Documentation
¶
Overview ¶
Package codesign ad-hoc signs the current macOS executable with a set of entitlements and re-execs it once, so a binary built without signing can still acquire entitlements it needs at runtime (notably com.apple.security.virtualization).
It is idempotent and re-exec-guarded: if the executable already carries every required entitlement, or the guard environment variable is set (indicating a prior re-exec), EnsureSigned is a no-op. Call it once at startup:
err := codesign.EnsureSigned(codesign.Options{
Entitlements: entitlementsPlist, // plist bytes (e.g. go:embed)
RequireKeys: []string{"com.apple.security.virtualization"},
GuardEnv: "MYAPP_CODESIGN_DONE",
})
This package performs ad-hoc signing (codesign -s -); it requires no signing identity. For signing-identity discovery and signature verification, see github.com/tmc/macgo/codesign, which is a separate concern.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureSigned ¶
EnsureSigned ad-hoc signs the current executable with opts.Entitlements and re-execs it once, unless the binary already carries every key in opts.RequireKeys or the guard variable opts.GuardEnv is set. On a successful sign it replaces the process image via execve, so it does not return on the signing path; it returns nil when no signing is needed.
Types ¶
type Options ¶
type Options struct {
// Entitlements is the entitlements plist, as bytes. Callers typically embed
// it with go:embed or inline a literal. Required.
Entitlements []byte
// RequireKeys lists the entitlement keys that must all be present for the
// binary to count as already signed. If any is missing the binary is
// (re)signed. At least one key is required.
//
// Checking every key — not just one — matters when a binary needs several
// entitlements: a binary signed with a subset would otherwise be treated as
// done and never gain the rest.
RequireKeys []string
// GuardEnv is the environment variable used to detect the post-sign re-exec
// and prevent an infinite loop. Required; it must be unique to the binary
// (e.g. "MYAPP_CODESIGN_DONE"). No default is supplied on purpose: a shared
// default would let one binary's already-signed re-exec be misread by a
// differently-built sibling during a rollout.
GuardEnv string
// VerifyHash, when true, hashes the executable before and after signing and
// skips the re-exec if codesign left the file unchanged (it was already
// signed in a way the entitlement check did not detect). When false the
// binary always re-execs after a successful codesign.
VerifyHash bool
// contains filtered or unexported fields
}
Options configures EnsureSigned.
Source Files