Yep. This focuses on the command line’s terrible error messages but the Xcode UI is bad too. Clicking through multiple steps, and for some reason non-standard “transparent buttons in list items” are used to reveal the “Export App” action you need to finally obtain a local notarized copy. Except those buttons will not appear after it is “done”; you have to switch to another target and then switch back to get the buttons to be clickable. I mean the whole process just screams “does anyone at Apple ever have to use this?”.
The Gates to Hell: Apple’s Notarizing
141–150 of 214 posts
Re: The Gates to Hell: Apple’s Notarizing
#142All this code signing stuff is an admission of defeat. "Our OSes are insecure and we can't secure them, so fuck it." Unix and VMS/NT, the two most popular kernel lineages, were both designed when computers were either isolated or connected to an Internet that was effectively an academic/government walled garden. They absolutely were not designed to deal with the present information war zone where everything is trying…
An admission of defeat is one way to look at it, or you could describe it as acceptance of reality.
As you point out, security engineers have been working for decades on a vast array of techniques to mitigate classes of vulnerabilities. There's no reason to believe this is something that can ever be finished. There will always be bugs, always. Code signing embraces that reality by making it much easier to contain bad programs after they get out into the wild. It is just another tool in the toolbox, as with all security mitigations.
It's silly to suggest that you can solve security by simply rewriting the entire OS in Rust; and in a modern OS, every process already does run with minimal required permissions, and authentication is generally enforced, and users do have visibility and control, at least by design. Sometimes things slip through, of course. That will still happen even in the shiny new world you're proposing.
The existence of JavaScript does not imply that a completely secure OS is possible. There's a rich history of JS bugs that have led to total compromise of the OS -- in fact, earlier in your comment, you listed several vulnerability classes that have disproportionately affected JavaScript VMs.
Re: The Gates to Hell: Apple’s Notarizing
#143Re: The Gates to Hell: Apple’s Notarizing
#144Earlier quoted context omitted.
I rearranged my CI graph to run notarization in parallel with my unit tests, and turned on GitLab's DAG to allow jobs from different stages to run at the same time as long as their dependencies are satisfied, so the impact of the notarization step has been small. My CI pipeline is build -> test -> deploy. The Mac "build" job uploads the app for notarization as a side effect. There is an additional "mac archive" job d…
Oh, I do notarization after building my .zip containing my .pkg, are you saying I could notarize each bundle separately and I dont need to notarize the final .zip ?
My final artifact is a dmg. I emit it as part of the app build, in my very first CI stage on Mac, and immediately upload for notarization before the build job ends. Then, in parallel to tests, I have a separate job that checks the dmg for common issues, then waits for notarization and staples it.
Re: The Gates to Hell: Apple’s Notarizing
#145It does so because it can.
Never understood the fans who never get fed up.
Re: The Gates to Hell: Apple’s Notarizing
#146I wrote a little sh script to notarize HandBrake two (or maybe three) years ago, and that's was it. It's not rocket science. But like every new thing, it required a bit of time to read the documentation and to understand what's going on. The plugin issue described in the article is probably related to the hardened runtime, so it's unrelated to the actual notarisation process.
This is my notary script for a DMG: https://gist.github.com/lunixbochs/0ceeb23be5c3d5c6748165e61... ./notary.sh notarize app.dmg ./notary.sh staple app.dmg I store a password as a keychain entry named AC_PASSWORD. If you're running this in headless CI you should run a notarize command once interactively so you can tell keychain to always allow altool to access the password.
You can also opt to use API keys from Apple Connect in CI, which is what I do - less of a headache with Keychain.app.
Re: The Gates to Hell: Apple’s Notarizing
#147I wrote a little sh script to notarize HandBrake two (or maybe three) years ago, and that's was it. It's not rocket science. But like every new thing, it required a bit of time to read the documentation and to understand what's going on. The plugin issue described in the article is probably related to the hardened runtime, so it's unrelated to the actual notarisation process.
While you only have to update your build process once, you now have a noticeable delay for every single release build, and worse, a few times per year, your build will break because you haven’t signed Apple’s latest contract. And for what? There is no way Apple can make it impossible to get malware notarized.
But your release build is not done constantly, and so you have to sign in and accept an agreement - neither of which is a big deal.
Re: The Gates to Hell: Apple’s Notarizing
#148[deleted]
Re: The Gates to Hell: Apple’s Notarizing
#149Earlier quoted context omitted.
Code signing isn’t linked to an active developer subscription, if it lapses all existing signatures are still valid - you just can’t sign more.
What happens when the cert root expires? Does it not expire or does Apple grant an eternal valid signature when apps were signed before the root expired?
For apps I’ve downloaded on my iPhone, there are sometimes updates that denote Apple updated the key. Assuming that’s App Store only behavior though.
Re: The Gates to Hell: Apple’s Notarizing
#150Earlier quoted context omitted.
Cheap considering what? Considering the 30% margins they take on any further sale? Considering the 25$ one-time fee the Play Store takes?
Cheap considering buying a proper certificate for signing and releasing on Windows will often cost you the same. ;P If your bar to hit is Linux, you'll never be happy with anything.
On this note, does HN know where to acquire the cheapest possible code signing cert for Windows?