Hi,
When postinstall tries to run another binary inside the ./scripts folder I package with pkgbuild, it gets killed by taskgated when the postinstall script tries to run it.
└── Contents
├── Helpers
├── Info.plist
├── MacOS
│ ├── UI
│ └──Worker
├── PkgInfo
├── Resources
│ ├── com.ui.plist
│ ├── com.worker.plist
│ └── icon.icns
├── _CodeSignature
│ └── CodeResources
└── embedded.provisionprofile
scripts:
├── token_installer
├── postinstall
├── token_installer ├── postinstall
How I am signing:
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force out/myapp.app/Contents/MacOS/UI
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force out/myapp.app/Contents/MacOS/Worker
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force ./scripts/token_installer
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force ./scripts/postinstall
codesign --entitlements entitlements.plist --timestamp --options=runtime --sign "$DEVELOPER_ID" --force out/myapp.app
echo "pkgbuilding..."
pkgbuild --root ./out/myapp.app --sign "$DEVELOPER_ID" --identifier com.myapp.app --version 1.0 --install-location /Applications/myapp.app --scripts ./scripts ./out/myapp.pkg
echo "productbuilding..."
# productbuild --distribution ./Distribution.xml --package-path ./out/myapp.pkg --resources . ./out/MyAppInstaller.pkg
productbuild --product requirements.plist --distribution ./Distribution.xml --package-path ./out/myapp.pkg --resources . ./out/MyAppInstaller.pkg
productsign --sign "Developer ID Installer: My Company Inc (***)" --force ./out/MyAppInstaller.pkg ./out/MyAppInstallerSigned.pkg
Sidenote: all binaries that are not the main executable, UI, get killed by taskgated, but I figured I will wrap the Worker in its own app Inside Helpers. I just do not see the point in doing that for the token_installer, since it should only be called once ever, during postinstall.
Is there a way to make it run without having to include it in the app bundle itself?
Is it not okay to sign the token_installer with the same entitlements as the Worker … ?
Correct.
There are two aspects to this:
-
A provisioning profile is tied to a specific executable via its App ID. TN3125 Inside Code Signing: Provisioning Profiles explains this in detail. Each executable (that needs a profile) should have its own unique App ID, and thus its own profile.
-
For the system to find the executable’s profile, the executable needs to be bundled and the profile embedded in the bundle. Hence the advice in Signing a daemon with a restricted entitlement.
Beyond that, I’m concerned about the execution context of the post-install script that runs your token_installer tool. I’m not an installer expert, so I’m not sure what context that runs in. However, if it runs in a global context then things are going to get weird, because both iCloud and (the data protection) keychain are per-user.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"