Live data from Hacker News

Achieving an open-source implementation of Apple Code Signing and notarization

gregoryszorc.com

51–56 of 56 posts

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#51
post #3

The only thing left to solve is to actually build cross platform. You can do with rust cross but you have to build your own docker images on macos first since apple licensing prohibits redistribution of binaries. It would save us so much money in github CI minutes.

We achieved this for Firefox macOS builds years ago. (Greg was there for that work as well. ) You do need to have an SDK accessible, but storing one internally and using it in CI was deemed acceptable. The impact on CI build times was hard to overstate.

We were already building our own clang binaries for various reasons, so it was mostly a matter of making an SDK available and ensuring that the right compiler options were passed in (since running clang on macOS sets a bunch of defaults that you don't get even if you pass -target x86_64-apple-darwin).

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#52
Does this mean I can now develop iOS (iphone/ipad) apps, start to finish, without asking Apple's

permission _at any stage_, and then sideload these apps onto my personal iphone/ipad?

(assuming as mentioned elsewhere that I can develop such apps on linux, without needing MacOS)

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#53
post #33

Earlier quoted context omitted.

CoreFoundation is (partially?) open-source and cross-platform now: https://github.com/apple/swift-corelibs-foundation

That’s not CoreFoundation, a C library, but a Swift reimplementation of that library, only to be consumed by Swift (import Foundation).

[deleted]

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#54
post #33

Earlier quoted context omitted.

CoreFoundation is (partially?) open-source and cross-platform now: https://github.com/apple/swift-corelibs-foundation

That’s not CoreFoundation, a C library, but a Swift reimplementation of that library, only to be consumed by Swift (import Foundation).

[deleted]

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#55

I’ve always used gon ( https://github.com/mitchellh/gon ) for this, which is open source golang, but I don’t think it supports mach-o embedding. I’ll have to try this tool out.

Note that gon is a glorified front-end for executing processes like `codesign`, `altool`, and even `ditto` for zip file generation. This Rust implementation, by contrast, has all the functionality implemented in pure Rust: there is no calling out to external processes for anything. You could drop the statically linked `rcodesign` executable into a Linux container with no other files and it would work. That's not to d…

Never knew it wrapped shell commands - good to know!

Re: Achieving an open-source implementation of Apple Code Signing and notarization

#56
post #20

is there a public format for Code or Keysigning Servers? Like SCEP/EST, but for other stuff?

From what I can remember the signature portion is documented in CMS RFC and the file format is only available from Apple's open source libsecurity.
Post reply on HN