3 ms·
Huh. I've only recently started using OSX, and I've had codesign issues when using self-compiled debuggers, but not when using things like servo. Can it be sig
by Manishearth 10y ago
Huh. I've only recently started using OSX, and I've
had codesign issues when using self-compiled
debuggers, but not when using things like servo.
Can it be signed by any old cert or does it need
to be part of the trust chain?
- LnxPrgr3 10y agoDebuggers are special--the OS won't let unsigned binaries control other processes, no matter how they came to exist on your system. Outside of that, Gatekeeper applies to executables fetched from the Web, can be disabled (harder on Sierra), and is easy enough to bypass--and you only have to do it once per executable. If signed, the certificate does need to be trusted to count--otherwise, it'd just be a fancy checksum.
- Manishearth 10y agoAlright. This sounds like something we should be eventually doing. Not sure if we should prioritize it right now. GPG-signing the binaries for extra verifiability is another thing we could do in the meantime, though it doesn't fix the OSX issue.
- Argorak 10y agoYou need an Apple Developer Cert. Here's the relevant tracking issue for the same problem in Rust. https://github.com/rust-lang/rust/issues/27694 https://github.com/rust-lang/rust/issues/27694