Codesign on macOS #727

jmarrec · 2024-08-24T05:49:04Z

Included works

The absolutely required bit is

Codesign an notarize the DMG installer itself (this is a self extractable executable)
- This required patching QtIFW and creating binaries
  - https://github.com/jmarrec/QtIFW-fixup/releases/tag/v5.0.0-dev-with-fixup
  - Trying to upstream them in https://codereview.qt-project.org/c/installer-framework/installer-framework/+/568786

The rules are going to be tightened in the fall when macOS Sequoia releases: https://9to5mac.com/2024/08/06/macos-sequoia-makes-it-harder-to-run-apps-that-dont-follow-apples-security-rules/

In addition, I chose to also codesign and harden the inner apps, libraries, and executables. This will help for the tar.gz one probably.

Codesign OpenStudio.app itself
Codesign all other libraries and executables (eg: Radiance, EnergyPlus, Python sos, etc)

I also added some QA/QC scripts that will, on GHA

On the build machine:
- it will check that the inner _CPack_Pacages binaries and executables are properly codesigned for IFW and TGZ
- for the TGZ one, it checks whether all libs can be resolved (the script uses otool and some logic to check if everything is fine)
On a test machine:
- It downloads the dmg artifact, ensures that is properly codesigned and notarized
- Mount the dmg
- check the installer is properly codesigned
- performs a silent install
- unmount dmg
- Check the signature of all the inner binaries and executables that have been installed
- otool to ensure all libraries are resolved (and output a JSON file for debugging / manual checking)
- Performs an E+ simulation with a PythonPlugin to ensure that works fine

Demonstration

Before signing

You get a an eject warning, and you have to right click > Open if you want to install it.

With signing

…to release anyways

The extracted OpenStudioApp.app itself is not codesigned and notarized

…f...)

…ria2c installed

The order in which CPack does stuff is weird as hell when subdirectories are involved, but basically It adds the install(CODE ) commands from the top level CMakeLists, which includes calling the install_codesign_script.cmake Then it includes the specific subdirectories 's cmake_install.cmake which means it'll try to sign something that wasn't installed (copied) yet!

was added only in 3.9

On the self hosted runner I tweaked the sudoers file... maybe it'll work

.github/workflows/app_build.yml

… Break up install scripts per component, and do cleanup of cmake lists to avoid signing Radiance like 20 times total.

jmarrec · 2024-08-27T10:37:03Z

There's an intermittent failure in the packaging step, that has been preexisting for a while, but which is annoying the crap out of me during all this testing.

There's a create_symlink failing sometimes, but restarting the run usually makes it work...
https://github.com/openstudiocoalition/OpenStudioApplication/actions/runs/10575968626/job/29300787775#step:18:2721

OpenStudioApplication/src/openstudio_app/CMakeLists.txt

Lines 446 to 484 in bcae7d2

    
             install(CODE [[ 
        
                 execute_process( 
        
                   COMMAND echo "CMAKE_INSTALL_PREFIX = ${CMAKE_INSTALL_PREFIX}" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../../../../../../../Frameworks" 
        
                     "${CMAKE_INSTALL_PREFIX}/OpenStudioApp.app/Contents/Frameworks/QtWebEngineCore.framework/Versions/A/Helpers/QtWebEngineProcess.app/Contents/Frameworks" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../../EnergyPlus" 
        
                     "${CMAKE_INSTALL_PREFIX}/OpenStudioApp.app/Contents/EnergyPlus" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../../Radiance" 
        
                     "${CMAKE_INSTALL_PREFIX}/OpenStudioApp.app/Contents/Radiance" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../../../lib/$<TARGET_FILE_NAME:openstudio::rubyengine>" 
        
                     "${CMAKE_INSTALL_PREFIX}/OpenStudioApp.app/Contents/Frameworks/$<TARGET_FILE_NAME:openstudio::rubyengine>" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../../../lib/$<TARGET_FILE_NAME:openstudio::pythonengine>" 
        
                     "${CMAKE_INSTALL_PREFIX}/OpenStudioApp.app/Contents/Frameworks/$<TARGET_FILE_NAME:openstudio::pythonengine>" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../../../lib/$<TARGET_FILE_NAME:openstudio::openstudiolib>" 
        
                     "${CMAKE_INSTALL_PREFIX}/OpenStudioApp.app/Contents/Frameworks/$<TARGET_FILE_NAME:openstudio::openstudiolib>" 
        
                   COMMAND "${CMAKE_COMMAND}" -E make_directory "${CMAKE_INSTALL_PREFIX}/bin" 
        
                   COMMAND "${CMAKE_COMMAND}" -E create_symlink 
        
                     "../OpenStudioApp.app/Contents/MacOS/$<TARGET_FILE_NAME:openstudio::openstudio>" 
        
                     "${CMAKE_INSTALL_PREFIX}/bin/$<TARGET_FILE_NAME:openstudio::openstudio>" 
        
                   COMMAND_ECHO STDOUT 
        
                   COMMAND_ERROR_IS_FATAL ANY 
        
                 ) 
        
               ]] 
        
               COMPONENT OpenStudioApp 
        
             )

… upload to release anyways" This reverts commit 76ffef6.

jmarrec · 2024-08-27T11:00:27Z

Ok, finally all green, aside from that nagging intermittent failure. Renabling all workflows now. Assuming I can pass CI just fine, this can drop.

.github/workflows/app_build.yml

CMake/install_codesign_script_OpenStudioApp.cmake

CMakeLists.txt

macumber · 2024-08-28T02:12:57Z

Wow @jmarrec this is a lot of work, very impressive! I left some comments/questions

jmarrec · 2024-08-29T13:42:28Z

annoy

There's an intermittent failure in the packaging step, that has been preexisting for a while, but which is annoying the crap out of me during all this testing.

There's a create_symlink failing sometimes, but restarting the run usually makes it work... https://github.com/openstudiocoalition/OpenStudioApplication/actions/runs/10575968626/job/29300787775#step:18:2721

See it failing on develop here: https://github.com/openstudiocoalition/OpenStudioApplication/actions/runs/10610974805/job/29409504326?pr=730#step:17:1875

jmarrec added 10 commits August 23, 2024 14:29

Disable all workflows, but the app build for mac, and make it upload …

76ffef6

…to release anyways

Setup codesigning & notarization of the DMG installer itself

f8b8b0b

The extracted OpenStudioApp.app itself is not codesigned and notarized

Codesign OpenStudioApp.app only (not the OpenStudio / EnergyPlus stuf…

6ef322f

…f...)

Setup GHA codesigning

6353789

Need the arch variable to get qtifw + self hosted mac does not have a…

366c5bc

…ria2c installed

Start codesigning inner libraries and exes

088e796

Verify signature: for the CPACK package + on a clean machine too

0fc02c8

Add Path.is_relative_to for python 3.8...

c16559a

was added only in 3.9

Try to get correct artifact for testing

cd0af8a

jmarrec added Enhancement Request New feature or request component - Installer/Platform 📦 labels Aug 24, 2024

jmarrec self-assigned this Aug 24, 2024

jmarrec added 9 commits August 24, 2024 08:19

Forgot a step id... see you in 45min

03d5594

typo in path in test step

5434291

Another typo

5476037

Can't use sudo on the self hosted runner

4dd03b7

K, put back the sudo

dcd2323

On the self hosted runner I tweaked the sudoers file... maybe it'll work

sudoers didn't appear to work...

45674eb

GRRRRRRRR

6558fc1

Disable test step on self hosted, can't figure out how to use sudo

e23b6c0

geeez

6b28918

macumber reviewed Aug 27, 2024

View reviewed changes

.github/workflows/app_build.yml Outdated Show resolved Hide resolved

jmarrec added 2 commits August 27, 2024 10:09

For the test step, use the GHA macos-14 (arm64)

a32d25c

For the TGZ package, I was signing and resigning over and over again.…

4ed3f1f

… Break up install scripts per component, and do cleanup of cmake lists to avoid signing Radiance like 20 times total.

Revert "Disable all workflows, but the app build for mac, and make it…

7510b06

… upload to release anyways" This reverts commit 76ffef6.

jmarrec marked this pull request as ready for review August 27, 2024 11:00

Don't try to upload otool info on non mac

5cfb71b

macumber reviewed Aug 28, 2024

View reviewed changes

.github/workflows/app_build.yml Show resolved Hide resolved

macumber reviewed Aug 28, 2024

View reviewed changes

.github/workflows/app_build.yml Show resolved Hide resolved

macumber reviewed Aug 28, 2024

View reviewed changes

CMake/install_codesign_script_OpenStudioApp.cmake Show resolved Hide resolved

macumber reviewed Aug 28, 2024

View reviewed changes

CMakeLists.txt Show resolved Hide resolved

jmarrec merged commit a78a443 into develop Aug 29, 2024
10 checks passed

jmarrec deleted the codesigning branch August 29, 2024 22:44

github-actions bot locked and limited conversation to collaborators Aug 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Codesign on macOS #727

Codesign on macOS #727

jmarrec commented Aug 24, 2024

jmarrec commented Aug 27, 2024 •

edited

Loading

jmarrec commented Aug 27, 2024

macumber commented Aug 28, 2024

jmarrec commented Aug 29, 2024

Codesign on macOS #727

Codesign on macOS #727

Conversation

jmarrec commented Aug 24, 2024

Included works

Demonstration

Before signing

With signing

jmarrec commented Aug 27, 2024 • edited Loading

jmarrec commented Aug 27, 2024

macumber commented Aug 28, 2024

jmarrec commented Aug 29, 2024

jmarrec commented Aug 27, 2024 •

edited

Loading