|
| 1 | +/** |
| 2 | + * Ad-hoc re-sign Bun-compiled darwin Mach-O binaries. |
| 3 | + * |
| 4 | + * `bun build --compile` leaves a linker signature (`Identifier=a.out`, |
| 5 | + * `adhoc,linker-signed`) whose page hashes do not match the final file. |
| 6 | + * macOS 27 SIGKILLs that binary at launch (exit 137). Re-signing after |
| 7 | + * compile covers the bytes that actually ship. |
| 8 | + * |
| 9 | + * darwin hosts use `codesign`, then `codesign --verify --strict`. |
| 10 | + * Linux/Windows release runners use `rcodesign sign`, then check each |
| 11 | + * CodeDirectory page hash in-process. `rcodesign verify` is not a gate: |
| 12 | + * 0.29.0 rejects ad-hoc signatures Apple accepts (`CMS error`). |
| 13 | + */ |
| 14 | +import { createHash } from "node:crypto"; |
| 15 | +import { readFileSync } from "node:fs"; |
| 16 | +import { spawnSync } from "node:child_process"; |
| 17 | + |
| 18 | +export const RCODESIGN_VERSION = "0.29.0"; |
| 19 | + |
| 20 | +function defaultLog(message = "") { |
| 21 | + process.stdout.write(`${message}\n`); |
| 22 | +} |
| 23 | + |
| 24 | +/** Command used to replace the linker signature. `platform` is the build host, not the target. */ |
| 25 | +export function adhocSignPlan(platform = process.platform) { |
| 26 | + if (platform === "darwin") { |
| 27 | + return { |
| 28 | + command: "codesign", |
| 29 | + args: ["--force", "--sign", "-", "--identifier", "bl"], |
| 30 | + }; |
| 31 | + } |
| 32 | + return { |
| 33 | + command: "rcodesign", |
| 34 | + args: ["sign"], |
| 35 | + }; |
| 36 | +} |
| 37 | + |
| 38 | +const LC_CODE_SIGNATURE = 0x1d; |
| 39 | +const CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0; |
| 40 | +const CSMAGIC_CODEDIRECTORY = 0xfade0c02; |
| 41 | +const CSSLOT_CODEDIRECTORY = 0; |
| 42 | +const CDHASH_SHA256 = 2; |
| 43 | + |
| 44 | +/** |
| 45 | + * Recompute CodeDirectory page hashes the way Apple does for ad-hoc Mach-O: |
| 46 | + * each 4KiB page is SHA-256 of the bytes that exist, with no zero padding. |
| 47 | + * Bun's linker signature matches the padded last page and fails this check. |
| 48 | + * |
| 49 | + * @param {string} binaryPath |
| 50 | + */ |
| 51 | +export function verifyAdhocPageHashes(binaryPath) { |
| 52 | + const data = readFileSync(binaryPath); |
| 53 | + const magic = data.readUInt32LE(0); |
| 54 | + const littleEndian = magic === 0xfeedfacf; |
| 55 | + if (!littleEndian && magic !== 0xcffaedfe) { |
| 56 | + throw new Error(`${binaryPath} is not a thin 64-bit Mach-O`); |
| 57 | + } |
| 58 | + const read32 = littleEndian |
| 59 | + ? (offset) => data.readUInt32LE(offset) |
| 60 | + : (offset) => data.readUInt32BE(offset); |
| 61 | + const commandCount = read32(16); |
| 62 | + let commandOffset = 32; |
| 63 | + let signatureOffset = 0; |
| 64 | + for (let commandIndex = 0; commandIndex < commandCount; commandIndex++) { |
| 65 | + const command = read32(commandOffset); |
| 66 | + const commandSize = read32(commandOffset + 4); |
| 67 | + if (command === LC_CODE_SIGNATURE) signatureOffset = read32(commandOffset + 8); |
| 68 | + commandOffset += commandSize; |
| 69 | + } |
| 70 | + if (!signatureOffset) throw new Error(`${binaryPath} has no LC_CODE_SIGNATURE`); |
| 71 | + const readBlob32 = (offset) => data.readUInt32BE(signatureOffset + offset); |
| 72 | + if (readBlob32(0) !== CSMAGIC_EMBEDDED_SIGNATURE) { |
| 73 | + throw new Error(`${binaryPath} code signature superblob is invalid`); |
| 74 | + } |
| 75 | + const blobCount = readBlob32(8); |
| 76 | + let directoryOffset = 0; |
| 77 | + for (let blobIndex = 0; blobIndex < blobCount; blobIndex++) { |
| 78 | + const blobType = readBlob32(12 + blobIndex * 8); |
| 79 | + const blobOffset = readBlob32(12 + blobIndex * 8 + 4); |
| 80 | + if (blobType === CSSLOT_CODEDIRECTORY) directoryOffset = blobOffset; |
| 81 | + } |
| 82 | + if (!directoryOffset) throw new Error(`${binaryPath} has no CodeDirectory`); |
| 83 | + const directory = signatureOffset + directoryOffset; |
| 84 | + if (data.readUInt32BE(directory) !== CSMAGIC_CODEDIRECTORY) { |
| 85 | + throw new Error(`${binaryPath} CodeDirectory magic is invalid`); |
| 86 | + } |
| 87 | + const version = data.readUInt32BE(directory + 8); |
| 88 | + const hashOffset = data.readUInt32BE(directory + 16); |
| 89 | + const codeSlotCount = data.readUInt32BE(directory + 28); |
| 90 | + let codeLimit = data.readUInt32BE(directory + 32); |
| 91 | + const hashSize = data[directory + 36]; |
| 92 | + const hashType = data[directory + 37]; |
| 93 | + const pageShift = data[directory + 39]; |
| 94 | + if (version >= 0x20300) { |
| 95 | + const codeLimit64 = data.readBigUInt64BE(directory + 48); |
| 96 | + if (codeLimit64 > 0n) codeLimit = Number(codeLimit64); |
| 97 | + } |
| 98 | + if (hashType !== CDHASH_SHA256 || hashSize !== 32) { |
| 99 | + throw new Error(`${binaryPath} code signature is not SHA-256`); |
| 100 | + } |
| 101 | + if (codeLimit > data.length) { |
| 102 | + throw new Error(`${binaryPath} codeLimit ${codeLimit} exceeds file length ${data.length}`); |
| 103 | + } |
| 104 | + const pageSize = pageShift === 0 ? codeLimit : 1 << pageShift; |
| 105 | + for (let slot = 0; slot < codeSlotCount; slot++) { |
| 106 | + const start = slot * pageSize; |
| 107 | + const end = Math.min(start + pageSize, codeLimit); |
| 108 | + const recorded = data.subarray( |
| 109 | + directory + hashOffset + slot * hashSize, |
| 110 | + directory + hashOffset + (slot + 1) * hashSize, |
| 111 | + ); |
| 112 | + const actual = createHash("sha256").update(data.subarray(start, end)).digest(); |
| 113 | + if (!recorded.equals(actual)) { |
| 114 | + throw new Error( |
| 115 | + `${binaryPath} code signature page ${slot} does not match the file (stale ad-hoc signature)`, |
| 116 | + ); |
| 117 | + } |
| 118 | + } |
| 119 | +} |
| 120 | + |
| 121 | +/** |
| 122 | + * Replace the Mach-O ad-hoc signature in place. |
| 123 | + * Then recompute page hashes so a stale linker signature fails the build on Linux. |
| 124 | + * On darwin, also run `codesign --verify --strict`. |
| 125 | + * |
| 126 | + * @param {string} binaryPath |
| 127 | + * @param {{ log?: (message?: string) => void, platform?: NodeJS.Platform }} [options] |
| 128 | + */ |
| 129 | +export function signDarwinAdhoc( |
| 130 | + binaryPath, |
| 131 | + { log = defaultLog, platform = process.platform } = {}, |
| 132 | +) { |
| 133 | + const plan = adhocSignPlan(platform); |
| 134 | + log(`adhoc sign via ${plan.command}`); |
| 135 | + const result = spawnSync(plan.command, [...plan.args, binaryPath], { encoding: "utf-8" }); |
| 136 | + if (result.error?.code === "ENOENT") { |
| 137 | + const installHint = |
| 138 | + platform === "darwin" |
| 139 | + ? "codesign ships with the Xcode command line tools." |
| 140 | + : `Install rcodesign ${RCODESIGN_VERSION} (apple-codesign) and retry.`; |
| 141 | + throw new Error( |
| 142 | + `${plan.command} not found on PATH. Darwin binaries need an ad-hoc signature before packaging. ${installHint}`, |
| 143 | + ); |
| 144 | + } |
| 145 | + if (result.stdout) process.stdout.write(result.stdout); |
| 146 | + if (result.stderr) process.stderr.write(result.stderr); |
| 147 | + if (result.status !== 0) { |
| 148 | + throw new Error(`ad-hoc sign failed for ${binaryPath}`); |
| 149 | + } |
| 150 | + verifyAdhocPageHashes(binaryPath); |
| 151 | + if (platform !== "darwin") return; |
| 152 | + |
| 153 | + const verify = spawnSync("codesign", ["--verify", "--strict", binaryPath], { encoding: "utf-8" }); |
| 154 | + if (verify.stdout) process.stdout.write(verify.stdout); |
| 155 | + if (verify.stderr) process.stderr.write(verify.stderr); |
| 156 | + if (verify.status !== 0) { |
| 157 | + const detail = (verify.stderr || verify.stdout || "").trim(); |
| 158 | + throw new Error( |
| 159 | + `codesign --verify --strict failed for ${binaryPath}${detail ? `: ${detail}` : ""}`, |
| 160 | + ); |
| 161 | + } |
| 162 | +} |
0 commit comments