEMU binary is not properly signed since v8.0.4. Homebrew/homebrew-core#139409 (comment)

[AkihiroSuda]

cc @lima-vm/maintainers

I'll release v0.17.2 after merging this workaround.

[afbjorklund]

Wouldn't this sign any random qemu binary in the path ?

[AkihiroSuda]

Wouldn't this sign any random qemu binary in the path ?

Sorry what do you mean?

[afbjorklund]

How do we know that the current qemu is the authentic homebrew ?

But maybe this is not so much about authenticating the prebuilt binary, as it is about adding com.apple.security.hypervisor entitlement to the existing program. Otherwise it seems like homebrew made a bug, and the right fix would be for them to make another "package" (well, tarball) revision where they sign it properly.

[AkihiroSuda]

How do we know that the current qemu is the authentic homebrew ?

We may check if the binary path contains "/Cellar/" ?

[AkihiroSuda]

Modified to open a Y/n prompt before signing.
NOP if tty is not available.

[AkihiroSuda]

(I don't want to let pkg/start depend on a specific driver, but I'm going to merge this right now anyway, as the Homebrew issue #1742 is critical. We can refactor this later.)

[mggluscevic59]

On Mac Big Sur entitlement check exits on: codesign --display --entitlements - --xml /usr/local/bin/qemu-system-x86_64 because that command is a bit different - it does not have --xml

Is there a way to turn off entitlements check all together?

[AkihiroSuda]

Big Sur

Addressed in:

• codesign --xml requires macOS Monterey or later #1981

Will be in v0.19