Re:Apple's 15% Deflection Tactic
by canarypilot on Thursday November 19, 2020 @02:13AM
(#25147005)
Do you know whether this applies to everything which executes? If my build scripts create a build script and run it I guess that will be ok, but if my build scripts build a specialised parser (say, from C source) I need to add a step after linking to code sign the generated parser binary before using it? Is that about right?
Signing is only required for native code. If your parser is a native binary, it needs at least an ad-hoc signature on it before it will run.
Re:Apple's 15% Deflection Tactic
by letitbeirie on Thursday November 19, 2020 @12:48PM
(#25152113)
> but you don't need one
Yet. Until this you didn't need a signature at all.
> codesign -f -s - [path to binary]
Unless something has changed on Apple Silicon, that's it, you're done, the binary has a signature. It does not have a trusted signature, but you don't need one. I think it was just simpler to write the OS assuming all executables would have a signature.