build, qt: Fix `make deploy` on M1-based macOS with system frameworks #22546

hebasto · 2021-07-25T15:38:35Z

This PR follows Apple docs:

New in macOS 11 on Macs with Apple silicon, and starting in macOS Big Sur 11 beta 6, the operating system enforces that any executable must be signed before it’s allowed to run. There isn’t a specific identity requirement for this signature: a simple ad-hoc signature is sufficient...

... If you use a custom workflow involving tools that modify a binary after linking (e.g. strip or install_name_tool) you might need to manually call codesign as an additional build phase to properly ad-hoc sign your binary. These new signatures are not bound to the specific machine that was used to build the executable, they can be verified on any other system and will be sufficient to comply with the new default code signing requirement on Macs with Apple silicon...

When building with system Qt frameworks (i.e., without depends), a new string has been added to the make deploy log on M1-based macOS:

% make deploy
...
+ Generating .DS_Store +
dist/Bitcoin-Qt.app: replacing existing signature
+ Preparing .dmg disk image +
...

This PR does not change build system behavior:

when building with depends
on Intel-based macOS

fanquake

ee722d3: It's not clear what this commit is doing, or what Align frameworks with macOS codesign tool requirements is meant to mean. You've also imported subprocess and not used it.

fanquake · 2021-07-29T06:33:19Z

contrib/macdeploy/macdeployqtplus

@@ -543,6 +546,9 @@ ds.close()

 # ------------------------------------------------

+if need_to_sign_target and platform.system() == "Darwin" and platform.machine() == "arm64":


Is there a problem with just always signing in the need_to_sign_target case, i.e non-depends builds, rather than making this specific to arm64?

Not a problem at all, just not required.

Probably easier to just always sign then. Otherwise this should have an explainer.

Is the following comment good as an explanation (compiled from Apple docs):

"In macOS 11 on Macs with Apple silicon the operating system enforces that any executable must be signed before it’s allowed to run. After using tools such as strip or install_name_tool, to call codesign is required to properly ad-hoc sign binaries."

?

I agree that adding a comment here makes sense. It's not obvious why this would be ARM-only.

I am of the opinion that it is just easier to always sign. Right now the requirement is only for apple silicon, but I have not seen anything to say that this wouldn't expand to remaining intel Macs in future OS versions.

If we stick with only signing for arm, then the following is a suitable comment:

"Starting with macOS 11 on Apple silicon, executables must be signed before they are allowed to run."

Probably easier to just always sign then. Otherwise this should have an explainer.

Updated.

hebasto · 2021-07-29T13:46:32Z

ee722d3: It's not clear what this commit is doing, or what Align frameworks with macOS codesign tool requirements is meant to mean.

Yeah, it was a hard time for me to choose a right wording. Without the first commit the signing tool returns an error:

% make deploy
...
dist/Bitcoin-Qt.app: replacing existing signature
dist/Bitcoin-Qt.app: bundle format unrecognized, invalid, or unsuitable
In subcomponent: /Users/hebasto/bitcoin/dist/Bitcoin-Qt.app/Contents/Frameworks/QtPrintSupport.framework
Traceback (most recent call last):
  File "/Users/hebasto/bitcoin/./contrib/macdeploy/macdeployqtplus", line 552, in <module>
    subprocess.check_call(f"codesign --deep --force --sign - {target}", shell=True)
  File "/opt/homebrew/Cellar/python@3.9/3.9.6/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 373, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command 'codesign --deep --force --sign - dist/Bitcoin-Qt.app' returned non-zero exit status 1.
make: *** [Bitcoin-Core.dmg] Error 1

hebasto · 2021-07-29T15:15:24Z

Updated 4d489dd -> bbdd588 (pr22546.02 -> pr22546.03, diff):

addressed @fanquake's comment:

You've also imported subprocess and not used it.

fanquake · 2021-07-30T03:13:38Z

Yeah, it was a hard time for me to choose a right wording. Without the first commit the signing tool returns an error:

Ok. I'll have a look. This needs a better commit message (with explanation), otherwise by itself, it's not clear what problem it's fixing or why it's the correct solution.

RandyMcMillan · 2021-08-11T04:52:33Z

Tested on macOS 11.4 (20F71)

Note:

Technically the package import order is not standard.
This may be a good time to bring it into compliance.

RandyMcMillan@d8deef3

Zero-1729

tACK bbdd588

Tested on macOS v11.4

On master, the built app from DMG is broken. I get the following error when attempting to launch it:

After Patch

I can confirm this patch fixes that; opening the built app in the DMG works as expected (Bitcoin-Qt.app opens normally).

$ make -j9 deploy
...
+ Adding Qt translations +
+ Installing qt.conf +
+ Generating .DS_Store +
dist/Bitcoin-Qt.app: replacing existing signature
+ Preparing .dmg disk image +
........................................................................................................
created: /Users/abubakar/Github/bitcoin/Bitcoin-Core.temp.dmg
+ Applying fancy settings +
+ Finalizing .dmg disk image +
"disk4" ejected.
Preparing imaging engine…
Reading Protective Master Boot Record (MBR : 0)…
   (CRC32 $251F7180: Protective Master Boot Record (MBR : 0))
Reading GPT Header (Primary GPT Header : 1)…
   (CRC32 $0E7F79E8: GPT Header (Primary GPT Header : 1))
Reading GPT Partition Data (Primary GPT Table : 2)…
   (CRC32 $46B32FF2: GPT Partition Data (Primary GPT Table : 2))
Reading  (Apple_Free : 3)…
   (CRC32 $00000000:  (Apple_Free : 3))
Reading disk image (Apple_APFS : 4)…
.................................................................................................................................................................................
   (CRC32 $0AE0B07F: disk image (Apple_APFS : 4))
Reading  (Apple_Free : 5)…
.................................................................................................................................................................................
   (CRC32 $00000000:  (Apple_Free : 5))
Reading GPT Partition Data (Backup GPT Table : 6)…
.................................................................................................................................................................................
   (CRC32 $46B32FF2: GPT Partition Data (Backup GPT Table : 6))
Reading GPT Header (Backup GPT Header : 7)…
.................................................................................................................................................................................
   (CRC32 $F4C2505D: GPT Header (Backup GPT Header : 7))
Adding resources…
.................................................................................................................................................................................
Elapsed Time:  3.616s
File size: 17954445 bytes, Checksum: CRC32 $CA646B34
Sectors processed: 134790, 80803 compressed
Speed: 10.9Mbytes/sec
Savings: 74.0%
created: /Users/abubakar/Github/bitcoin/Bitcoin-Core.dmg
+ Done +

$ file Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt 
Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt: Mach-O 64-bit executable arm64

jarolrod

on an M1 mac, the application is recognized as an IOS application, it should be recognized as Apple Silicon. Obviously, we are not building an IOS application and it is not an IOS executable. The system is just categorizing it wrong. But, why?

My current thinking with what is going on is that it could be related to LSArchitecturePriority, this field is still set as x86_64 when it should be set as arm64:

  <key>LSArchitecturePriority</key>
  <array>
    <string>x86_64</string>
  </array>

jarolrod

Concept ACK, need to do more testing in relation to signing and macOS 12.

I have fixed the issue mentioned here about the deployed app's categorization in #418. If you find it appropriate, feel free to close that PR and include the commit here 🥃

contrib/macdeploy/macdeployqtplus

hebasto · 2021-09-05T09:56:38Z

Updated bbdd588 -> 462e632 (pr22546.03 -> pr22546.04):

addressed @jarolrod's comment
rebased on the recent CI code

contrib/macdeploy/macdeployqtplus

3765c48 qt: fix bitcoin-qt app categorization on apple silicon (Jarol Rodriguez) Pull request description: `System Information` contains many insights into various aspects of your macOS system; the 'Applications' tab contains info on apps. Starting with macOS 11, the 'kind' column under the 'Applications' tab started displaying the CPU architecture of the application. The options are; apple silicon, intel, universal. Previously, the `kind` column indicated where the application originated. The change was made to conveniently determine if the app installed was built to run natively on the new M1 CPU or an intel app that will run under rosetta. Of course, there are several other tools to confirm this; the 'kind' column provides a user-friendly way. We expect that Bitcoin Core compiled, built, and deployed on an intel CPU will be classified as `Intel`. Similarly, we expect that if this is done on an M1 mac, the resulting app is classified as `Apple Silicon`. In reality, Bitcoin-qt built and deployed on an M1 mac will be classified as `IOS`. This behavior is incorrect and should be fixed. We fix this by setting the `CFBundleSupportedPlatforms` in our info.plist to the value of `MacOSX`. In doing this, we are telling macOS, "We do not support IOS; stop it!". Tested and confirmed that this is a no-op on macOS < 11. | On [#22546](bitcoin/bitcoin#22546) Branch | [#22546](bitcoin/bitcoin#22546) + PR Branch | | ------------------------------------------------------------------- | ----------- | | ![Screen Shot 2021-09-04 at 6 21 49 PM](https://user-images.githubusercontent.com/23396902/132113868-c697d699-12c3-4834-8b8a-003ff475d946.jpeg) | ![Screen Shot 2021-09-04 at 6 12 14 PM](https://user-images.githubusercontent.com/23396902/132113875-6f004f72-4108-41d6-ab03-e90d3e400713.jpeg) | **To Test:** For testing, our base branch will be [#22546](bitcoin/bitcoin#22546). Please perform the following steps on the base branch and then the base branch with the commit from this PR cherry-picked onto it: - Have an M1 mac - Compile and deploy bitcoin - Open up the deployed *.dmg, installed the bundled app - Eject the bitcoin dmg that should currently be mounted - Navigate to System Information -> Applications - Click on the top-left Apple icon - Click about this mac - Click on the 'Storage' tab - Click on the 'Manage...' button - On the left, click on 'Applications' - Sort by Name - Look for the Bitcoin Core application - Base Branch: The kind column should state that this application is of type `IOS` - PR Branch: The kind column should state that this application is of type `Apple Silicon` Note: Intel users on at least macOS 11 can help test by confirming that the application still shows up as kind=`Intel` ACKs for top commit: hebasto: ACK 3765c48 Tree-SHA512: 666672025e81e59fe1803859a7f9a4fd3b93a3aba05a163ce223c36081dd579b866d071455608011a19d9ba0c3e9f564cca0c4cb941452f2b51f4ef0dfead1fa

hebasto · 2021-09-14T11:45:52Z

Updated 462e632 -> c206adc (pr22546.04 -> pr22546.05):

addressed @fanquake's comment:

Probably easier to just always sign then. Otherwise this should have an explainer.

rebased on top of the merged fix bitcoin-qt app categorization on apple silicon bitcoin-core/gui#418

…e silicon 3765c48 qt: fix bitcoin-qt app categorization on apple silicon (Jarol Rodriguez) Pull request description: `System Information` contains many insights into various aspects of your macOS system; the 'Applications' tab contains info on apps. Starting with macOS 11, the 'kind' column under the 'Applications' tab started displaying the CPU architecture of the application. The options are; apple silicon, intel, universal. Previously, the `kind` column indicated where the application originated. The change was made to conveniently determine if the app installed was built to run natively on the new M1 CPU or an intel app that will run under rosetta. Of course, there are several other tools to confirm this; the 'kind' column provides a user-friendly way. We expect that Bitcoin Core compiled, built, and deployed on an intel CPU will be classified as `Intel`. Similarly, we expect that if this is done on an M1 mac, the resulting app is classified as `Apple Silicon`. In reality, Bitcoin-qt built and deployed on an M1 mac will be classified as `IOS`. This behavior is incorrect and should be fixed. We fix this by setting the `CFBundleSupportedPlatforms` in our info.plist to the value of `MacOSX`. In doing this, we are telling macOS, "We do not support IOS; stop it!". Tested and confirmed that this is a no-op on macOS < 11. | On [bitcoin#22546](bitcoin#22546) Branch | [bitcoin#22546](bitcoin#22546) + PR Branch | | ------------------------------------------------------------------- | ----------- | | ![Screen Shot 2021-09-04 at 6 21 49 PM](https://user-images.githubusercontent.com/23396902/132113868-c697d699-12c3-4834-8b8a-003ff475d946.jpeg) | ![Screen Shot 2021-09-04 at 6 12 14 PM](https://user-images.githubusercontent.com/23396902/132113875-6f004f72-4108-41d6-ab03-e90d3e400713.jpeg) | **To Test:** For testing, our base branch will be [bitcoin#22546](bitcoin#22546). Please perform the following steps on the base branch and then the base branch with the commit from this PR cherry-picked onto it: - Have an M1 mac - Compile and deploy bitcoin - Open up the deployed *.dmg, installed the bundled app - Eject the bitcoin dmg that should currently be mounted - Navigate to System Information -> Applications - Click on the top-left Apple icon - Click about this mac - Click on the 'Storage' tab - Click on the 'Manage...' button - On the left, click on 'Applications' - Sort by Name - Look for the Bitcoin Core application - Base Branch: The kind column should state that this application is of type `IOS` - PR Branch: The kind column should state that this application is of type `Apple Silicon` Note: Intel users on at least macOS 11 can help test by confirming that the application still shows up as kind=`Intel` ACKs for top commit: hebasto: ACK 3765c48 Tree-SHA512: 666672025e81e59fe1803859a7f9a4fd3b93a3aba05a163ce223c36081dd579b866d071455608011a19d9ba0c3e9f564cca0c4cb941452f2b51f4ef0dfead1fa

RandyMcMillan · 2021-09-22T20:19:31Z

tACK c206adc

dongcarl · 2022-01-26T20:23:07Z

Haven't looked into the code deeply, but I had the exact same problem as #22546 (review), and using this patch fixed it.

Apparently codesigning verification with M1 Macs are a lot stricter than with non-M1 Macs, which is what causes the above problem.

fanquake · 2022-01-28T06:38:14Z

Could you rebase this now that #21851 has been merged?

hebasto · 2022-01-28T20:54:36Z

Could you rebase this now that #21851 has been merged?

Rebased c206adc -> c9cb557 (pr22546.05 -> pr22546.06).

hebasto · 2022-01-28T21:12:13Z

Guix builds:

$ env HOSTS='x86_64-apple-darwin arm64-apple-darwin' ./contrib/guix/guix-build
$ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
f62bd85dd3928ba391afbff31ccdd9907e5cb60d8ffa80b3d30941910e6c0dbb  guix-build-c9cb5574468d/output/arm64-apple-darwin/SHA256SUMS.part
6c154b25f46966b1b4f3db68efcd6ba7dc98b6777af30d28ced87c510a6b9ef3  guix-build-c9cb5574468d/output/arm64-apple-darwin/bitcoin-c9cb5574468d-arm64-apple-darwin.tar.gz
1ba428c8c5af244b2a3ae17f3fec2f0c56da54214034fb4499f6c915dfe8c6fd  guix-build-c9cb5574468d/output/arm64-apple-darwin/bitcoin-c9cb5574468d-osx-unsigned.dmg
46fd56b4566dec7df25f941cc61a51d9e0645f6729da1955725eb6e877f5a96f  guix-build-c9cb5574468d/output/arm64-apple-darwin/bitcoin-c9cb5574468d-osx-unsigned.tar.gz
9ddf675f91d5dc0c89cc7adb929e60d26e113d4a0e7ec309c4ee0da5e57164d8  guix-build-c9cb5574468d/output/dist-archive/bitcoin-c9cb5574468d.tar.gz
8d7545aa56cd6ab7aca5f0e65a43a6d14644cd65768cb3fda6396edb934bf7e3  guix-build-c9cb5574468d/output/x86_64-apple-darwin/SHA256SUMS.part
a37588563758c493241e3be2422919a51933c73b48458f7e01bde5f51470a3b3  guix-build-c9cb5574468d/output/x86_64-apple-darwin/bitcoin-c9cb5574468d-osx-unsigned.dmg
33075026fbc8cde0b83988d8f544e3d56a894b02f684554bc06143cc1400e102  guix-build-c9cb5574468d/output/x86_64-apple-darwin/bitcoin-c9cb5574468d-osx-unsigned.tar.gz
1769bb344dc7ff2caf32ed21a645f7c24b1cb736550508f8c654c2096140e11e  guix-build-c9cb5574468d/output/x86_64-apple-darwin/bitcoin-c9cb5574468d-osx64.tar.gz

hebasto · 2022-02-06T10:20:13Z

Rebased c9cb557 -> 06909e4 (pr22546.06 -> pr22546.07).

hebasto · 2022-02-06T10:53:36Z

Guix builds:

$ env HOSTS='x86_64-apple-darwin arm64-apple-darwin' ./contrib/guix/guix-build
$ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
e7699d91489e62f0593b92b4a2bb7c55a0234f2dcbf988c91ac56fcf10828c3e  guix-build-06909e4f2678/output/arm64-apple-darwin/SHA256SUMS.part
45e0526a05685158bf20fd1c57cd412a3f82c1bdf1250a244f0890b32ed025f6  guix-build-06909e4f2678/output/arm64-apple-darwin/bitcoin-06909e4f2678-arm64-apple-darwin.tar.gz
ce1ff6b4fc996c38c1e681ad268fd110cd452c9da666b46d06cea6f55a7e19fd  guix-build-06909e4f2678/output/arm64-apple-darwin/bitcoin-06909e4f2678-osx-unsigned.dmg
6fdbf122cecc8e07d8d2853e805dbe2df7d470a8de3594a454df0817f5ba8f71  guix-build-06909e4f2678/output/arm64-apple-darwin/bitcoin-06909e4f2678-osx-unsigned.tar.gz
cca1b3b2029c780165bb1206c7810298c1996134541a649b124a34b607ae26fa  guix-build-06909e4f2678/output/dist-archive/bitcoin-06909e4f2678.tar.gz
8a433dc326f3c054d0f607727fcebfb46585e0d83ddcfc27b511c2421d760734  guix-build-06909e4f2678/output/x86_64-apple-darwin/SHA256SUMS.part
06a838d7388bbdac7ec9be89d467b061d72256215e787695f05513d3a0c112ae  guix-build-06909e4f2678/output/x86_64-apple-darwin/bitcoin-06909e4f2678-osx-unsigned.dmg
c388c66896ea0c201d735f236ad9733ae14c4c9f78618cdaae7d7fefbd552ab8  guix-build-06909e4f2678/output/x86_64-apple-darwin/bitcoin-06909e4f2678-osx-unsigned.tar.gz
0e04bff3b9b0f33a83782a7dab5720a2f64344ae44c338ae2ab2292cc23146f4  guix-build-06909e4f2678/output/x86_64-apple-darwin/bitcoin-06909e4f2678-osx64.tar.gz

Zero-1729

re-tACK 06909e4

Tested on macOS 12.2.1 (21D62)

Patch still works as expected; the generated app in the DMG launches without any errors.

Currently the codesign tool fails to sign copied frameworks.

Starting with macOS 11 on Apple silicon, executables must be signed before they are allowed to run.

hebasto · 2022-02-17T12:12:23Z

Rebased 06909e4 -> 1513727 (pr22546.07 -> pr22546.08) on top of the merged #24348.

hebasto · 2022-02-17T17:33:04Z

Guix builds:

$ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
0793e0ac20b1f3abc2e5159e9038d70eb0138630eef595782fc996f5e704d68a  guix-build-1513727e2b38/output/aarch64-linux-gnu/SHA256SUMS.part
56cdca87802db062b32a4bba60ef7f39e5aee4a9779cef35071cc914fea1bf0e  guix-build-1513727e2b38/output/aarch64-linux-gnu/bitcoin-1513727e2b38-aarch64-linux-gnu-debug.tar.gz
576308ed1fb69ebebbce4f7c1252373de8875cd949386b1a13b53fe6d6c954b5  guix-build-1513727e2b38/output/aarch64-linux-gnu/bitcoin-1513727e2b38-aarch64-linux-gnu.tar.gz
0f39af36a605bac0f1bfe5118a1e9e4b0807f6fc25ee72600aabb19bb9a85fb5  guix-build-1513727e2b38/output/arm-linux-gnueabihf/SHA256SUMS.part
04f402e3b75c3643d74e7f1ecbcb9f56e45561d39423755abb9d5f1ecbaa1019  guix-build-1513727e2b38/output/arm-linux-gnueabihf/bitcoin-1513727e2b38-arm-linux-gnueabihf-debug.tar.gz
027ee6368839531b57c1907927dd4967765299447ded1c12cc17c64b13fddbef  guix-build-1513727e2b38/output/arm-linux-gnueabihf/bitcoin-1513727e2b38-arm-linux-gnueabihf.tar.gz
0cf76bb70bd6f446a99ea7cade2357cceef16fe63f1d1258087d13642f024f9c  guix-build-1513727e2b38/output/arm64-apple-darwin/SHA256SUMS.part
0c9246cef1ae82f37f5618308b477e7548e09ce94613ab9c43e3160a0f0450a7  guix-build-1513727e2b38/output/arm64-apple-darwin/bitcoin-1513727e2b38-arm64-apple-darwin.tar.gz
51dcbcfd86e55e36ee299ff4f3a5e2e2baec06755a4b149742616fa5c691a3b5  guix-build-1513727e2b38/output/arm64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.dmg
fd16a158dd2ae9f90d61de4a8d4e287458d42e5e6b5bd6aece6b2bd18cbc73c5  guix-build-1513727e2b38/output/arm64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.tar.gz
b18f242456aeeddf37cc31f001221593283b020f35ba72e375f69a4c602a3970  guix-build-1513727e2b38/output/dist-archive/bitcoin-1513727e2b38.tar.gz
6b411193b4a60fb37e7809a1df45e465feaf09ff4ad2d7cbb293e0838774591d  guix-build-1513727e2b38/output/powerpc64-linux-gnu/SHA256SUMS.part
5b8d26f66d30de098f790ef3cf632eb8aa85f9c680f6c2cdaee9076227f627c2  guix-build-1513727e2b38/output/powerpc64-linux-gnu/bitcoin-1513727e2b38-powerpc64-linux-gnu-debug.tar.gz
95d6811384228b2b2dca487b87027fc3704416def3d2574df511c1f75febb7af  guix-build-1513727e2b38/output/powerpc64-linux-gnu/bitcoin-1513727e2b38-powerpc64-linux-gnu.tar.gz
2887fd0d7f618b1ece5dee2909867606d2ff60e10d9bb4f48d69bcb4f4256948  guix-build-1513727e2b38/output/powerpc64le-linux-gnu/SHA256SUMS.part
a8f9598eefb77bdcbe7317636921d633b1af0210608d9f033027bf1d5d0152f2  guix-build-1513727e2b38/output/powerpc64le-linux-gnu/bitcoin-1513727e2b38-powerpc64le-linux-gnu-debug.tar.gz
0b7851c32dc1df406b71e68a5bd1c61dc4062b4e5a7d08c026ed3191682e5d2a  guix-build-1513727e2b38/output/powerpc64le-linux-gnu/bitcoin-1513727e2b38-powerpc64le-linux-gnu.tar.gz
cff4e6eb1afd5fb403e3afebc15b59ae34f593cc956666e692eff1ac0b031eb0  guix-build-1513727e2b38/output/riscv64-linux-gnu/SHA256SUMS.part
093723e11f3fd55feb34acd5fae2c1d48cf9251edfd8e286ccfca26d5b3d4408  guix-build-1513727e2b38/output/riscv64-linux-gnu/bitcoin-1513727e2b38-riscv64-linux-gnu-debug.tar.gz
d8cc7ffdc9e3ce0ff610d0fa71d5eeca18f7f27b9a76a4b21fd89c343a002eaa  guix-build-1513727e2b38/output/riscv64-linux-gnu/bitcoin-1513727e2b38-riscv64-linux-gnu.tar.gz
c33f78cbf09ff0d71bae8a971030fac0a7fcf8e8ae745b7ae35ec8ef0979105b  guix-build-1513727e2b38/output/x86_64-apple-darwin/SHA256SUMS.part
6bc78aa850bfe906ae6593e6e44b9d1d95b0977ff9dd227fd355f938b75cdd64  guix-build-1513727e2b38/output/x86_64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.dmg
6066fc635615cf9e918c0ec8579588683d5f9b2a0f14d57a4d2576f199746b9a  guix-build-1513727e2b38/output/x86_64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.tar.gz
c43582f8ecef39f049cbba11c4e646e011ac3cff4a59582435bb8733b30b12f0  guix-build-1513727e2b38/output/x86_64-apple-darwin/bitcoin-1513727e2b38-osx64.tar.gz
04da85b5eeeb4549f1d74902596853ace814d704fac21ee963d737142f5cee7d  guix-build-1513727e2b38/output/x86_64-linux-gnu/SHA256SUMS.part
53274875268d4b18b36c487e3410961381d1960772c5def082bf3048659bc899  guix-build-1513727e2b38/output/x86_64-linux-gnu/bitcoin-1513727e2b38-x86_64-linux-gnu-debug.tar.gz
8e93f32641da9f574d228429dc8133bccb9b3a499c0654ea81148a6ca2a4124d  guix-build-1513727e2b38/output/x86_64-linux-gnu/bitcoin-1513727e2b38-x86_64-linux-gnu.tar.gz
e911fc37258f7a26976fe0a66f0af69bf89ed95e71064cdbd3e2615d18e13d8c  guix-build-1513727e2b38/output/x86_64-w64-mingw32/SHA256SUMS.part
e1f9ce7c661e97d69f9f5518071cf70fd4cc75c186941fed9ba4678ad8a9ed22  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win-unsigned.tar.gz
ddbc59f27da63b2e2a65b1b323bcda604570c63e5886692808d0bda455c97ce1  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win64-debug.zip
53e2fd55381470496fe800854c03a03bbf2189bd8e0ab5617942281c9df1ef4f  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win64-setup-unsigned.exe
79519d66034fecd41886f5ec4caae433fd7d3d5c182d068fc45ef9260ef2bdf7  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win64.zip

jarolrod

ACK 1513727

Testing on an m1 machine; I have confirmed the issue on master, and this PR fixes it. Also tested on an Intel Mac to ensure that there's no ill side effects of this change on that platform.

fanquake

ACK 1513727 - although didn't test on M1 hardware. Given the forced signing is scoped to only occur when running the deploy script on macOS, this doesn't interfere with our release signing.

Guix Build:

bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
0793e0ac20b1f3abc2e5159e9038d70eb0138630eef595782fc996f5e704d68a  guix-build-1513727e2b38/output/aarch64-linux-gnu/SHA256SUMS.part
56cdca87802db062b32a4bba60ef7f39e5aee4a9779cef35071cc914fea1bf0e  guix-build-1513727e2b38/output/aarch64-linux-gnu/bitcoin-1513727e2b38-aarch64-linux-gnu-debug.tar.gz
576308ed1fb69ebebbce4f7c1252373de8875cd949386b1a13b53fe6d6c954b5  guix-build-1513727e2b38/output/aarch64-linux-gnu/bitcoin-1513727e2b38-aarch64-linux-gnu.tar.gz
0f39af36a605bac0f1bfe5118a1e9e4b0807f6fc25ee72600aabb19bb9a85fb5  guix-build-1513727e2b38/output/arm-linux-gnueabihf/SHA256SUMS.part
04f402e3b75c3643d74e7f1ecbcb9f56e45561d39423755abb9d5f1ecbaa1019  guix-build-1513727e2b38/output/arm-linux-gnueabihf/bitcoin-1513727e2b38-arm-linux-gnueabihf-debug.tar.gz
027ee6368839531b57c1907927dd4967765299447ded1c12cc17c64b13fddbef  guix-build-1513727e2b38/output/arm-linux-gnueabihf/bitcoin-1513727e2b38-arm-linux-gnueabihf.tar.gz
0cf76bb70bd6f446a99ea7cade2357cceef16fe63f1d1258087d13642f024f9c  guix-build-1513727e2b38/output/arm64-apple-darwin/SHA256SUMS.part
0c9246cef1ae82f37f5618308b477e7548e09ce94613ab9c43e3160a0f0450a7  guix-build-1513727e2b38/output/arm64-apple-darwin/bitcoin-1513727e2b38-arm64-apple-darwin.tar.gz
51dcbcfd86e55e36ee299ff4f3a5e2e2baec06755a4b149742616fa5c691a3b5  guix-build-1513727e2b38/output/arm64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.dmg
fd16a158dd2ae9f90d61de4a8d4e287458d42e5e6b5bd6aece6b2bd18cbc73c5  guix-build-1513727e2b38/output/arm64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.tar.gz
b18f242456aeeddf37cc31f001221593283b020f35ba72e375f69a4c602a3970  guix-build-1513727e2b38/output/dist-archive/bitcoin-1513727e2b38.tar.gz
6b411193b4a60fb37e7809a1df45e465feaf09ff4ad2d7cbb293e0838774591d  guix-build-1513727e2b38/output/powerpc64-linux-gnu/SHA256SUMS.part
5b8d26f66d30de098f790ef3cf632eb8aa85f9c680f6c2cdaee9076227f627c2  guix-build-1513727e2b38/output/powerpc64-linux-gnu/bitcoin-1513727e2b38-powerpc64-linux-gnu-debug.tar.gz
95d6811384228b2b2dca487b87027fc3704416def3d2574df511c1f75febb7af  guix-build-1513727e2b38/output/powerpc64-linux-gnu/bitcoin-1513727e2b38-powerpc64-linux-gnu.tar.gz
2887fd0d7f618b1ece5dee2909867606d2ff60e10d9bb4f48d69bcb4f4256948  guix-build-1513727e2b38/output/powerpc64le-linux-gnu/SHA256SUMS.part
a8f9598eefb77bdcbe7317636921d633b1af0210608d9f033027bf1d5d0152f2  guix-build-1513727e2b38/output/powerpc64le-linux-gnu/bitcoin-1513727e2b38-powerpc64le-linux-gnu-debug.tar.gz
0b7851c32dc1df406b71e68a5bd1c61dc4062b4e5a7d08c026ed3191682e5d2a  guix-build-1513727e2b38/output/powerpc64le-linux-gnu/bitcoin-1513727e2b38-powerpc64le-linux-gnu.tar.gz
cff4e6eb1afd5fb403e3afebc15b59ae34f593cc956666e692eff1ac0b031eb0  guix-build-1513727e2b38/output/riscv64-linux-gnu/SHA256SUMS.part
093723e11f3fd55feb34acd5fae2c1d48cf9251edfd8e286ccfca26d5b3d4408  guix-build-1513727e2b38/output/riscv64-linux-gnu/bitcoin-1513727e2b38-riscv64-linux-gnu-debug.tar.gz
d8cc7ffdc9e3ce0ff610d0fa71d5eeca18f7f27b9a76a4b21fd89c343a002eaa  guix-build-1513727e2b38/output/riscv64-linux-gnu/bitcoin-1513727e2b38-riscv64-linux-gnu.tar.gz
c33f78cbf09ff0d71bae8a971030fac0a7fcf8e8ae745b7ae35ec8ef0979105b  guix-build-1513727e2b38/output/x86_64-apple-darwin/SHA256SUMS.part
6bc78aa850bfe906ae6593e6e44b9d1d95b0977ff9dd227fd355f938b75cdd64  guix-build-1513727e2b38/output/x86_64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.dmg
6066fc635615cf9e918c0ec8579588683d5f9b2a0f14d57a4d2576f199746b9a  guix-build-1513727e2b38/output/x86_64-apple-darwin/bitcoin-1513727e2b38-osx-unsigned.tar.gz
c43582f8ecef39f049cbba11c4e646e011ac3cff4a59582435bb8733b30b12f0  guix-build-1513727e2b38/output/x86_64-apple-darwin/bitcoin-1513727e2b38-osx64.tar.gz
04da85b5eeeb4549f1d74902596853ace814d704fac21ee963d737142f5cee7d  guix-build-1513727e2b38/output/x86_64-linux-gnu/SHA256SUMS.part
53274875268d4b18b36c487e3410961381d1960772c5def082bf3048659bc899  guix-build-1513727e2b38/output/x86_64-linux-gnu/bitcoin-1513727e2b38-x86_64-linux-gnu-debug.tar.gz
8e93f32641da9f574d228429dc8133bccb9b3a499c0654ea81148a6ca2a4124d  guix-build-1513727e2b38/output/x86_64-linux-gnu/bitcoin-1513727e2b38-x86_64-linux-gnu.tar.gz
e911fc37258f7a26976fe0a66f0af69bf89ed95e71064cdbd3e2615d18e13d8c  guix-build-1513727e2b38/output/x86_64-w64-mingw32/SHA256SUMS.part
e1f9ce7c661e97d69f9f5518071cf70fd4cc75c186941fed9ba4678ad8a9ed22  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win-unsigned.tar.gz
ddbc59f27da63b2e2a65b1b323bcda604570c63e5886692808d0bda455c97ce1  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win64-debug.zip
53e2fd55381470496fe800854c03a03bbf2189bd8e0ab5617942281c9df1ef4f  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win64-setup-unsigned.exe
79519d66034fecd41886f5ec4caae433fd7d3d5c182d068fc45ef9260ef2bdf7  guix-build-1513727e2b38/output/x86_64-w64-mingw32/bitcoin-1513727e2b38-win64.zip

fanquake · 2022-02-23T15:12:21Z

contrib/macdeploy/macdeployqtplus

@@ -543,6 +541,9 @@ ds.close()

 # ------------------------------------------------

+if platform.system() == "Darwin":
+    subprocess.check_call(f"codesign --deep --force --sign - {target}", shell=True)


For anyone else's reference, passing - to --sign invokes ad-hoc signing, which is more limited in it's capabilities, but sufficient for locally running/testing binaries.

If identity is the single letter "-" (dash), ad-hoc signing is performed. Ad-hoc signing does not use an identity at all, and identifies exactly one instance of code. Significant restrictions apply to the use of ad-hoc signed code; consult documentation before using this.

…ith system frameworks 1513727 build, qt: (Re-)sign package (Hennadii Stepanov) c26a0a5 build, qt: Align frameworks with macOS codesign tool requirements (Hennadii Stepanov) Pull request description: Fixes bitcoin#22403 This PR follows Apple [docs](https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes): > - New in macOS 11 on Macs with Apple silicon, and starting in macOS Big Sur 11 beta 6, the operating system enforces that any executable must be signed before it’s allowed to run. There isn’t a specific identity requirement for this signature: a simple ad-hoc signature is sufficient... > - ... If you use a custom workflow involving tools that modify a binary after linking (e.g. `strip` or `install_name_tool`) you might need to manually call `codesign` as an additional build phase to properly ad-hoc sign your binary. These new signatures are not bound to the specific machine that was used to build the executable, they can be verified on any other system and will be sufficient to comply with the new default code signing requirement on Macs with Apple silicon... When building with system Qt frameworks (i.e., without depends), a new string has been added to the `make deploy` log on M1-based macOS: ``` % make deploy ... + Generating .DS_Store + dist/Bitcoin-Qt.app: replacing existing signature + Preparing .dmg disk image + ... ``` This PR does not change build system behavior: - when building with depends - on Intel-based macOS ACKs for top commit: jarolrod: ACK 1513727 fanquake: ACK 1513727 - although didn't test on M1 hardware. Given the forced signing is scoped to only occur when running the deploy script on macOS, this doesn't interfere with our release signing. Tree-SHA512: 3aa778fdd6ddb54f029f632f2fe52c2ae3bb197ba564cb776493aa5c3a655bd51d10ccbe6c007372d717e9b01fc4193dd5c29ea0bc7e069dcae7e991ae259f0c

hebasto force-pushed the 210725-deploy branch 2 times, most recently from a3a74ec to ba962f6 Compare July 25, 2021 16:08

DrahtBot added the Scripts and tools label Jul 25, 2021

hebasto force-pushed the 210725-deploy branch 3 times, most recently from daaa644 to 4d489dd Compare July 25, 2021 16:44

hebasto marked this pull request as ready for review July 25, 2021 16:48

hebasto added the macOS label Jul 25, 2021

hebasto mentioned this pull request Jul 25, 2021

Installation via Bitcoin-Core.dmg is broken on macOS (Apple Silicon) #22403

Closed

fanquake reviewed Jul 29, 2021

View reviewed changes

hebasto force-pushed the 210725-deploy branch from 4d489dd to bbdd588 Compare July 29, 2021 15:12

bitcoin deleted a comment from josedanielrojaspixel Aug 12, 2021

Zero-1729 reviewed Aug 13, 2021

View reviewed changes

jarolrod reviewed Sep 4, 2021

View reviewed changes

jarolrod mentioned this pull request Sep 5, 2021

fix bitcoin-qt app categorization on apple silicon bitcoin-core/gui#418

Merged

jarolrod reviewed Sep 5, 2021

View reviewed changes

contrib/macdeploy/macdeployqtplus Outdated Show resolved Hide resolved

hebasto force-pushed the 210725-deploy branch from bbdd588 to 462e632 Compare September 5, 2021 09:53

laanwj reviewed Sep 6, 2021

View reviewed changes

contrib/macdeploy/macdeployqtplus Outdated Show resolved Hide resolved

hebasto force-pushed the 210725-deploy branch from 462e632 to c206adc Compare September 14, 2021 10:41

hebasto marked this pull request as draft September 14, 2021 11:39

hebasto marked this pull request as ready for review September 14, 2021 11:45

hebasto mentioned this pull request Jan 26, 2022

release: support cross-compiling for arm64-apple-darwin #21851

Merged

hebasto force-pushed the 210725-deploy branch from c206adc to c9cb557 Compare January 28, 2022 20:50

hebasto mentioned this pull request Jan 31, 2022

[22.x] guix: ignore additional failing certvalidator test #24215

Merged

hebasto force-pushed the 210725-deploy branch from c9cb557 to 06909e4 Compare February 6, 2022 10:18

meshcollider added this to the 23.0 milestone Feb 7, 2022

Zero-1729 reviewed Feb 14, 2022

View reviewed changes

hebasto added 2 commits February 17, 2022 14:10

build, qt: Align frameworks with macOS codesign tool requirements

c26a0a5

Currently the codesign tool fails to sign copied frameworks.

build, qt: (Re-)sign package

1513727

Starting with macOS 11 on Apple silicon, executables must be signed before they are allowed to run.

hebasto force-pushed the 210725-deploy branch from 06909e4 to 1513727 Compare February 17, 2022 12:10

jarolrod reviewed Feb 23, 2022

View reviewed changes

fanquake approved these changes Feb 23, 2022

View reviewed changes

fanquake merged commit 077cfff into bitcoin:master Feb 23, 2022

hebasto deleted the 210725-deploy branch February 23, 2022 16:29

bitcoin locked and limited conversation to collaborators Feb 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build, qt: Fix `make deploy` on M1-based macOS with system frameworks #22546

build, qt: Fix `make deploy` on M1-based macOS with system frameworks #22546

hebasto commented Jul 25, 2021 •

edited

Loading

fanquake left a comment

fanquake Jul 29, 2021

hebasto Jul 29, 2021

fanquake Jul 30, 2021

hebasto Jul 30, 2021

laanwj Sep 6, 2021

jarolrod Sep 6, 2021

hebasto Sep 14, 2021

hebasto commented Jul 29, 2021

hebasto commented Jul 29, 2021

fanquake commented Jul 30, 2021

RandyMcMillan commented Aug 11, 2021 •

edited

Loading

Zero-1729 left a comment

jarolrod left a comment

jarolrod left a comment

hebasto commented Sep 5, 2021

hebasto commented Sep 14, 2021

RandyMcMillan commented Sep 22, 2021

dongcarl commented Jan 26, 2022

fanquake commented Jan 28, 2022

hebasto commented Jan 28, 2022

hebasto commented Jan 28, 2022

hebasto commented Feb 6, 2022

hebasto commented Feb 6, 2022

Zero-1729 left a comment

hebasto commented Feb 17, 2022

hebasto commented Feb 17, 2022

jarolrod left a comment

fanquake left a comment

fanquake Feb 23, 2022

		@@ -543,6 +546,9 @@ ds.close()

		# ------------------------------------------------

		if need_to_sign_target and platform.system() == "Darwin" and platform.machine() == "arm64":

build, qt: Fix make deploy on M1-based macOS with system frameworks #22546

build, qt: Fix make deploy on M1-based macOS with system frameworks #22546

Conversation

hebasto commented Jul 25, 2021 • edited Loading

fanquake left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hebasto commented Jul 29, 2021

hebasto commented Jul 29, 2021

fanquake commented Jul 30, 2021

RandyMcMillan commented Aug 11, 2021 • edited Loading

Zero-1729 left a comment

Choose a reason for hiding this comment

jarolrod left a comment

Choose a reason for hiding this comment

jarolrod left a comment

Choose a reason for hiding this comment

hebasto commented Sep 5, 2021

hebasto commented Sep 14, 2021

RandyMcMillan commented Sep 22, 2021

dongcarl commented Jan 26, 2022

fanquake commented Jan 28, 2022

hebasto commented Jan 28, 2022

hebasto commented Jan 28, 2022

Guix builds:

hebasto commented Feb 6, 2022

hebasto commented Feb 6, 2022

Guix builds:

Zero-1729 left a comment

Choose a reason for hiding this comment

hebasto commented Feb 17, 2022

hebasto commented Feb 17, 2022

Guix builds:

jarolrod left a comment

Choose a reason for hiding this comment

fanquake left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

build, qt: Fix `make deploy` on M1-based macOS with system frameworks #22546

build, qt: Fix `make deploy` on M1-based macOS with system frameworks #22546

hebasto commented Jul 25, 2021 •

edited

Loading

RandyMcMillan commented Aug 11, 2021 •

edited

Loading