From da7ba8a4e8d79200ecead5227b2950b53594bae3 Mon Sep 17 00:00:00 2001 From: Janek Bevendorff Date: Wed, 25 Mar 2020 00:24:27 +0100 Subject: [PATCH] Fix macOS 10.15.4 codesigning crash. The recent macOS security patch renders our codesigning "fix" of setting the sandbox entitlement to false twice unusable. This patch adds a full provisioning profile and adjusts the signing procedure to not include entitlements for Qt frameworks. The patch also changes the app and bundle ID, so granted accessibility privileges have to be granted again after installing the update. Fixes #4398 Fixes #4515 --- CMakeLists.txt | 13 +++++---- release-tool | 11 ++++++-- share/macosx/Info.plist.cmake | 6 ++-- share/macosx/embedded.provisionprofile | Bin 0 -> 7610 bytes share/macosx/keepassxc.entitlements | 37 ++++++------------------- src/CMakeLists.txt | 1 + 6 files changed, 27 insertions(+), 41 deletions(-) create mode 100644 share/macosx/embedded.provisionprofile diff --git a/CMakeLists.txt b/CMakeLists.txt index ac4c8a9ac6..8375dff7bb 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -334,12 +334,13 @@ if(MINGW) set(PLUGIN_INSTALL_DIR ".") set(DATA_INSTALL_DIR "share") elseif(APPLE AND WITH_APP_BUNDLE) - set(CMAKE_INSTALL_MANDIR "${PROGNAME}.app/Contents/Resources/man") - set(CLI_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS") - set(PROXY_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS") - set(BIN_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS") - set(PLUGIN_INSTALL_DIR "${PROGNAME}.app/Contents/PlugIns") - set(DATA_INSTALL_DIR "${PROGNAME}.app/Contents/Resources") + set(BUNDLE_INSTALL_DIR "${PROGNAME}.app/Contents") + set(CMAKE_INSTALL_MANDIR "${BUNDLE_INSTALL_DIR}/Resources/man") + set(CLI_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS") + set(PROXY_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS") + set(BIN_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS") + set(PLUGIN_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/PlugIns") + set(DATA_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/Resources") else() include(GNUInstallDirs) diff --git a/release-tool b/release-tool index 6d217ca9db..26fc7fae84 100755 --- a/release-tool +++ b/release-tool @@ -1200,9 +1200,14 @@ appsign() { exitError "Unpacking failed!" fi - logInfo "Signing app..." - xcrun codesign --sign "${key}" --verbose --deep --entitlements \ - "${real_src_dir}/share/macosx/keepassxc.entitlements" ./app/KeePassXC.app + logInfo "Signing app bundle..." + xcrun codesign --sign "${key}" --verbose --deep --options runtime ./app/KeePassXC.app + + # Sign main binary and libraries independently so we can keep using the convenient --deep + # option while avoiding adding entitlements recursively + logInfo "Signing main binary..." + xcrun codesign --sign "${key}" --verbose --force --options runtime --entitlements \ + "${real_src_dir}/share/macosx/keepassxc.entitlements" ./app/KeePassXC.app/Contents/MacOS/KeePassXC if [ 0 -ne $? ]; then cd "${orig_dir}" diff --git a/share/macosx/Info.plist.cmake b/share/macosx/Info.plist.cmake index b38ca2844c..53e4897422 100644 --- a/share/macosx/Info.plist.cmake +++ b/share/macosx/Info.plist.cmake @@ -15,7 +15,7 @@ CFBundleIconFile keepassxc.icns CFBundleIdentifier - org.keepassx.keepassxc + org.keepassxc.keepassxc CFBundleInfoDictionaryVersion 6.0 CFBundleName @@ -25,11 +25,11 @@ CFBundleShortVersionString ${KEEPASSXC_VERSION} CFBundleSignature - KEPX + KPXC CFBundleVersion ${KEEPASSXC_VERSION_NUM} NSHumanReadableCopyright - Copyright 2016-2018 KeePassXC Development Team + Copyright 2016-2020 KeePassXC Development Team CFBundleDocumentTypes diff --git a/share/macosx/embedded.provisionprofile b/share/macosx/embedded.provisionprofile new file mode 100644 index 0000000000000000000000000000000000000000..6fb14fd57e8c95ebb3a88fb7e69fe06409223f6e GIT binary patch literal 7610 zcmdT}d3;k<_HVjSxZm{mjV4eOQVSj7a9})*Mv`O+mXIpJ{oaIN zh^7kq1NLAzCIiZf!3!m}u&of7Y1jUMJD}I*#KRSt8Rc$!tOA%r`3lTyFQ+A%pf?l_ z0%t3vcDo7-g-kqZ;z9a@HmV%+VT3(cPU{fqR^f5tSQyM0wb^}PXQk5~R0Zvo&S;lX zEEvRkY8NrI92G}W%3<`>M(Yww_`(a?+m!OLaJP3h(5PTQ45%1l6+=uNojIP)9?vSX zl+)UVI($-juyCb6=>44oUGr0FO@C|}4Vl22+1n><>rzsQc|vwtXXyC$h~1NjI}d~& zOd5p19_o_qoJvMH@C&Puqo~mC;_(oXlz>STfe92v4OYZ#D)pFDT#~OgOQe1a>WJV9 zSS^qtYM8X^1YtQZB!cOB0Zfu^jmW^T7^4wfWQd^xj{p@YJh)F2uy{Q#vq=-MGFXJ# zWPmVHSqw92*mA9zl)z@bL9LeY5juj4k&s1;@GT|@gc&UXGeZcTW!0!aNVkcAWv>SU zHg$4D&}NfIkW#e?A*~`kp*6ByGM7Lmhuv*sh(pdZ804hbfh*)XJSuky;&L4km%GrY zG0_K}pbzTmbMX*wT!6_DLc}AyT8ZDQ<2s{mFjqOxjmPwHn_2<+8HzX>RrBE@gisg| zST0vU8jsCu2w9nk2X`V84G(FX2WC__Y$8v@>hcp>udv!;3=wK?B0g-ll_~LBoUmUL zm*^C9n5lJ{nR2H)Du~0HcDi`N|G#bHUi zj9CYJ3_7r;2^VHS2Ipw&X9a%UAc zXfVW#`qIj~2pHlhnImBipOgFq~C< zW6+JMz47WOn+OXzs+eD1E%rw+k3fZn4LogFSf%C^Nw`XOkwGOgF=GrH^oS0J24=OZOo`3^Z zW5Whs|Hewh4;n5wE` zWo15*TkiHtkuoVaWJV1DgK#yQR0OKkC?8hCh@XWbEFF&r+aOX!m{BQdMi8}L4B{@3 zyI@kzV~Kc)JW}h0NE}8SPKny? zq(!YvGea$ebv%U2hy4ga1Q9|YMASGB)|hcjtbuU8KO$q=n6}u1b27K(vB6~q?~-JX z7!fE*Sj}?6s?Y*#37A2i1B{4Roe01YPaG9JfH59aBw?c>VYOY0kY<1*;OW4b3cA&3 z0J1`tnPDJpVBE~m6IOSi?hDFez-0zXw)}X$SyaUeEnR%1HrfmbT-x&1Hej2wyEg zXr!8#!0U%#IG-Q{2rQJsMzh9(BQkr01sPC-*5pyEVG|UHS7Pp{G$3+AsKex?bEHI2 z%O>Nn*A-+NrFaO5$xAUuQ4vEdhIqD8EsYLYxDuU#24aN!Sgv@f2j*zZ+E`SC8xf+~ z=M{L!YK|NdGm4m1MQVXcpr{sC!hEl|)QtHY(ID5w*GXMsXN2Wsi1}s@12Hi~2$K~S z(&!3(DakPzkWjQ*?6yUta*0+LVM*LL*UF9td}NHNbh=@QAXe%t5^Ff3>Npz;GJRD- zuSO@qSyCa!)(iDMD+)ORsLEjra6J(>ZgZHUzCb1EEEAXcxn4!sz$dvjrJIOXdUR@M zl?08jB}G;m#T84oiy zwx`;zStsWFu*uju2}()Wj(PvH`E(mdgtaGA6hs5g;2#n)CKs@=VkY!QgzR5Z%x>UL$JpKXqFR%s&fs>!@=rq4yFSW>n5FDGF?&ZWV781*3(w!wrRJT(Dg7k zC793drXnDiKAS&SS=m!Vf~V@7Uc1gOb4I#Zs?!&?1EyS2%H}}jw9Zz?w$$rUewU{m zRJxMR#OO90FXrGJb}@^~9qM^3$Sg1C&5UNedY)DC_Bq#T#oNsO^^EUK@`gGMZlr&J_SljBI6n$#10m*tT zeE{@GFVM&wkl9wDP*ERVLLUQ-N_1uoC}{8OX2M|csBm@I;SV~)F?t>}Fd>&RpijG; z#_tbPc`)?opgwdaAoCmsoyBEwEQ9(mdN!e&r4M%^yQdT5ps{UEWRGlDZuAE|HWFkn zwTq!sHFi)CBsLVC4srRPjl^NK?bQ#b9BnrG2=>fK>AKl9KJNU}MY)P;qfcA*C}!<@@z~2Jhg5BSX5}iT zLVu^fDZ6e*UY~uJNx_RM@vfrcON*bs@O8_o4;@YKH2z9F7uc0-mXgTAvYoAmFUY>% zJ3(B({_=>Y?z&vNH{`LOIrin-H-%4p{Pq5M-^BL1Fe3Ne>vu0ZnypX!K3Vqn?}y^| z7TMoSPN5`G8f(@=HH}aKh<8EX)V$PzFFZCVR>2u=D?y)oub8&jC()2Uo4rl{+38SqxV#(Bq1<7^)YBPG_qkt z!|=L-j>;GhdU{mGL9oe6Ko`_EA)k}5kP5bZ9n`N^W?Oxa+j=EaQj@`6e{k!ArKBV& zKl$GL{YaV!?x zyy@_M0W`mHR-YpUqAfqXJhw5tV%`2%g0m-7Y!YNG((PpIUNBhe&Q$c1^)o?Je0{oV7o`iv~dl8l-CLph$q66P(`nx{q z^^Low(8dc5o134Q`DF%q`F++}%E1|*UCjJ)!j9cncUhO*OvB;Y!#NWQWJ}had-Kl6 zOTJNFl7BU3S3Tp z>F3Lz>hpt*Ju+9CYc6iHbbVXmQ+T)=k1~U#8i7TdOGqd zbD(_75pc4oLjgp zjRMu&0H;CkqF&$#OHZccJ(@s<(C`3qb6(sDrxoDsUa|G z!@w7`us!GnFZgU!-0!nF+fF2^zmi%VvX6VfP{0q~O&9}`UG@`aY9NT=VZetHI>YVM zw&XXd*#=)zN|(usqua05ulVdHx#C9T7zru&4S#;t^FxzZuai!;evgo|tZ5j+9?1>JNQ$1z!&+*2S@AM2+76AVLS%Q&ZMx_v) z!G$0?i^cpMGtz*syyHM7q^4w#mSZ?osim5zUA!55z)dtNonZ56orDjxy9nF^+$r%% z8z^a`cp#PjHL3X`x7;}QVy13n-p;b%md_`T;tYRs_A6g!Wqr8m=I5rBNpH{k+5g(C zs+mfWDBKV5L=X>`l}bB)I+_va43 zuyjhrQvM}qVElux&QmXY9SfSK?``DX`1Y%UQ{^0nF!K!l{ag7rG}J|-c3mDn^{-Pe zuIF3c=qso|&+$JWv|A~Q`v0EvC1*`1)SUp4`V@My6FDf9R3=1+Xq|0{Qa7@LkofUX zpa&yKG(nX_lC~gJ)`J(lw0uBrPE8I`7Q0PZb#3hcWQQ~WWhZd1jTa?DNe_^shtjB8 z%CJsg902^w0smPK0OQ@?f?f9iPq1Tm#u>o-6A!%-=|)UD)>(o)crvBW1SeDbB@b>( z&H60|1jx_^qSG3eEGbCyFL37_TO=8uGp`Arlrs9K=D!|%Pia_RuVB8w&pJg}3}?>U zbmFCRZ`RJg`O)8Kr9YvAcdhxpwJ`WRWsg{S<@kzMZs$-AH1;2`I{SnE^%I+#UzoXg z{%GktriB^lHCxH7arZB#{JP1p`obfOqFNpO?2xfPk98c+YEo>f*>~uLQRydlEiyUy zt{e3^WK+uQi%ai0Z!P=3&ABLf%CUyv3nCO6#BV&93H zR~}a0KEwP%?O5{|vuN7%;`NSasz-gk_$is9#nJm8PLp!yjmEO2%}351*m&&hi~R-| zPyI0c%QNYDdvE1W!apErYx9rOYm?uAYLnN4%dZ5H|6c{m8(bwpBfCda>7Z_r4WEA^V-Mrk$Hh%Qi(iFx zf%-@dcRZaUT=7M zwfXYJ=f0W4T>nkphx@X27k{+)1!2X^hQH;aIpuqF*IzrfpSY33*>PYKd ze46^ho6^5dIJ&p`t0jlOq9r{R`Nys`E&H>t4IQc()n|lsillYr#RbgIepoVHT0Ezr z-%}S(j97j)bN~IcXXmIKi^lAIynN@W_jg=BaxdwAEWg=xq3YtAgHrT}a?at$y_c6O j5wdrkzJ^@(J*VjOw|tH)z4rw5)6>$`>F4_P;;#HBoXtvq literal 0 HcmV?d00001 diff --git a/share/macosx/keepassxc.entitlements b/share/macosx/keepassxc.entitlements index 2645a2031c..7126b7ac5b 100644 --- a/share/macosx/keepassxc.entitlements +++ b/share/macosx/keepassxc.entitlements @@ -1,33 +1,12 @@ - - com.apple.application-identifier - org.keepassx.keepassxc - com.apple.developer.aps-environment - production - - keychain-access-groups - - org.keepassx.keepassxc - - - - com.apple.security.app-sandbox - - com.apple.security.app-sandbox - - - + + com.apple.application-identifier + G2S7P7J672.org.keepassxc.keepassxc + keychain-access-groups + + G2S7P7J672.org.keepassxc.keepassxc + + diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index af9b9bb586..1982a3c4c4 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -354,6 +354,7 @@ target_link_libraries(${PROGNAME} keepassx_core) set_target_properties(${PROGNAME} PROPERTIES ENABLE_EXPORTS ON) if(APPLE AND WITH_APP_BUNDLE) + install(FILES ${CMAKE_SOURCE_DIR}/share/macosx/embedded.provisionprofile DESTINATION ${BUNDLE_INSTALL_DIR}) configure_file(${CMAKE_SOURCE_DIR}/share/macosx/Info.plist.cmake ${CMAKE_CURRENT_BINARY_DIR}/Info.plist) set_target_properties(${PROGNAME} PROPERTIES MACOSX_BUNDLE ON