There s something weird with the app bundle ```miniseph o se

Question

There s something weird with the app bundle ```miniseph o seph$ usr sbin spctl a vvv ignore cache opt osquery lib osquery app opt osquery lib osquery app code has no resources but signature indicates they must be present```

seph · Answer

This is status error 67056 gt code has no resources but signature indicates they must be present Most probably structural damage which should be referred to the developer says <https eclecticlight co 2019 06 28 a primer on code signing errors >

seph · Answer

I m guessing this is because we sign the binary but not the app

seph · Answer

There s so much tied together it s hard for me to quickly resign and test this

seph · Answer

Okay I went through resigning A pretty normal process I used the same codesign commands that we do with the release file but against the ` app` The notarized it Now it shows as signed and entitled I m less sure how to fix the build to handle this I think we re dumping raw stuff into package data which is then signed and then packaged And the packaging step converts it to a app But I think that ordering is probably wrong Instead we should be shoving the app into the package data Which can then be signed and packaged into to the tar gz and pkg I d probably say the package data should basically be identical to the tar gz

seph · Answer

I even kinda understand stuff With status quo I can run osqueryd from contents but I m skeptical it has the entitlements and it generally looks unsigned But I can move it outside the app bundle and then it starts looking pretty normal

seph · Answer

With my signing the app Things display as codesigned and notarized But if I copy the binary out of the app it complains about being invalid

seph · Answer

Which ultimately probably means we need to view the app bundle as somewhat more real than we thought I think we can distribute a bare signed osqueryd But it may not be as useful

seph · Answer

If anyone wants to play here s a zip This was built on CI but signed on my local machine

seph · Answer

theopolis · Answer

I am not sure I am following exactly but it s late and my brain is most likely fried Are we OK if we sign the binary then the app bundle I would expect that allows the binary to be moved out of the bundle and used as a normal signed binary

theopolis · Answer

But I see what you are saying about <https github com osquery osquery codesign blob master github workflows release generator yml L417> needing to sign the app Let me think through this and see if there s an easy path

theopolis · Answer

I don t see a downside to the package data including the app bundle layout That means less logic in osquery packaging

alessandrogario · Answer

Additional note to why package data is done like that since not all package formats require the same files we used a neutral archive that contrains a control folder with all the files required for all different formats

alessandrogario · Answer

One of the major issues we had before is that we couldn t generate an MSI file from a the ZIP release because the WiX data was missing The opposite was also true we couldn t start from the MSI to generate Choco because we were missing the nupkg configuration files

alessandrogario · Answer

I think it is fine to include app as an additional format if there is no other way but I think it makes sense to keep package data neutral and see if we can fix this the correct way and keep the standard procedure to sign while the package is being made

sharvil · Answer

Taking a look

seph · Answer

gt Are we OK if we sign the binary then the app bundle From what I can tell signing the app bundle overwrites the sig on the plain macho binary

sharvil · Answer

I think the `spctl` output is a red herring of sorts while not ideal since our app bundle is a minimal set of things required for it to work I took the `osquery a08056b68ef64b23d163fafdfe6f0e1681c80a5c pkg` from the test s3 bucket installed it on a fresh macOS 11 VM and things are working fine It is picking up the entitlements and also the provisioning profile correctly and I can see `es process events` flowing in

sharvil · Answer

I am still digging a bit into this

seph · Answer

I could run the `osqueryd` from the the bundle but all the signature verification tools I have say it s a bad sig Which makes me think we re asking for trouble

sharvil · Answer

any other tool apart from spctl

seph · Answer

spctl codesign <https objective see com products whatsyoursign html>

sharvil · Answer

```root osquerytests Mac codesign vvv strict deep display opt osquery lib osquery app Executable= opt osquery lib osquery app Contents MacOS osqueryd Identifier=osqueryd Format=app bundle with Mach O thin x86 64 CodeDirectory v=20500 size=311860 flags=0x10000 runtime hashes=9737+5 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=870a7d77eabc2d12c410060aed030bbe940a81fc CandidateCDHashFull sha256=870a7d77eabc2d12c410060aed030bbe940a81fc94241ab9824f21f9a96f7348 Hash choices=sha256 CMSDigest=870a7d77eabc2d12c410060aed030bbe940a81fc94241ab9824f21f9a96f7348 CMSDigestType=2 CDHash=870a7d77eabc2d12c410060aed030bbe940a81fc Signature size=9021 Authority=Developer ID Application OSQUERY A Series of LF Projects LLC 3522FA9PXF Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=Aug 15 2021 at 5 52 53 PM Info plist=not bound TeamIdentifier=3522FA9PXF Runtime Version=11 1 0 Sealed Resources=none Internal requirements count=1 size=168 root osquerytests Mac CodeSignature ```

seph · Answer

```dover osq5 seph$ codesign vvv strict deep opt osquery lib osquery app opt osquery lib osquery app code has no resources but signature indicates they must be present```

sharvil · Answer

I see there is a new ` CodeSignature CodeResources` file in the signed app bundle

sharvil · Answer

```root osquerytests Mac Desktop find ~ Desktop osquery app Users osquerytest Desktop osquery app Users osquerytest Desktop osquery app Contents Users osquerytest Desktop osquery app Contents CodeSignature Users osquerytest Desktop osquery app Contents CodeSignature CodeResources Users osquerytest Desktop osquery app Contents MacOS Users osquerytest Desktop osquery app Contents MacOS osqueryd Users osquerytest Desktop osquery app Contents Resources Users osquerytest Desktop osquery app Contents Resources osqueryctl Users osquerytest Desktop osquery app Contents embedded provisionprofile Users osquerytest Desktop osquery app Contents Info plist Users osquerytest Desktop osquery app Contents PkgInfo root osquerytests Mac Desktop find opt osquery lib osquery app opt osquery lib osquery app opt osquery lib osquery app Contents opt osquery lib osquery app Contents MacOS opt osquery lib osquery app Contents MacOS osqueryd opt osquery lib osquery app Contents Resources opt osquery lib osquery app Contents Resources osqueryctl opt osquery lib osquery app Contents embedded provisionprofile opt osquery lib osquery app Contents Info plist opt osquery lib osquery app Contents PkgInfo```

sharvil · Answer

``` lt xml version= 1 0 encoding= UTF 8 gt lt DOCTYPE plist PUBLIC Apple DTD PLIST 1 0 EN <http www apple com DTDs PropertyList 1 0 dtd> gt lt plist version= 1 0 gt lt dict gt lt key gt files lt key gt lt dict gt lt key gt Resources osqueryctl lt key gt lt data gt cfmKsVPNeZNg+ +Phdj1bSeUOE4= lt data gt lt dict gt lt key gt files2 lt key gt lt dict gt lt key gt Resources osqueryctl lt key gt lt dict gt lt key gt hash2 lt key gt lt data gt XK+14UzR5NpyldAfI3YrGoH2v0L1pzZLt Hb6yBA5ko= lt data gt lt dict gt lt key gt embedded provisionprofile lt key gt lt dict gt lt key gt hash2 lt key gt lt data gt X1tITOEGCKY4oqba+4SFfq3vhZW3rGSe8gjNcIk9t1M= lt data gt lt dict gt lt dict gt lt key gt rules lt key gt lt dict gt lt key gt ^Resources lt key gt lt true gt lt key gt ^Resources lproj lt key gt lt dict gt lt key gt optional lt key gt lt true gt lt key gt weight lt key gt lt real gt 1000 lt real gt lt dict gt lt key gt ^Resources lproj locversion plist$ lt key gt lt dict gt lt key gt omit lt key gt lt true gt lt key gt weight lt key gt lt real gt 1100 lt real gt lt dict gt lt key gt ^Resources Base lproj lt key gt lt dict gt lt key gt weight lt key gt lt real gt 1010 lt real gt lt dict gt lt key gt ^version plist$ lt key gt lt true gt lt dict gt lt key gt rules2 lt key gt lt dict gt lt key gt dSYM $| lt key gt lt dict gt lt key gt weight lt key gt lt real gt 11 lt real gt lt dict gt lt key gt ^ DS Store$ lt key gt lt dict gt lt key gt omit lt key gt lt true gt lt key gt weight lt key gt lt real gt 2000 lt real gt lt dict gt lt key gt ^ Frameworks|SharedFrameworks|PlugIns|Plug ins|XPCServices|Helpers|MacOS|Library Automator|Spotlight|LoginItems lt key gt lt dict gt lt key gt nested lt key gt lt true gt lt key gt weight lt key gt lt real gt 10 lt real gt lt dict gt lt key gt ^ lt key gt lt true gt lt key gt ^Info plist$ lt key gt lt dict gt lt key gt omit lt key gt lt true gt lt key gt weight lt key gt lt real gt 20 lt real gt lt dict gt lt key gt ^PkgInfo$ lt key gt lt dict gt lt key gt omit lt key gt lt true gt lt key gt weight lt key gt lt real gt 20 lt real gt lt dict gt lt key gt ^Resources lt key gt lt dict gt lt key gt weight lt key gt lt real gt 20 lt real gt lt dict gt lt key gt ^Resources lproj lt key gt lt dict gt lt key gt optional lt key gt lt true gt lt key gt weight lt key gt lt real gt 1000 lt real gt lt dict gt lt key gt ^Resources lproj locversion plist$ lt key gt lt dict gt lt key gt omit lt key gt lt true gt lt key gt weight lt key gt lt real gt 1100 lt real gt lt dict gt lt key gt ^Resources Base lproj lt key gt lt dict gt lt key gt weight lt key gt lt real gt 1010 lt real gt lt dict gt lt key gt ^ ^ +$ lt key gt lt dict gt lt key gt nested lt key gt lt true gt lt key gt weight lt key gt lt real gt 10 lt real gt lt dict gt lt key gt ^embedded provisionprofile$ lt key gt lt dict gt lt key gt weight lt key gt lt real gt 20 lt real gt lt dict gt lt key gt ^version plist$ lt key gt lt dict gt lt key gt weight lt key gt lt real gt 20 lt real gt lt dict gt lt dict gt lt dict gt lt plist gt ``` Which is a plist of all files and hashes

sharvil · Answer

yep you are right we should sign the ` app` bundle too

seph · Answer

AFAICT there s no point to signging the macho binary prior

sharvil · Answer

okay I am gonna put a PR to try things out

sharvil · Answer

might result in some failed workflows and notifications while i try things out

sharvil · Answer

yes I think so too

seph · Answer

I can review PRs intermittently

seph · Answer

But I think it would be clean to have the app generated in the osquery package data phase

alessandrogario · Answer

reading again i can see your point

alessandrogario · Answer

makes sense to do it that way

alessandrogario · Answer

i was initially assuming the app to be a package itself but it s totally wrong as it s in fact a binary

seph · Answer

Yeah The app is a special directory structure around some binaries It s sorta like a package in you might not need any more

sharvil · Answer

PR for `osquery osquery` <https github com osquery osquery pull 7263>

sharvil · Answer

working on updating packaging repo next

sharvil · Answer

Packaging PR <https github com osquery osquery packaging pull 11>

sharvil · Answer

Codesign PR <https github com osquery osquery codesign pull 28>

sharvil · Answer

would like your code reviews whenever you get a moment < seph> < theopolis>