Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The latest 0.7.3 release has a 0 byte file at ./Contents/_CodeSignature with 000 permissions #1144

Open
varenc opened this issue Jan 14, 2020 · 7 comments

Comments

@varenc
Copy link

varenc commented Jan 14, 2020

➜  unzip -qq ./MacDown.app.zip
➜  ls -la MacDown.app/Contents/_CodeSignature
.--------- chris wheel 0 B Tue Jan  1 00:00:00 1980   _CodeSignature

That file is empty, so I think it doesn't need to be there? The previous 0.7.2 release didn't have a file at that path. But the reason this is causing issues is that the zip file seems to specify that that file has 000 permissions, not readable or writeable by anyone. When unzipped from the cli with unzip those permissions are preserved.

I noticed this because it's causing issues with homebrew casks. When the file is unzipped with macOS's built in "Archive Utility" the permission problem doesn't exist so probably not many people run into this.

For more context on the homebrew situation, I commented on an issue here: Homebrew/homebrew-cask#75036

@varenc
Copy link
Author

varenc commented Jan 16, 2020

possibly related commit? 7b93d1c

@FranklinYu
Copy link
Member

That was a cherry-pick of 12e8a72 which is fixing #1106. I think I can fix this temporarily (maybe removing this file in build script) but it will probably in 0.7.4 because modifying current release sounds bad.

In addition, is there anyway to test whether this is the only bad file?

@varenc
Copy link
Author

varenc commented Jan 18, 2020

I think it's possible to update the current release's binary without changing the version...but agree that sounds risky.

I checked the latest release with these commands and that seems to be the only file with issues!

➜  wget -q https://github.com/MacDownApp/macdown/releases/download/v0.7.3/MacDown.app.zip
➜  unzip -qq ./MacDown.app.zip
➜  find ./MacDown.app \! -perm -u=r
./MacDown.app/Contents/_CodeSignature
➜  

@varenc
Copy link
Author

varenc commented Jan 18, 2020

Though something more helpful for your release build script...when looping through each file to create the .zip, you could assert os.access(<path>, os.R_OK)

example:

In [13]: os.access("./MacDown.app/Contents/_CodeSignature",os.R_OK)
Out[13]: False
In [14]: os.access("./MacDown.app/Contents/Info.plist",os.R_OK)
Out[14]: True

FranklinYu added a commit that referenced this issue Jan 19, 2020
Removal of code signature with the utility seems to be buggy, and causes
issues like #1144. This solution is found on following answer by Rob:

https://stackoverflow.com/questions/31039513/how-can-i-skip-code-signing-for-development-builds-in-xcode#54296008
@CITguy
Copy link

CITguy commented Feb 19, 2020

Is this the reason why I get the following error?

CleanShot 2020-02-19 at 10 55 29@2x

I ask because my system is managed by my company with the following settings (cannot change):

CleanShot 2020-02-19 at 11 00 59@2x

System Preferences > Security & Privacy > General

@FranklinYu
Copy link
Member

FranklinYu commented Feb 19, 2020

@CITguy No, it's unrelated. Please checkout FAQ.

I think I'll update the page with updated information for Mojave, since the current solution is to right-click the app to open.

@FranklinYu
Copy link
Member

0.8.0d71 is released and should be good. Waiting for Homebrew to try it out before I backport the fix to stable branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants