fix(cli): use ditto instead of fs::copy to preserve macOS code signing#113
fix(cli): use ditto instead of fs::copy to preserve macOS code signing#113DorianZheng wants to merge 1 commit intomainfrom
Conversation
|
@shayne-snap Hi, I found a bug when use rust std::fs::copy didn't preserve signing. Would you like to review? |
Replace Rust's fs::copy() with macOS ditto command in build.rs to preserve code signing metadata when copying runtime files. Problem: CLI and shim binaries were killed with SIGKILL (exit 137) on macOS because fs::copy() creates new files that lose code signing extended attributes, causing "Invalid Page" code signature validation failures at dyld load time. Solution: Use ditto on macOS which preserves extended attributes, resource forks, and code signing metadata. Use cp -R -T on Linux.
DorianZheng
force-pushed
the
fix/cli-macos-copy-metadata
branch
from
886a8ed to
eccbc7b
Compare
|
Hi @DorianZheng I haven't came across this problem on my laptop(Apple chip M2). Which platform are you on? bcz I'm using runtime-debug? Line 91 in 7d662d7 |
Hi, my mac chip is |
|
After executing |
|
LGTM |
@shayne-snap Ahhh, that's weird. I will paste the reproduce steps here in some time. Before that, I will leave this PR open and won't merge it. |
|
I test on M2 chip and macOS Sequoia. It also works for me. |
I came across the same problem on my laptop after I created two dirs in |
|
This PR works for me. Could you merge it into main? @DorianZheng |
3 participants
Summary
fs::copy()with macOSdittocommand inbuild.rsto preserve code signing metadata when copying runtime filescp -R -Ton Linux for similar behaviorProblem
CLI and shim binaries were killed with SIGKILL (exit 137) on macOS because
fs::copy()creates new files that lose code signing extended attributes, causing "Invalid Page" code signature validation failures at dyld load time.The crash report showed:
Root Cause
fs::copy()creates a new file that doesn't preserve macOS code signing metadatatarget/boxlite-runtime/to~/.local/share/boxlite/, the code signatures become invalidSolution
Use
dittoon macOS which preserves extended attributes, resource forks, and code signing metadata.Test plan
rm -rf ~/.local/share/boxlite && make cli./target/debug/boxlite -hshows help~/.local/share/boxlite/boxlite-shim --helpshows help