From: Paolo Bonzini <pbonzini@redhat.com>
To: Akihiko Odaki <akihiko.odaki@gmail.com>
Cc: qemu-devel@nongnu.org
Subject: Re: [PATCH] hvf: Sign the code after installation
Date: Thu, 25 Feb 2021 14:48:42 +0100 [thread overview]
Message-ID: <2d7fa111-9970-b417-392c-4ddaef3cc4a8@redhat.com> (raw)
In-Reply-To: <20210225000614.46919-1-akihiko.odaki@gmail.com>
On 25/02/21 01:06, Akihiko Odaki wrote:
> Before this change, the code signed during the build was installed
> directly.
>
> However, the signature gets invalidated because meson modifies the code
> to fix dynamic library install names during the install process.
>
> It also prevents meson to strip the code because the pre-signed file is
> not marked as an executable (although it is somehow able to perform the
> modification described above).
>
> With this change, the unsigned code will be installed and modified by
> meson first, and a script signs it later.
>
> Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Thanks very much! As mentioned in the other message, I would prefer to
have a single script so here is what I came up with.
#!/bin/sh -e
#
# Helper script for the build process to apply entitlements
copy=:
if [ "$1" = --install ]; then
shift
copy=false
cd "$MESON_INSTALL_DESTDIR_PREFIX"
fi
SRC="$1"
DST="$2"
ENTITLEMENT="$3"
if $copy; then
trap 'rm "$DST.tmp"' exit
cp -af "$SRC" "$DST.tmp"
SRC="$DST.tmp"
fi
codesign --entitlements "$ENTITLEMENT" --force -s - "$SRC"
mv -f "$SRC" "$DST"
trap '' exit
I'll include this in the next pull request, since I was able to test it
with Cirrus CI.
Thanks,
Paolo
next prev parent reply other threads:[~2021-02-25 13:49 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-20 22:44 [PATCH v6 00/11] hvf: Implement Apple Silicon Support Alexander Graf
2021-01-20 22:44 ` [PATCH v6 01/11] hvf: Add hypervisor entitlement to output binaries Alexander Graf
2021-02-23 11:56 ` Akihiko Odaki
2021-02-23 15:07 ` Paolo Bonzini
2021-02-25 0:06 ` [PATCH] hvf: Sign the code after installation Akihiko Odaki
2021-02-25 13:48 ` Paolo Bonzini [this message]
2021-02-26 4:58 ` Akihiko Odaki
2021-01-20 22:44 ` [PATCH v6 02/11] hvf: x86: Remove unused definitions Alexander Graf
2021-01-21 7:27 ` Philippe Mathieu-Daudé
2021-02-09 10:07 ` Roman Bolshakov
2021-01-20 22:44 ` [PATCH v6 03/11] hvf: Move common code out Alexander Graf
2021-01-21 7:26 ` Philippe Mathieu-Daudé
2021-05-16 14:12 ` Alexander Graf
2021-01-28 15:23 ` Peter Maydell
2021-01-20 22:44 ` [PATCH v6 04/11] hvf: Introduce hvf vcpu struct Alexander Graf
2021-01-20 22:44 ` [PATCH v6 05/11] arm: Set PSCI to 0.2 for HVF Alexander Graf
2021-01-28 15:25 ` Peter Maydell
2021-01-20 22:44 ` [PATCH v6 06/11] hvf: Simplify post reset/init/loadvm hooks Alexander Graf
2021-01-28 15:28 ` Peter Maydell
2021-02-10 21:34 ` Alexander Graf
2021-01-20 22:44 ` [PATCH v6 07/11] hvf: Add Apple Silicon support Alexander Graf
2021-01-28 15:52 ` Peter Maydell
2021-02-10 22:20 ` Alexander Graf
2021-02-10 22:39 ` Peter Maydell
2021-02-11 13:06 ` Alexander Graf
2021-02-11 13:16 ` Peter Maydell
2021-01-20 22:44 ` [PATCH v6 08/11] arm: Add Hypervisor.framework build target Alexander Graf
2021-01-28 16:00 ` Peter Maydell
2021-01-20 22:44 ` [PATCH v6 09/11] arm/hvf: Add a WFI handler Alexander Graf
2021-01-28 16:25 ` Peter Maydell
2021-02-10 20:25 ` Peter Collingbourne
2021-02-10 22:17 ` Peter Maydell
2021-02-11 0:33 ` Alexander Graf
2021-03-21 16:28 ` Alexander Graf
2021-01-20 22:44 ` [PATCH v6 10/11] hvf: arm: Add support for GICv3 Alexander Graf
2021-01-28 16:40 ` Peter Maydell
2021-03-21 16:36 ` Alexander Graf
2021-01-20 22:44 ` [PATCH v6 11/11] hvf: arm: Implement -cpu host Alexander Graf
2021-01-28 16:55 ` Peter Maydell
2021-05-16 11:16 ` Alexander Graf
2021-05-16 16:12 ` Peter Maydell
2021-01-20 23:03 ` [PATCH v6 00/11] hvf: Implement Apple Silicon Support no-reply
2021-01-28 16:55 ` Stefan Weil
2021-01-28 16:59 ` Peter Maydell
2021-01-28 17:12 ` Roman Bolshakov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2d7fa111-9970-b417-392c-4ddaef3cc4a8@redhat.com \
--to=pbonzini@redhat.com \
--cc=akihiko.odaki@gmail.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).