Validating Your Version of Xcode • Hacker News Board

Re: Validating Your Version of Xcode

#71

Post by hjuutilainen » Tue, Sep 22, 2015, 5:27 PM UTC

The problem with "spctl" is that it also evaluates trust which depends on your system settings and you have to pay attention to the output (as pointed out in the article). If you only want to verify the code signature _and_ provide your own requirement string, you could use something like (long options for legibility):

    $ codesign --verify --verbose --deep --test-requirement "=anchor apple" /Applications/Xcode.app/

The "anchor apple" means Apple’s own code, signed by Apple ("anchor apple generic" for developer IDs too).

Add verbosity for all the gory details:

    $ codesign --verify --verbose=999 --deep --test-requirement "=anchor apple" /Applications/Xcode.app/

Re: Validating Your Version of Xcode

#72

Post by [deleted] » Tue, Sep 22, 2015, 5:35 PM UTC

galad87 wrote: post #59

klausa wrote: post #24

Earlier quoted context omitted.

I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

The right click trick works only if the app is not signed. If the app signature is invalid it won't work. You have to disable gatekeeper completely to open the invalid Xcode version.

[deleted]

Re: Validating Your Version of Xcode

#73

Post by msbarnett » Tue, Sep 22, 2015, 5:47 PM UTC

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

Any time one of those "Quickly set up an OS X dev machine!" setup scripts makes the rounds, you can practically guarantee that the script disables Gatekeeper and the file download quarantine because the author "found it annoying/useless/pointless/mai freedums". You end up with one guy intentionally shooting himself in the foot, and 100s of others running his "helpful" script and shooting themselves in the feet without even realizing it.

Developers as a group are at least as stupid about security as everyone else.

Re: Validating Your Version of Xcode

#74

Post by msbarnett » Tue, Sep 22, 2015, 5:49 PM UTC

cheshire137 wrote: post #64

klausa wrote: post #24

Earlier quoted context omitted.

I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

Right-click and open doesn't always work.

It will fail if the signature is invalid.

Don't open it if the signature is invalid.

Re: Validating Your Version of Xcode

#75

Post by jakejake » Tue, Sep 22, 2015, 6:07 PM UTC

funkysquid wrote: post #51

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I keep gatekeeper disabled because I don't want app developers to have to sign up with (and I believe pay money to) Apple to setup a Developer ID. (but I also don't download Xcode from random places)

It's easy enough to run unsigned apps, you just have to ctrl+click and select "open" then you'll get a different prompt that allows you to install the app anyway.

I suppose you can argue that, if that's the case, what's the point? Well, if you think that a piece of software should be signed but it is in fact not signed properly, then that's a clue that it's been tampered with. If the software isn't signed at all, then at least I can decide whether I trust the source enough to install it.

Re: Validating Your Version of Xcode

#76

Post by stephenr » Tue, Sep 22, 2015, 6:21 PM UTC

cheshire137 wrote: post #65

epmatsw wrote: post #50

Earlier quoted context omitted.

How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.

I rarely find apps on the Mac app store, they're usually always from the app's creator's website. Recent ones I can think of include Bowtie and Sublime Text 3.

So? Once you open an app once (right click and open) it's white listed by gatekeeper.

Re: Validating Your Version of Xcode

#77

Post by perrycynic » Tue, Sep 22, 2015, 6:33 PM UTC

Osmium wrote: post #67

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

> Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? This is generally known as hubris. We think we're smart and that the rules don't apply to us, because we know better than the other people. Turns out they can protect us too. Who knew? In this instance, I'd give the Chinese developers the benefit of the doubt, having recently had first hand…

The whole point of Gatekeeper is that you can download your software from anywhere and it'll integrity-check it for you. "The downloads were too slow" has no bearing on "and then I saved three minutes by skipping the security check on the software I got from an untrusted site."

:-(

Re: Validating Your Version of Xcode

#78

Post by perrycynic » Tue, Sep 22, 2015, 6:38 PM UTC

cjensen wrote: post #35

stephenr wrote: post #11

Earlier quoted context omitted.

They downloaded Xcode from somewhere besides Apple. How much more clue do you need about their stupidity.

Gatekeeper makes that a lot safer than you might think. The only downside is that it's not obvious how to check who signed it. If you could easily verify it's signed by Apple, that would be 100% safe.

$ spctl --assess --verbose /path/to/.app

Re: Validating Your Version of Xcode

#79

Post by davidkhess » Tue, Sep 22, 2015, 6:43 PM UTC

patmcc wrote: post #48

I'm getting "a sealed resource is missing or invalid", with a copy of Xcode I know was installed from the App Store. Any ideas?

If you use `codesign -v --verbose /Applications/Xcode.app` you may see:

  file added: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man/whatis
  file added: /Applications/Xcode.app/Contents/Developer/usr/share/man/whatis

That should be safe.

It's a bit of a shock that Apple:

1) is modifying sealed containers post-install (it's the weekly periodic job that rebuilds whatis database from installed man pages)

2) doesn't realize this and has put out instructions that will cause lots of false positives

Re: Validating Your Version of Xcode

#80

Post by gress » Tue, Sep 22, 2015, 6:47 PM UTC

liquidise wrote: post #49

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I'm fascinated that there are people on HN who have not disabled GateKeeper. I'm not sure i've used a machine since it was added where i haven't disabled it within an hour of setting up a machine.

Why would you do that? It it exposes you to risk, and as has now been proven, if adopted as a general practice it exposes everyone else to risk too.