Documentation/Nightly/Developers/Mac OS X Code Signing - Revision history

JChris.FillionR: /* Authentication */

2018-10-26T01:55:54Z

Authentication

Max.smolens: /* Verifying */

2016-05-27T14:05:34Z

Verifying

Max.smolens: /* Verifying */

2016-05-27T14:04:39Z

Verifying

Max.smolens: /* Verifying */

2016-05-26T19:53:55Z

Verifying

Max.smolens: Xcode

2016-05-26T19:52:58Z

Xcode

Max.smolens: /* Developer ID certificate */

2016-05-26T19:52:22Z

Developer ID certificate

Max.smolens: /* Verifying */

2016-05-26T19:44:47Z

Verifying

Max.smolens: /* Integration with CPack */

2016-05-26T19:35:39Z

Integration with CPack

Max.smolens: /* Tasks */

2016-05-26T19:20:23Z

Tasks

Max.smolens at 19:19, 26 May 2016

2016-05-26T19:19:24Z

@@ Line 41: / Line 41: @@
 Depending on the environment in which code signing is being performed, it may be necessary to take one or more of the following steps to use the <tt>codesign</tt> tool without user interaction (i.e. authentication):
 * Run <code>security unlock-keychain</code>, like [https://github.com/Mendeley/Mac-OS-X-Bundle-Utilities/blob/4f92019d559989a160abf578e36107e825935ca7/hdiutil-codesign.rb#L71 here]
-* In Keychain Access, edit the certificate's private key to "allow all applications to access this item"
+* In Keychain Access, edit the certificate's private key to "allow all applications to access this item" (right click on the private key, then choose <tt>Get Info</tt>)
 * Add the signing certificate to the system keychain instead of the login keychain

@@ Line 105: / Line 105: @@
 ==Verifying==
-See [https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211 Checking Gatekeeper Conformance] and [https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW13 Verifying Your Steps] for detailed instructions on how to verify a signed application works with Gatekeeper. For reference, some basic commands using the <tt>spctl</tt> tool to verify are summarized below. The <tt>spctl</tt> tool tests code signatures against Gatekeeper policies and manages the security assessment policy subsystem.
+See [https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211 Checking Gatekeeper Conformance] and [https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW13 Verifying Your Steps] for detailed instructions on how to verify a signed application works with Gatekeeper.
 ===Tasks===

@@ Line 105: / Line 105: @@
 ==Verifying==
-See [https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211 Checking Gatekeeper Conformance] and [https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW13 Verifying Your Steps] for detailed instructions on how to verify that code signing an application worked with Gatekeeper. For reference, some basic commands using the <tt>spctl</tt> tool to verify are summarized below. The <tt>spctl</tt> tool tests code signatures against Gatekeeper policies and manages the security assessment policy subsystem.
+See [https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211 Checking Gatekeeper Conformance] and [https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW13 Verifying Your Steps] for detailed instructions on how to verify a signed application works with Gatekeeper. For reference, some basic commands using the <tt>spctl</tt> tool to verify are summarized below. The <tt>spctl</tt> tool tests code signatures against Gatekeeper policies and manages the security assessment policy subsystem.
 ===Tasks===

← Older revision		Revision as of 19:53, 26 May 2016
Line 106:		Line 106:

	See [https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211 Checking Gatekeeper Conformance] and [https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW13 Verifying Your Steps] for detailed instructions on how to verify that code signing an application worked with Gatekeeper. For reference, some basic commands using the <tt>spctl</tt> tool to verify are summarized below. The <tt>spctl</tt> tool tests code signatures against Gatekeeper policies and manages the security assessment policy subsystem.		See [https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG211 Checking Gatekeeper Conformance] and [https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html#//apple_ref/doc/uid/TP40012582-CH12-SW13 Verifying Your Steps] for detailed instructions on how to verify that code signing an application worked with Gatekeeper. For reference, some basic commands using the <tt>spctl</tt> tool to verify are summarized below. The <tt>spctl</tt> tool tests code signatures against Gatekeeper policies and manages the security assessment policy subsystem.
		+
		+	===Tasks===

	List current assessment rules:		List current assessment rules:

@@ Line 19: / Line 19: @@
 A Developer ID certificate is required to sign an application for distribution outside of the Mac App Store. Once Slicer is signed with this type of certificate, Gatekeeper's signature verification will succeed and users will be able to run Slicer without warnings.
-Only the team agent for an organization in the Apple Developer program has authority to create Developer ID certificates. Certificates can be created using XCode or on the Apple Developer site: https://developer.apple.com/account/mac/certificate/.
+Only the team agent for an organization in the Apple Developer program has authority to create Developer ID certificates. Certificates can be created using Xcode or on the Apple Developer site: https://developer.apple.com/account/mac/certificate/.
 There are two types of Developer ID certificates: Developer ID Application certificate and Developer ID Installer certificate. Only the Developer ID Application certificate is required to sign Slicer. The Developer ID Installer certificate is used to sign installers in .pkg format.

← Older revision		Revision as of 19:52, 26 May 2016
Line 22:		Line 22:

	There are two types of Developer ID certificates: Developer ID Application certificate and Developer ID Installer certificate. Only the Developer ID Application certificate is required to sign Slicer. The Developer ID Installer certificate is used to sign installers in .pkg format.		There are two types of Developer ID certificates: Developer ID Application certificate and Developer ID Installer certificate. Only the Developer ID Application certificate is required to sign Slicer. The Developer ID Installer certificate is used to sign installers in .pkg format.
		+
		+	Using a self-signed certificate as opposed to a Developer ID certificate is appropriate while testing the packaging process. To create a self-signed certificate, follow the steps in [https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW1 Obtaining a Signing Identity] described in the section titled "To use the Certificate Assistant to create a self-signed signing identity."

	===App identifier===		===App identifier===

@@ Line 102: / Line 102: @@
 ==Verifying==
 ==Reference list==
 <references />

← Older revision		Revision as of 19:35, 26 May 2016
Line 80:		Line 80:

	==Integration with CPack==		==Integration with CPack==
		+
		+	Preliminary testing shows one possible way to integrate code signing into Slicer's packaging process with CPack.
		+
		+	After running <tt>fixup_bundle</tt> in [https://github.com/Slicer/Slicer/blob/3833366b4d0c4a5ee45f6ce2023f56c530a96925/CMake/SlicerCPackBundleFixup.cmake.in#L323 CMake/SlicerCPackBundleFixup.cmake.in] (or outside the function after calling <tt>fixup_bundle_with_plugins</tt>?), call <tt>codesign</tt> like:
		+
		+	execute_process(
		+	COMMAND codesign --deep --force --sign "<certificate id>" -i "<unique app identifier>" "${app_dir}"
		+	)
		+
		+	Note that <tt><certificate id></tt> and <tt><unique app identifier></tt> should be CMake variables.
		+
		+	The process could also verify the signing:
		+
		+	execute_process(
		+	COMMAND codesign -dv "${app_dir}"
		+	)
		+
		+	Logic could be added to only sign if the required CMake variables are specified.
		+
		+	Note that the CPack [https://cmake.org/cmake/help/v3.5/module/CPackBundle.html Bundle] generator can be configured to sign by setting variables such as <tt>CPACK_BUNDLE_APPLE_CERT_APP</tt>. However, this cannot be used here because Slicer uses the [https://cmake.org/cmake/help/v3.5/module/CPackDMG.html DragNDrop] generator (see [https://github.com/Slicer/Slicer/blob/846a654748e263ca51ac43c0d324d260c03e008e/CMake/SlicerCPack.cmake#L14-L16 CMake/SlicerCPack.cmake]).

	==Verifying==		==Verifying==

@@ Line 70: / Line 70: @@
      codesign -dv
-Show designated requirements:<ref>[https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html#//apple_ref/doc/uid/TP40005929-CH3-SW2 Code Requirements], Mac Developer Library—OS X Code Signing In Depth</ref>
+Show designated requirements<ref>[https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html#//apple_ref/doc/uid/TP40005929-CH3-SW2 Code Requirements], Mac Developer Library—OS X Code Signing In Depth</ref>:
      codesign -d -r- ./Slicer.app

@@ Line 33: / Line 33: @@
 For Slicer, in the first case, the factory could set the CMake variable <tt>MACOSX_BUNDLE_GUI_IDENTIFIER</tt> (see [https://github.com/Slicer/Slicer/blob/master/CMake/MacOSXBundleInfo.plist.in#L17-L18 CMake/MacOSXBundleInfo.plist.in]). In the second case, a new CMake variable could be added and used when signing the code.
-The unique app identifiers are typically hierarchical names in reverse DNS notation.<ref>[https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW6 Adding an Info.plist to Single-File Tools], (Mac Developer Library—Code Signing Guide)</ref> Therefore, an appropriate identifier could be something like <tt>com.kitware.medical.Slicer</tt>.
+The unique app identifiers are typically hierarchical names in reverse DNS notation.<ref>[https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW6 Adding an Info.plist to Single-File Tools], Mac Developer Library—Code Signing Guide</ref> Therefore, an appropriate identifier could be something like <tt>com.kitware.medical.Slicer</tt>.
 ===Authentication===