morgan pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits: 429a5220 by Nicolas Vigier at 2024-10-31T17:35:09+01:00 Bug 41243: Use separate entitlements for signing tor

Use a separate entitlements file for signing the tor binary, with `com.apple.security.cs.allow-unsigned-executable-memory` enabled.

- - - - -

2 changed files:

- + tools/signing/macos-entitlements/tor.xml - tools/signing/wrappers/sign-rcodesign-128

Changes:

===================================== tools/signing/macos-entitlements/tor.xml ===================================== @@ -0,0 +1,17 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> +<!-- + Entitlements to apply to the tor process executable. +--> +<plist version="1.0"> + <dict> + <!-- tor needs this when connecting to PoW onion-services. + See tor-browser#43250 and tor#40988 --> + <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/> + + <!-- Allow loading third party libraries to support pkcs11 modules --> + <key>com.apple.security.cs.disable-library-validation</key><true/> + + <key>com.apple.security.cs.allow-jit</key><true/> + </dict> +</plist>

===================================== tools/signing/wrappers/sign-rcodesign-128 ===================================== @@ -82,6 +82,7 @@ $rcodesign sign \ --code-signature-flags Contents/Frameworks/ChannelPrefs.framework:runtime \ --code-signature-flags Contents/MacOS/plugin-container.app:runtime \ --code-signature-flags Contents/MacOS/media-plugin-helper.app:runtime \ + --entitlements-xml-path Contents/MacOS/Tor/tor:/signing/tor-browser-build/tools/signing/macos-entitlements/tor.xml \ --entitlements-xml-path Contents/MacOS/plugin-container.app:/signing/tor-browser-build/tools/signing/macos-entitlements/plugin-container.xml \ --entitlements-xml-path Contents/MacOS/media-plugin-helper.app:/signing/tor-browser-build/tools/signing/macos-entitlements/media-plugin-helper.xml \ --entitlements-xml-path /signing/tor-browser-build/tools/signing/macos-entitlements/firefox.browser.xml \

View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/42...