macOS Installer Requires Notarization To Be Run Under Catalina and Beyond

[enquora]

Catalina and beyond refuse to execute installer package (because of lack of notarization). It is possible to circumvent this but the procedure is not discoverable and shouldn't be expected of normal users.

It is unlikely even this current work-around will be permitted in future versions of macOS. The installer package should either conform to platform security requirements or be removed from the distributions list entirely.

[targos]

Refs: https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution

[bnoordhuis]

Reading through Customizing the Notarization Workflow, it sounds like it'd be a major PITA to integrate with our release process. Thanks, Apple!

[MajuMadhusudanan]

I'm also facing the same problem. My package file bundle nodejs .PKG file. Now when I try to notarize my package file, apple rejects the package file saying it as invalid one. The below errors are coming in logs:

/node-v8.11.3.pkg/node-v8.11.3.pkg Contents/Payload/usr/local/bin/node",
"message": "The signature algorithm used is too weak.",

[silverwind]

These requirements do not apply to Homebrew, right? If Apple's processes prove too tricky, maybe we should make that the recommended installation method.

[enquora]

Transferring responsibility for distribution to package managers is, indeed, one answer to a fundamental requirement of the modern computing landscape.

[duncanmak]

I also ship an app that has node bundled inside the app bundle, depending on Homebrew is not a viable solution for me.

Will the Node.js foundation ship a hardened (optionally also notarized) copy of Node.js soon, in time for the release of MacOS Catalina?

[tylersmalley]

Apple has announced that Catalina will be coming in October. It would be great to hear from the OpenJS Foundation to understand if they intend on notarizing the macOS Binary.

[devsnek]

perhaps we should just recommend people install via brew/n/nvm/etc, easier to upgrade that way anyway.

[tylersmalley]

@devsnek, unfortunately, that isn't an option for folks who ship a version of Node in their software as myself and multiple folks on this thread do.

[jasontedor]

It's also relying on an assumption that Homebrew won't add the quarantine extended attribute that causes Gatekeeper to enforce signing/notarization requirements. Note that applications installed by Homebrew Cask do get the quarantine extended attribute.

[somu84]

Yea and resigning / hardening the node binary also doesn't work. As node tries to validate the signature and terminates if it's signed with any other certificate

[devsnek]

sorry I don't know much about this packaging... Why can't you just bundle the node binary itself?

[somu84]

Node binary terminates without providing any details as to why, when I try to codesign the binary with a different cert.

[MajuMadhusudanan]

Apple released macOS Catalina yesterday. Any updates regarding this issue?

[duncanmak]

I think @gdams is working on a PR to fix this.

@gdams how goes it?

[gdams]

I have a patch which enabled hardened runtime, as soon as I can confirm if the full test suite passes I will create a PR

[faijaz]

I have a patch which enabled hardened runtime, as soon as I can confirm if the full test suite passes I will create a PR

Any update on it @gdams ? When can we start integrating it with our App?

[sam-github]

ATTN: @nodejs/build -- since I don't see a ping of them (us!) in here.

[rvagg]

Thanks @sam-github, this wasn't on my radar at all either. What a pain. It looks like we're going to have more integration work to do:

If you use an automated build system, you can integrate the notarization process into your existing build scripts. The altool and stapler command-line tools (included with Xcode) allow you to upload your software to the Apple notary service, and to staple the resulting ticket to your executable.

Figuring out that process will be an interesting task for someone. Any takers? The builds primarily go through the $(BINARYTAR) and $(PKG) build targets in Makefile. In there references to tools/osx-codesign.sh and tools/osx-productsign.sh. We'll need to extend those or add new steps to make this happen.

[gdams]

@rvagg so far I have the following patch that I have been testing:

diff --git a/tools/osx-codesign.sh b/tools/osx-codesign.sh
index 6a954c737f..70403ab268 100644
--- a/tools/osx-codesign.sh
+++ b/tools/osx-codesign.sh
@@ -8,4 +8,4 @@ if [ "X$SIGN" == "X" ]; then
   exit 0
 fi
 
-codesign -s "$SIGN" "$PKGDIR"/bin/node
+codesign --sign "$SIGN" --entitlements tools/osx-entitlements.plist --options runtime --timestamp "$PKGDIR"/bin/node
\ No newline at end of file
diff --git a/tools/osx-entitlements.plist b/tools/osx-entitlements.plist
new file mode 100644
index 0000000000..9519157d71
--- /dev/null
+++ b/tools/osx-entitlements.plist
@@ -0,0 +1,16 @@
+  <?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
\ No newline at end of file

This will enable hardened runtime on the node binary which is the main requirement going forwards. In the OpenJDK world I have then been using electron-notarize-cli to notarize the pkg installer. The main issue going forwards is that the notarization has to be done on a mac with a full blown xcode 10 or 11 installation (not xcode build tools) as it requires the xcrun command. I'm more than happy to walk people through what I've done in the OpenJDK world so far if that helps?

[AshCripps]

@gdams Didn't you say it also requires at least 10.13 OSX machine for the notorization? and the binary itself must be built with xcode 10 command line tools otherwise the notorization fails?

[gdams]

@AshCripps yes that's correct you need a 10.13 machine with xcode 10 or above, I did some test builds and I was able to notarize a binary built on xcode 9 command line tools so maybe that requirement is slightly looser.

[directionless]

Notarization isn't too bad -- the biggest issue is that it's an asynchronous process. Because of it, my workflow ends up having an intermediary staging step.

Anyhow, the core commands to notarize are:

xcrun altool --username $APPLEID --password @env:N_PASS --asc-provider $TEAMID --notarize-app --file $FILE  --primary-bundle-id $BUNDLEID

xcrun altool --username $APPLEID --password @env:N_PASS --asc-provider $TEAMID  --notarization-info $REQUEST_GUUID 

staple $FILE

These commands can return xml which is reasonably parsable

[MylesBorins]

This has gone out in v13.12.0.

We'll aim to get it in the next two LTS releases if there are no regressions reported

[AshCripps]

This should be closed now, the latest 10.x and 12.x releases went out yesterday with notorization right?

[richardlau]

I'll leave this pinned for a few days for visibility. Node.js 10.20.0, 12.16.2 and 13.12.0 are all notarized.