Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Installation via Bitcoin-Core.dmg is broken on macOS (Apple Silicon) #22403

Closed
hebasto opened this issue Jul 5, 2021 · 9 comments · Fixed by #22546
Closed

Installation via Bitcoin-Core.dmg is broken on macOS (Apple Silicon) #22403

hebasto opened this issue Jul 5, 2021 · 9 comments · Fixed by #22546
Labels
Bug Build system macOS

Comments

@hebasto
Copy link
Member

hebasto commented Jul 5, 2021 •
edited
Loading

System: macOS Big Sur 11.4 (20F71), chip Apple M1.

On master (c609e10), after succesfull make deploy (without depends), the app installed from Bitcoin-Core.dmg fails to run.

src/qt/bitcoin-qt works flawlessly.
@jarolrod
Copy link
Member

jarolrod commented Jul 5, 2021

will test but I believe this was supposed to fix it? #21658

@hebasto
Copy link
Member Author

hebasto commented Jul 5, 2021 •
edited
Loading

will test but I believe this was supposed to fix it? #21658

I've update the OP to mentioned the issue happens on master (c609e10).

UPDATE:

% /opt/homebrew/bin/python3.9 -m pip show mac_alias 
Name: mac-alias
Version: 2.2.0
Summary: Generate/parse Mac OS Alias records from Python
Home-page: http://alastairs-place.net/projects/mac_alias
Author: Alastair Houghton
Author-email: alastair@alastairs-place.net
License: MIT License
Location: /opt/homebrew/lib/python3.9/site-packages
Requires: 
Required-by: ds-store

@hebasto
Copy link
Member Author

hebasto commented Jul 5, 2021

@jarolrod

Building with depends, make deploy, and the following installation from *.dmg works fine.

@jarolrod
Copy link
Member

jarolrod commented Jul 5, 2021

ah right, that's the difference. Noted

@prusnak
Copy link
Contributor

prusnak commented Jul 6, 2021 •
edited
Loading

Building with depends, make deploy, and the following installation from *.dmg works fine.

Shouldn't make deploy depend on (at least part of) make -C depends then?

@bitcoin bitcoin deleted a comment from ccr781 Jul 8, 2021
@fanquake
Copy link
Member

fanquake commented Jul 9, 2021

the app installed from Bitcoin-Core.dmg fails to run.

Hard to debug anything here with such little information. For what it's worth, I've installed from the .dmg after a non depends builds, and from what I can see, the issue is related to us running strip & install_name_tool on libs while building the .dmg. This breaks some Apple code-signing requirement, and prevents the app from launching.

Looks like some other projects have run into a similar issue when doing the same thing. i.e: https://gitlab.kitware.com/cmake/cmake/-/issues/21854.

@hebasto
Copy link
Member Author

hebasto commented Jul 11, 2021

According to https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes it looks like the binaries must be signed (at least with ad-hoc signatures):

codesign --sign - --deep --force dist/Bitcoin-Qt.app

@fanquake fanquake mentioned this issue Jul 13, 2021
Merged
@achow101
Copy link
Member

signapple should already be able to make signatures for universal binaries, so we should be good for releases.

@hebasto hebasto mentioned this issue Jul 25, 2021
Merged
@hebasto
Copy link
Member Author

hebasto commented Jul 25, 2021

According to https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes it looks like the binaries must be signed (at least with ad-hoc signatures):

codesign --sign - --deep --force dist/Bitcoin-Qt.app

Done in #22546.

sidhujag pushed a commit to syscoin/syscoin that referenced this issue Feb 23, 2022
@fanquake
Merge bitcoin#22546: build, qt: Fix make deploy on M1-based macOS w…
88aeaee 
…ith system frameworks

1513727 build, qt: (Re-)sign package (Hennadii Stepanov)
c26a0a5 build, qt: Align frameworks with macOS codesign tool requirements (Hennadii Stepanov)

Pull request description:

  Fixes bitcoin#22403

  This PR follows Apple [docs](https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes):
  >  - New in macOS 11 on Macs with Apple silicon, and starting in macOS Big Sur 11 beta 6, the operating system enforces that any executable must be signed before it’s allowed to run. There isn’t a specific identity requirement for this signature: a simple ad-hoc signature is sufficient...
  >  - ... If you use a custom workflow involving tools that modify a binary after linking (e.g. `strip` or `install_name_tool`) you might need to manually call `codesign` as an additional build phase to properly ad-hoc sign your binary. These new signatures are not bound to the specific machine that was used to build the executable, they can be verified on any other system and will be sufficient to comply with the new default code signing requirement on Macs with Apple silicon...

  When building with system Qt frameworks (i.e., without depends), a new string has been added to the `make deploy` log on M1-based macOS:
  ```
  % make deploy
  ...
  + Generating .DS_Store +
  dist/Bitcoin-Qt.app: replacing existing signature
  + Preparing .dmg disk image +
  ...
  ```

  This PR does not change build system behavior:
  - when building with depends
  - on Intel-based macOS

ACKs for top commit:
  jarolrod:
    ACK 1513727
  fanquake:
    ACK 1513727 - although didn't test on M1 hardware. Given the forced signing is scoped to only occur when running the deploy script on macOS, this doesn't interfere with our release signing.

Tree-SHA512: 3aa778fdd6ddb54f029f632f2fe52c2ae3bb197ba564cb776493aa5c3a655bd51d10ccbe6c007372d717e9b01fc4193dd5c29ea0bc7e069dcae7e991ae259f0c
@bitcoin bitcoin locked and limited conversation to collaborators Feb 23, 2023
knst pushed a commit to knst/dash that referenced this issue Nov 20, 2023
@fanquake @knst
Merge bitcoin#22546: build, qt: Fix make deploy on M1-based macOS w…
1a717e9 
…ith system frameworks

1513727 build, qt: (Re-)sign package (Hennadii Stepanov)
c26a0a5 build, qt: Align frameworks with macOS codesign tool requirements (Hennadii Stepanov)

Pull request description:

  Fixes bitcoin#22403

  This PR follows Apple [docs](https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes):
  >  - New in macOS 11 on Macs with Apple silicon, and starting in macOS Big Sur 11 beta 6, the operating system enforces that any executable must be signed before it’s allowed to run. There isn’t a specific identity requirement for this signature: a simple ad-hoc signature is sufficient...
  >  - ... If you use a custom workflow involving tools that modify a binary after linking (e.g. `strip` or `install_name_tool`) you might need to manually call `codesign` as an additional build phase to properly ad-hoc sign your binary. These new signatures are not bound to the specific machine that was used to build the executable, they can be verified on any other system and will be sufficient to comply with the new default code signing requirement on Macs with Apple silicon...

  When building with system Qt frameworks (i.e., without depends), a new string has been added to the `make deploy` log on M1-based macOS:
  ```
  % make deploy
  ...
  + Generating .DS_Store +
  dist/Bitcoin-Qt.app: replacing existing signature
  + Preparing .dmg disk image +
  ...
  ```

  This PR does not change build system behavior:
  - when building with depends
  - on Intel-based macOS

ACKs for top commit:
  jarolrod:
    ACK 1513727
  fanquake:
    ACK 1513727 - although didn't test on M1 hardware. Given the forced signing is scoped to only occur when running the deploy script on macOS, this doesn't interfere with our release signing.

Tree-SHA512: 3aa778fdd6ddb54f029f632f2fe52c2ae3bb197ba564cb776493aa5c3a655bd51d10ccbe6c007372d717e9b01fc4193dd5c29ea0bc7e069dcae7e991ae259f0c
PastaPastaPasta pushed a commit to knst/dash that referenced this issue Nov 24, 2023
@fanquake @PastaPastaPasta
Merge bitcoin#22546: build, qt: Fix make deploy on M1-based macOS w…
23adfb7 
…ith system frameworks

1513727 build, qt: (Re-)sign package (Hennadii Stepanov)
c26a0a5 build, qt: Align frameworks with macOS codesign tool requirements (Hennadii Stepanov)

Pull request description:

  Fixes bitcoin#22403

  This PR follows Apple [docs](https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes):
  >  - New in macOS 11 on Macs with Apple silicon, and starting in macOS Big Sur 11 beta 6, the operating system enforces that any executable must be signed before it’s allowed to run. There isn’t a specific identity requirement for this signature: a simple ad-hoc signature is sufficient...
  >  - ... If you use a custom workflow involving tools that modify a binary after linking (e.g. `strip` or `install_name_tool`) you might need to manually call `codesign` as an additional build phase to properly ad-hoc sign your binary. These new signatures are not bound to the specific machine that was used to build the executable, they can be verified on any other system and will be sufficient to comply with the new default code signing requirement on Macs with Apple silicon...

  When building with system Qt frameworks (i.e., without depends), a new string has been added to the `make deploy` log on M1-based macOS:
  ```
  % make deploy
  ...
  + Generating .DS_Store +
  dist/Bitcoin-Qt.app: replacing existing signature
  + Preparing .dmg disk image +
  ...
  ```

  This PR does not change build system behavior:
  - when building with depends
  - on Intel-based macOS

ACKs for top commit:
  jarolrod:
    ACK 1513727
  fanquake:
    ACK 1513727 - although didn't test on M1 hardware. Given the forced signing is scoped to only occur when running the deploy script on macOS, this doesn't interfere with our release signing.

Tree-SHA512: 3aa778fdd6ddb54f029f632f2fe52c2ae3bb197ba564cb776493aa5c3a655bd51d10ccbe6c007372d717e9b01fc4193dd5c29ea0bc7e069dcae7e991ae259f0c
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Bug Build system macOS
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

build, qt: Fix make deploy on M1-based macOS with system frameworks hebasto/bitcoin
5 participants
@prusnak @fanquake @achow101 @jarolrod @hebasto