build: codesign tarball binary on macOS #14179

evanlucas · 2017-07-12T00:16:19Z

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

Affected core subsystem(s)

build,tools

Fixes: #11936

I ran it locally and confirmed that it does codesign the binary when make binary is run. I also confirmed that the change to make pkg works as well.

gibfahn · 2017-07-12T00:27:43Z

Do you know why it seemed to be intermittently unsigned (see #11936 (comment))?

refack

LGTM.
Can't verify it actually works.

MylesBorins

LGTM if we can do a test build and make sure tarball is signed that would be great

evanlucas · 2017-07-12T11:40:55Z

@gibfahn I'm not seeing any of the node binaries from the tarball as being signed. From the looks of the Makefile, I'm not sure how it could be possible that they are either. Unless make binary isn't being used in the release builds?

Here is one that you were showing was signed, but I can't reproduce:

(S) [~]
:] (v8.1.4) ➜ n v6.10.0                                                                                                 

     install : node-v6.10.0
       mkdir : /usr/local/n/versions/node/6.10.0
       fetch : https://nodejs.org/dist/v6.10.0/node-v6.10.0-darwin-x64.tar.gz
######################################################################## 100.0%
   installed : v6.10.0


(S) [~]
:] (v6.10.0) ➜ codesign -d (which node)                                                                                 
/usr/local/bin/node: code object is not signed at all

evanlucas · 2017-07-12T11:41:47Z

@MylesBorins a test build would be great. Do I just use the same method as when cutting a release?

MylesBorins · 2017-07-12T12:27:02Z

yup, just select test instead of release in the drop down

You will need to include the date :D

evanlucas · 2017-07-12T12:28:19Z

Trying out a test build at https://ci-release.nodejs.org/job/iojs+release/1837/

evanlucas · 2017-07-12T12:40:29Z

Ok, so looks like the job that runs make binary-upload would need the CODESIGN_CERT env var the same way the job that make pkg-upload does.

/cc @nodejs/build could we possibly get that added?

gibfahn · 2017-07-12T12:58:16Z

@evanlucas seems to work for me

curl -O https://nodejs.org/dist/v6.10.0/node-v6.10.0-darwin-x64.tar.gz
tar -xf node-v6.10.0-darwin-x64.tar.gz
codesign -d node-v6.10.0-darwin-x64/bin/node

I think it's because you're using () and thus executing in a subshell. Does codesign -d $(which node) work?

evanlucas · 2017-07-12T13:02:38Z

@gibfahn no I use fish, so () is fish's version of $()

Pulling that same file is not working for me still. What version of macOS are you running?

(S) [/private/tmp/node-v6.10.0-darwin-x64]
:] (v8.1.4) ➜ ./bin/node -v                                                                                             
v6.10.0

(S) [/private/tmp/node-v6.10.0-darwin-x64]
:] (v8.1.4) ➜ codesign -d bin/node                                                                                      
bin/node: code object is not signed at all

gibfahn · 2017-07-12T13:05:02Z

10.12.5

joaocgreis · 2017-07-13T01:28:21Z

Confirmed that CODESIGN_CERT was not defined for the job that generates the OSX tarball and signing was skipped in @evanlucas test run. Added the variable, here is another test run: ~~https://ci-release.nodejs.org/job/iojs+release/1841/~~ https://ci-release.nodejs.org/job/iojs+release/1842/ - will overwrite the previous test run at https://nodejs.org/download/test/v9.0.0-test20170712056c85c8df/

EDIT: Looks like it worked. Please confirm the binary is signed.

evanlucas · 2017-07-13T11:55:56Z

(P) [/Volumes/code/help/services/org-customer-service]
:] (v8.1.4) ➜ cd /Users/evan/Downloads/node-v9.0.0-test20170712056c85c8df-darwin-x64                                                                                                               (fixroutes) 

(P) [~/Downloads/node-v9.0.0-test20170712056c85c8df-darwin-x64]
:] (v8.1.4) ➜ codesign -d bin/node                                                                                                                                                                             
Executable=/Users/evan/Downloads/node-v9.0.0-test20170712056c85c8df-darwin-x64/bin/node

woo hoo!!!! Thanks @joaocgreis!!!!

evanlucas · 2017-07-13T12:11:10Z

@gibfahn I'm at a loss here. Those same commands are not working for me locally.

gdams · 2017-07-17T07:46:06Z

here is the output when I run the same commands:

➜  tmp rm -rf node*                                                           
➜  tmp curl -O https://nodejs.org/dist/v6.10.0/node-v6.10.0-darwin-x64.tar.gz 
#  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 11.5M  100 11.5M    0     0  2850k      0  0:00:04  0:00:04 --:--:-- 2850k
➜  tmp tar -xf node-v6.10.0-darwin-x64.tar.gz 
➜  tmp codesign -d node-v6.10.0-darwin-x64/bin/node 
Executable=/Users/george/tmp/node-v6.10.0-darwin-x64/bin/node

evanlucas · 2017-07-17T14:15:24Z

I'm really confused on how that's possible...both of my macOS machines are showing that it is not signed. What confuses me the most though, is if they are signed, how are they being signed??

evanlucas · 2017-07-18T22:10:13Z

@gibfahn @gdams any issue with me going ahead and landing this? I really don't have an explanation on how those are showing as signed for yall.

gdams

LGTM

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: nodejs#14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: nodejs#14179 Fixes: nodejs#11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: #14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: #14179 Fixes: #11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: #14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: #14179 Fixes: #11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: #14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: #14179 Fixes: #11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

This LTS release comes with 152 commits. This includes 75 which are test related, 25 which are doc related, 21 which are build / tool related and 3 commits which are updates to dependencies. Notable Changes: * build: - Codesigning is fixed on macOS (Evan Lucas) #14179 * deps: - Snapshots are turned back on!!! (Yang Guo) #14385 * path: - win32 volume-relative paths are working again! (Timothy Gu) #14440 * tools: - v6.x can now build with ICU 59 (Steven R. Loomis) #12078 PR-URL: #14852

This LTS release comes with 152 commits. This includes 75 which are test related, 25 which are doc related, 21 which are build / tool related and 3 commits which are updates to dependencies. Notable Changes: * build: - Codesigning is fixed on macOS (Evan Lucas) nodejs#14179 * deps: - Snapshots are turned back on!!! (Yang Guo) nodejs#14385 * path: - win32 volume-relative paths are working again! (Timothy Gu) nodejs#14440 * tools: - v6.x can now build with ICU 59 (Steven R. Loomis) nodejs#12078 PR-URL: nodejs#14852

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: nodejs/node#14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: nodejs/node#14179 Fixes: nodejs/node#11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: nodejs/node#14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: nodejs/node#14179 Fixes: nodejs/node#11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: #14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: #14179 Fixes: #11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Allow passing the prefix in via the PKGDIR env var. This will allow us to use this same script to codesign the binary tarball. PR-URL: nodejs/node#14179 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Previously, we were signing the binary that was released in the .pkg, but not the binary released in the tarball. PR-URL: nodejs/node#14179 Fixes: nodejs/node#11936 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

nodejs-github-bot added build Issues and PRs related to build files or the CI. macos Issues and PRs related to the macOS platform / OSX. tools Issues and PRs related to the tools directory. labels Jul 12, 2017

evanlucas mentioned this pull request Jul 12, 2017

Codesign node binary for macOS #11936

Closed

refack approved these changes Jul 12, 2017

View reviewed changes

bnoordhuis approved these changes Jul 12, 2017

View reviewed changes

MylesBorins approved these changes Jul 12, 2017

View reviewed changes

gibfahn approved these changes Jul 18, 2017

View reviewed changes

gdams approved these changes Jul 19, 2017

View reviewed changes

jasnell approved these changes Jul 19, 2017

View reviewed changes

evanlucas added 2 commits July 19, 2017 16:38

evanlucas force-pushed the codesigntarballosx branch from 056c85c to e36166b Compare July 19, 2017 21:49

evanlucas closed this Jul 19, 2017

evanlucas deleted the codesigntarballosx branch July 19, 2017 21:49

MylesBorins mentioned this pull request Aug 16, 2017

v6.11.3-proposal #14852

Merged

MylesBorins mentioned this pull request Sep 20, 2017

v4.8.5 proposal #15507

Closed

MylesBorins mentioned this pull request Oct 25, 2017

v4.8.6 proposal #16500

Merged

joaocgreis mentioned this pull request Sep 10, 2018

release-macstadium-macos10.10-x64-1 - Unblock 8.12 release nodejs/build#1486

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build: codesign tarball binary on macOS #14179

build: codesign tarball binary on macOS #14179

evanlucas commented Jul 12, 2017

gibfahn commented Jul 12, 2017

refack left a comment

MylesBorins left a comment

evanlucas commented Jul 12, 2017

evanlucas commented Jul 12, 2017

MylesBorins commented Jul 12, 2017

evanlucas commented Jul 12, 2017

evanlucas commented Jul 12, 2017

gibfahn commented Jul 12, 2017 •

edited

evanlucas commented Jul 12, 2017

gibfahn commented Jul 12, 2017

joaocgreis commented Jul 13, 2017 •

edited

evanlucas commented Jul 13, 2017

evanlucas commented Jul 13, 2017

gdams commented Jul 17, 2017

evanlucas commented Jul 17, 2017

evanlucas commented Jul 18, 2017

gdams left a comment

build: codesign tarball binary on macOS #14179

build: codesign tarball binary on macOS #14179

Conversation

evanlucas commented Jul 12, 2017

Checklist

Affected core subsystem(s)

gibfahn commented Jul 12, 2017

refack left a comment

Choose a reason for hiding this comment

MylesBorins left a comment

Choose a reason for hiding this comment

evanlucas commented Jul 12, 2017

evanlucas commented Jul 12, 2017

MylesBorins commented Jul 12, 2017

evanlucas commented Jul 12, 2017

evanlucas commented Jul 12, 2017

gibfahn commented Jul 12, 2017 • edited

evanlucas commented Jul 12, 2017

gibfahn commented Jul 12, 2017

joaocgreis commented Jul 13, 2017 • edited

evanlucas commented Jul 13, 2017

evanlucas commented Jul 13, 2017

gdams commented Jul 17, 2017

evanlucas commented Jul 17, 2017

evanlucas commented Jul 18, 2017

gdams left a comment

Choose a reason for hiding this comment

gibfahn commented Jul 12, 2017 •

edited

joaocgreis commented Jul 13, 2017 •

edited