Live data from Hacker News

Achieving an open-source implementation of Apple Code Signing and notarization

gregoryszorc.com

11–20 of 56 posts

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#11
post #3

The only thing left to solve is to actually build cross platform. You can do with rust cross but you have to build your own docker images on macos first since apple licensing prohibits redistribution of binaries. It would save us so much money in github CI minutes.

You mean building mac/ios apps on Linux?

That’s relatively easy to do, with the only questionable/legally gray area being access to the iOS/Mac SDKs. I’m not a lawyer, but it’s my understanding that the Google v Oracle case established that APIs aren’t protected by copyright. So if we can use the headers from e.g. the iOS SDK on Linux wtohout worrying about copyright issues (Apple developer agreements may be an issue though), it should be possible to autogenerate stub libraries for linking purposes.

With that, you can compile and link a binary for iOS or Mac on Linux.

Next, you’ll need to implement the packaging and signing portion. Packaging (generating an app bundle) is easy, but codesigning requires Apple’s codesign utility, which doesn’t work outside of Mac, even with a project like Darling (last I checked, anyways).

But if the OP does implement a working codesign alternative, then that means it should be possible to create an iOS/Mac app that can be distributed on the App Store entirely from Linux with no Xcode, virtual machines, cloud macs, etc.

The only gate left then is the Apple tax/signing certificate you need to buy for $99/year. But that might change with all of the antitrust pressure Apple is facing, including the recent EU law that would force Apple to allow competing app stores.

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#12
post #8

I think Apple's official code signing tool is also open source? https://github.com/Apple-FOSS-Mirror/security_systemkeychain... xar is another tool for codesigning Mac installer packages, which runs on Linux. I've used it successfully in the past. https://users.wfu.edu/cottrell/productsign/productsign_linux...

Good pointers indeed - Apple's code signing tool is open source, but heavily dependent on Cocoa/OSX libraries like CoreFoundation. I'm not sure if it works with any of the open-source reimplementations of these libraries, although I kind of want to try now, just for fun - has anyone done this already? Plus, it's not Written in Rust (TM)! `xar` only signs packages, not Mach-O binaries, at least as far as I know?

CoreFoundation is (partially?) open-source and cross-platform now: https://github.com/apple/swift-corelibs-foundation

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#13
post #11
post #3

The only thing left to solve is to actually build cross platform. You can do with rust cross but you have to build your own docker images on macos first since apple licensing prohibits redistribution of binaries. It would save us so much money in github CI minutes.

You mean building mac/ios apps on Linux? That’s relatively easy to do, with the only questionable/legally gray area being access to the iOS/Mac SDKs. I’m not a lawyer, but it’s my understanding that the Google v Oracle case established that APIs aren’t protected by copyright. So if we can use the headers from e.g. the iOS SDK on Linux wtohout worrying about copyright issues (Apple developer agreements may be an issue…

Zig already does this I think, they committed the Apple headers to their repo.

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#14
post #3

The only thing left to solve is to actually build cross platform. You can do with rust cross but you have to build your own docker images on macos first since apple licensing prohibits redistribution of binaries. It would save us so much money in github CI minutes.

This is actually a solved problem, using osxcross[0]. The experience is honestly very smooth, and we don't require any apple proprietary binaries. The only thing apple-proprietary is their SDK (containing the header files for compiling, and tbd files for linking), which can be downloaded from apple's website (at least if you have a developer account), or from various GitHub projects archiving them.

[0]: https://github.com/tpoechtrager/osxcross

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#17
post #9

Earlier quoted context omitted.

As far I can tell, you can compile the binary and sign your app. # From a Git checkout $ cargo run --bin rcodesign -- --help $ cargo install --bin rcodesign # Remote install. $ cargo install --git https://github.com/indygreg/PyOxidizer --branch main --bin rcodesign apple-codesign

Quoted post unavailable.

Your parent is clearly answering the OP’s second question but not the first, come on.

I’m aware of production iOS apps using Rust that are either:

1. Using rust for core logic but still using Swift/obj c for UI.

2. Pure Rust but don’t use native widgets. Like games or similar custom UI.

That said it is in my understanding theoretically possible but I’m not aware of a paved cow path here. It’s also not my area of specialty though.

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#18
post #8

I think Apple's official code signing tool is also open source? https://github.com/Apple-FOSS-Mirror/security_systemkeychain... xar is another tool for codesigning Mac installer packages, which runs on Linux. I've used it successfully in the past. https://users.wfu.edu/cottrell/productsign/productsign_linux...

Good pointers indeed - Apple's code signing tool is open source, but heavily dependent on Cocoa/OSX libraries like CoreFoundation. I'm not sure if it works with any of the open-source reimplementations of these libraries, although I kind of want to try now, just for fun - has anyone done this already? Plus, it's not Written in Rust (TM)! `xar` only signs packages, not Mach-O binaries, at least as far as I know?

> Plus, it's not Written in Rust (TM)!

It could be co-authored by Xi Jinping and Mark Zuckerberg in COBOL and hosted on NPM, and that wouldn’t stop me from using an open source codesign alternative that runs on Linux.

Post reply on HN