From e9754efbbe2f6da03b29d42606cb5365e4cd489e Mon Sep 17 00:00:00 2001 From: Janek Bevendorff Date: Wed, 25 Mar 2020 00:24:27 +0100 Subject: [PATCH] Fix macOS 10.15.4 codesigning crash. The recent macOS security patch renders our codesigning "fix" of setting the sandbox entitlement to false twice unusable. This patch adds a full provisioning profile and adjusts the signing procedure to not include entitlements for Qt frameworks. The patch also changes the app and bundle ID, so granted accessibility privileges have to be granted again after installing the update. Fixes #4398 Fixes #4515 --- CMakeLists.txt | 13 +++++---- release-tool | 11 ++++++-- share/macosx/Info.plist.cmake | 6 ++-- share/macosx/embedded.provisionprofile | Bin 0 -> 7610 bytes share/macosx/keepassxc.entitlements | 37 ++++++------------------- src/CMakeLists.txt | 1 + 6 files changed, 27 insertions(+), 41 deletions(-) create mode 100644 share/macosx/embedded.provisionprofile diff --git a/CMakeLists.txt b/CMakeLists.txt index ac4c8a9ac..8375dff7b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -334,12 +334,13 @@ if(MINGW) set(PLUGIN_INSTALL_DIR ".") set(DATA_INSTALL_DIR "share") elseif(APPLE AND WITH_APP_BUNDLE) - set(CMAKE_INSTALL_MANDIR "${PROGNAME}.app/Contents/Resources/man") - set(CLI_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS") - set(PROXY_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS") - set(BIN_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS") - set(PLUGIN_INSTALL_DIR "${PROGNAME}.app/Contents/PlugIns") - set(DATA_INSTALL_DIR "${PROGNAME}.app/Contents/Resources") + set(BUNDLE_INSTALL_DIR "${PROGNAME}.app/Contents") + set(CMAKE_INSTALL_MANDIR "${BUNDLE_INSTALL_DIR}/Resources/man") + set(CLI_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS") + set(PROXY_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS") + set(BIN_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS") + set(PLUGIN_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/PlugIns") + set(DATA_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/Resources") else() include(GNUInstallDirs) diff --git a/release-tool b/release-tool index 6d217ca9d..26fc7fae8 100755 --- a/release-tool +++ b/release-tool @@ -1200,9 +1200,14 @@ appsign() { exitError "Unpacking failed!" fi - logInfo "Signing app..." - xcrun codesign --sign "${key}" --verbose --deep --entitlements \ - "${real_src_dir}/share/macosx/keepassxc.entitlements" ./app/KeePassXC.app + logInfo "Signing app bundle..." + xcrun codesign --sign "${key}" --verbose --deep --options runtime ./app/KeePassXC.app + + # Sign main binary and libraries independently so we can keep using the convenient --deep + # option while avoiding adding entitlements recursively + logInfo "Signing main binary..." + xcrun codesign --sign "${key}" --verbose --force --options runtime --entitlements \ + "${real_src_dir}/share/macosx/keepassxc.entitlements" ./app/KeePassXC.app/Contents/MacOS/KeePassXC if [ 0 -ne $? ]; then cd "${orig_dir}" diff --git a/share/macosx/Info.plist.cmake b/share/macosx/Info.plist.cmake index b38ca2844..53e489742 100644 --- a/share/macosx/Info.plist.cmake +++ b/share/macosx/Info.plist.cmake @@ -15,7 +15,7 @@ CFBundleIconFile keepassxc.icns CFBundleIdentifier - org.keepassx.keepassxc + org.keepassxc.keepassxc CFBundleInfoDictionaryVersion 6.0 CFBundleName @@ -25,11 +25,11 @@ CFBundleShortVersionString ${KEEPASSXC_VERSION} CFBundleSignature - KEPX + KPXC CFBundleVersion ${KEEPASSXC_VERSION_NUM} NSHumanReadableCopyright - Copyright 2016-2018 KeePassXC Development Team + Copyright 2016-2020 KeePassXC Development Team CFBundleDocumentTypes diff --git a/share/macosx/embedded.provisionprofile b/share/macosx/embedded.provisionprofile new file mode 100644 index 0000000000000000000000000000000000000000..6fb14fd57e8c95ebb3a88fb7e69fe06409223f6e GIT binary patch literal 7610 zcmdT}d3;k<_HVjSxZm{mjV4eOQVSj7a9})*Mv`O+mXIpJ{oaIN zh^7kq1NLAzCIiZf!3!m}u&of7Y1jUMJD}I*#KRSt8Rc$!tOA%r`3lTyFQ+A%pf?l_ z0%t3vcDo7-g-kqZ;z9a@HmV%+VT3(cPU{fqR^f5tSQyM0wb^}PXQk5~R0Zvo&S;lX zEEvRkY8NrI92G}W%3<`>M(Yww_`(a?+m!OLaJP3h(5PTQ45%1l6+=uNojIP)9?vSX zl+)UVI($-juyCb6=>44oUGr0FO@C|}4Vl22+1n><>rzsQc|vwtXXyC$h~1NjI}d~& zOd5p19_o_qoJvMH@C&Puqo~mC;_(oXlz>STfe92v4OYZ#D)pFDT#~OgOQe1a>WJV9 zSS^qtYM8X^1YtQZB!cOB0Zfu^jmW^T7^4wfWQd^xj{p@YJh)F2uy{Q#vq=-MGFXJ# zWPmVHSqw92*mA9zl)z@bL9LeY5juj4k&s1;@GT|@gc&UXGeZcTW!0!aNVkcAWv>SU zHg$4D&}NfIkW#e?A*~`kp*6ByGM7Lmhuv*sh(pdZ804hbfh*)XJSuky;&L4km%GrY zG0_K}pbzTmbMX*wT!6_DLc}AyT8ZDQ<2s{mFjqOxjmPwHn_2<+8HzX>RrBE@gisg| zST0vU8jsCu2w9nk2X`V84G(FX2WC__Y$8v@>hcp>udv!;3=wK?B0g-ll_~LBoUmUL zm*^C9n5lJ{nR2H)Du~0HcDi`N|G#bHUi zj9CYJ3_7r;2^VHS2Ipw&X9a%UAc zXfVW#`qIj~2pHlhnImBipOgFq~C< zW6+JMz47WOn+OXzs+eD1E%rw+k3fZn4LogFSf%C^Nw`XOkwGOgF=GrH^oS0J24=OZOo`3^Z zW5Whs|Hewh4;n5wE` zWo15*TkiHtkuoVaWJV1DgK#yQR0OKkC?8hCh@XWbEFF&r+aOX!m{BQdMi8}L4B{@3 zyI@kzV~Kc)JW}h0NE}8SPKny? zq(!YvGea$ebv%U2hy4ga1Q9|YMASGB)|hcjtbuU8KO$q=n6}u1b27K(vB6~q?~-JX z7!fE*Sj}?6s?Y*#37A2i1B{4Roe01YPaG9JfH59aBw?c>VYOY0kY<1*;OW4b3cA&3 z0J1`tnPDJpVBE~m6IOSi?hDFez-0zXw)}X$SyaUeEnR%1HrfmbT-x&1Hej2wyEg zXr!8#!0U%#IG-Q{2rQJsMzh9(BQkr01sPC-*5pyEVG|UHS7Pp{G$3+AsKex?bEHI2 z%O>Nn*A-+NrFaO5$xAUuQ4vEdhIqD8EsYLYxDuU#24aN!Sgv@f2j*zZ+E`SC8xf+~ z=M{L!YK|NdGm4m1MQVXcpr{sC!hEl|)QtHY(ID5w*GXMsXN2Wsi1}s@12Hi~2$K~S z(&!3(DakPzkWjQ*?6yUta*0+LVM*LL*UF9td}NHNbh=@QAXe%t5^Ff3>Npz;GJRD- zuSO@qSyCa!)(iDMD+)ORsLEjra6J(>ZgZHUzCb1EEEAXcxn4!sz$dvjrJIOXdUR@M zl?08jB}G;m#T84oiy zwx`;zStsWFu*uju2}()Wj(PvH`E(mdgtaGA6hs5g;2#n)CKs@=VkY!QgzR5Z%x>UL$JpKXqFR%s&fs>!@=rq4yFSW>n5FDGF?&ZWV781*3(w!wrRJT(Dg7k zC793drXnDiKAS&SS=m!Vf~V@7Uc1gOb4I#Zs?!&?1EyS2%H}}jw9Zz?w$$rUewU{m zRJxMR#OO90FXrGJb}@^~9qM^3$Sg1C&5UNedY)DC_Bq#T#oNsO^^EUK@`gGMZlr&J_SljBI6n$#10m*tT zeE{@GFVM&wkl9wDP*ERVLLUQ-N_1uoC}{8OX2M|csBm@I;SV~)F?t>}Fd>&RpijG; z#_tbPc`)?opgwdaAoCmsoyBEwEQ9(mdN!e&r4M%^yQdT5ps{UEWRGlDZuAE|HWFkn zwTq!sHFi)CBsLVC4srRPjl^NK?bQ#b9BnrG2=>fK>AKl9KJNU}MY)P;qfcA*C}!<@@z~2Jhg5BSX5}iT zLVu^fDZ6e*UY~uJNx_RM@vfrcON*bs@O8_o4;@YKH2z9F7uc0-mXgTAvYoAmFUY>% zJ3(B({_=>Y?z&vNH{`LOIrin-H-%4p{Pq5M-^BL1Fe3Ne>vu0ZnypX!K3Vqn?}y^| z7TMoSPN5`G8f(@=HH}aKh<8EX)V$PzFFZCVR>2u=D?y)oub8&jC()2Uo4rl{+38SqxV#(Bq1<7^)YBPG_qkt z!|=L-j>;GhdU{mGL9oe6Ko`_EA)k}5kP5bZ9n`N^W?Oxa+j=EaQj@`6e{k!ArKBV& zKl$GL{YaV!?x zyy@_M0W`mHR-YpUqAfqXJhw5tV%`2%g0m-7Y!YNG((PpIUNBhe&Q$c1^)o?Je0{oV7o`iv~dl8l-CLph$q66P(`nx{q z^^Low(8dc5o134Q`DF%q`F++}%E1|*UCjJ)!j9cncUhO*OvB;Y!#NWQWJ}had-Kl6 zOTJNFl7BU3S3Tp z>F3Lz>hpt*Ju+9CYc6iHbbVXmQ+T)=k1~U#8i7TdOGqd zbD(_75pc4oLjgp zjRMu&0H;CkqF&$#OHZccJ(@s<(C`3qb6(sDrxoDsUa|G z!@w7`us!GnFZgU!-0!nF+fF2^zmi%VvX6VfP{0q~O&9}`UG@`aY9NT=VZetHI>YVM zw&XXd*#=)zN|(usqua05ulVdHx#C9T7zru&4S#;t^FxzZuai!;evgo|tZ5j+9?1>JNQ$1z!&+*2S@AM2+76AVLS%Q&ZMx_v) z!G$0?i^cpMGtz*syyHM7q^4w#mSZ?osim5zUA!55z)dtNonZ56orDjxy9nF^+$r%% z8z^a`cp#PjHL3X`x7;}QVy13n-p;b%md_`T;tYRs_A6g!Wqr8m=I5rBNpH{k+5g(C zs+mfWDBKV5L=X>`l}bB)I+_va43 zuyjhrQvM}qVElux&QmXY9SfSK?``DX`1Y%UQ{^0nF!K!l{ag7rG}J|-c3mDn^{-Pe zuIF3c=qso|&+$JWv|A~Q`v0EvC1*`1)SUp4`V@My6FDf9R3=1+Xq|0{Qa7@LkofUX zpa&yKG(nX_lC~gJ)`J(lw0uBrPE8I`7Q0PZb#3hcWQQ~WWhZd1jTa?DNe_^shtjB8 z%CJsg902^w0smPK0OQ@?f?f9iPq1Tm#u>o-6A!%-=|)UD)>(o)crvBW1SeDbB@b>( z&H60|1jx_^qSG3eEGbCyFL37_TO=8uGp`Arlrs9K=D!|%Pia_RuVB8w&pJg}3}?>U zbmFCRZ`RJg`O)8Kr9YvAcdhxpwJ`WRWsg{S<@kzMZs$-AH1;2`I{SnE^%I+#UzoXg z{%GktriB^lHCxH7arZB#{JP1p`obfOqFNpO?2xfPk98c+YEo>f*>~uLQRydlEiyUy zt{e3^WK+uQi%ai0Z!P=3&ABLf%CUyv3nCO6#BV&93H zR~}a0KEwP%?O5{|vuN7%;`NSasz-gk_$is9#nJm8PLp!yjmEO2%}351*m&&hi~R-| zPyI0c%QNYDdvE1W!apErYx9rOYm?uAYLnN4%dZ5H|6c{m8(bwpBfCda>7Z_r4WEA^V-Mrk$Hh%Qi(iFx zf%-@dcRZaUT=7M zwfXYJ=f0W4T>nkphx@X27k{+)1!2X^hQH;aIpuqF*IzrfpSY33*>PYKd ze46^ho6^5dIJ&p`t0jlOq9r{R`Nys`E&H>t4IQc()n|lsillYr#RbgIepoVHT0Ezr z-%}S(j97j)bN~IcXXmIKi^lAIynN@W_jg=BaxdwAEWg=xq3YtAgHrT}a?at$y_c6O j5wdrkzJ^@(J*VjOw|tH)z4rw5)6>$`>F4_P;;#HBoXtvq literal 0 HcmV?d00001 diff --git a/share/macosx/keepassxc.entitlements b/share/macosx/keepassxc.entitlements index 2645a2031..7126b7ac5 100644 --- a/share/macosx/keepassxc.entitlements +++ b/share/macosx/keepassxc.entitlements @@ -1,33 +1,12 @@ - - com.apple.application-identifier - org.keepassx.keepassxc - com.apple.developer.aps-environment - production - - keychain-access-groups - - org.keepassx.keepassxc - - - - com.apple.security.app-sandbox - - com.apple.security.app-sandbox - - - + + com.apple.application-identifier + G2S7P7J672.org.keepassxc.keepassxc + keychain-access-groups + + G2S7P7J672.org.keepassxc.keepassxc + + diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index af9b9bb58..1982a3c4c 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -354,6 +354,7 @@ target_link_libraries(${PROGNAME} keepassx_core) set_target_properties(${PROGNAME} PROPERTIES ENABLE_EXPORTS ON) if(APPLE AND WITH_APP_BUNDLE) + install(FILES ${CMAKE_SOURCE_DIR}/share/macosx/embedded.provisionprofile DESTINATION ${BUNDLE_INSTALL_DIR}) configure_file(${CMAKE_SOURCE_DIR}/share/macosx/Info.plist.cmake ${CMAKE_CURRENT_BINARY_DIR}/Info.plist) set_target_properties(${PROGNAME} PROPERTIES MACOSX_BUNDLE ON