CreateDump doesn't get signed

[filipnavara]

#12210 added the createdump tool into the application bundles. However, it doesn't get signed through the regular Xamarin signing process (EnableCodeSigning=true) and the apps fail notarization when packaged.

[filipnavara]

    {
      "severity": "error",
      "code": null,
      "path": "eM_Client.pkg/eM-Client-Component.pkg Contents/Payload/Applications/eM Client.app/Contents/MonoBundle/createdump",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "eM_Client.pkg/eM-Client-Component.pkg Contents/Payload/Applications/eM Client.app/Contents/MonoBundle/createdump",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": null,
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "eM_Client.pkg/eM-Client-Component.pkg Contents/Payload/Applications/eM Client.app/Contents/MonoBundle/createdump",
      "message": "The executable does not have the hardened runtime enabled.",
      "docUrl": null,
      "architecture": "x86_64"
    },

[rolfbjarne]

I wonder if we need to have a list of additional files that will be code signed (and make it possible for users to add to the list if they want to).

[filipnavara]

Our current workaround:

  <!-- Workaround for https://github.com/xamarin/xamarin-macios/issues/13417 -->
  <PropertyGroup>
    <CodesignDependsOn>CodeSignCreateDump;$(CodesignDependsOn)</CodesignDependsOn>
  </PropertyGroup>
  <Target Name="CodeSignCreateDump" Condition="'$(_CodeSigningKey)' != ''">
    <Codesign
      Condition="'$(IsMacEnabled)' == 'true'"
      SessionId="$(BuildSessionId)"
      ToolExe="$(CodesignExe)"
      ToolPath="$(CodesignPath)"
      CodesignAllocate="$(_CodesignAllocate)"
      DisableTimestamp="$(_CodesignDisableTimestamp)"
      Keychain="$(CodesignKeychain)"
      Resources="$(AppBundleDir)\Contents\MonoBundle\createdump"
      SigningKey="$(_CodeSigningKey)"
      ExtraArgs="$(CodesignExtraArgs)"
      UseHardenedRuntime="$(UseHardenedRuntime)"
      UseSecureTimestamp="$(UseHardenedRuntime)" />
  </Target>

We may need to sign some other parts of the bundle too but there are multiple different ways to accomplish that. We place some Helper applications and PlugIns into the bundle and they're usually already signed externally. Alternatively --deep signing would also work for those since they are captured by the default macOS bundle resource seal rules.

Having an option to have custom list of files to sign would likely be beneficial for our scenarios though. Right now we don't strictly need it but we may want to patch Info.plist files of the embedded PlugIns/Helpers and they would need to be resigned after that.

[filipnavara]

Actually, looks like signing createdump is enough for the notarization but not really enough to run the application:

Termination Reason:    Namespace DYLD, Code 1 Library missing
Library not loaded: @rpath/libSystem.Globalization.Native.dylib
Referenced from: /Users/USER/*/eM Client.app/Contents/MacOS/eM Client
Reason: tried: '/Users/filipnavara/Projects/emclient/MailClient/bin/Release/net6.0-macos/osx-x64/eM Client.app/Contents/MacOS/../MonoBundle/libSystem.Globalization.Native.dylib' (code signature in <9C5DCEA4-D8EA-3DD9-8504-0C0319B17F5E> '/Users/filipnavara/Projects/emclient/MailClient/bin/Release/net6.0-macos/osx-x64/eM Client.app/Contents/MonoBundle/libSystem.Globalization.Native.dylib' not valid for use in process: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)), '/Users/filipnavara/Projects/emclient/MailClient/bin/Release/net6.0-macos/osx-x64/eM Client.app/Contents/MacOS/../MonoBundle/libSystem.Globalization.Native.dylib' (code signature in <9C5DCEA4-D8EA-3DD9-8504-0C0319B17F5E> '/Users/filipnavara/Projects/emclient/MailClient/bin/Release/net6.0-macos/osx-x
(terminated at launch; ignore backtrace)

Signing all the lib*.dylib files in MonoBundle allowed me to run the application.