[tor-bugs] #13252 [Tor Browser]: Tor Browser on OS X should not store data into the application bundle

[Tor Bug Tracker & Wiki]

#13252: Tor Browser on OS X should not store data into the application bundle
-------------------------+--------------------------
 Reporter:  torosx       |          Owner:  tbb-team
     Type:  defect       |         Status:  new
 Priority:  Medium       |      Milestone:
Component:  Tor Browser  |        Version:
 Severity:  Normal       |     Resolution:
 Keywords:               |  Actual Points:
Parent ID:  #6540        |         Points:
  Sponsor:               |
-------------------------+--------------------------
Changes (by mikeperry):

 * cc: mcs, brade (added)
 * severity:   => Normal


Comment:

 OK, I attempted to sign our app dir via the command line using codesign as
 per:
 https://stackoverflow.com/questions/9245149/jenkins-on-os-x-xcodebuild-
 gives-code-sign-error and then
 https://lists.torproject.org/pipermail/tor-dev/2015-October/009780.html

 I had to add a --keychain to codesign to specify a non-default keychain,
 but otherwise it was pretty much that verbatim.

 Unfortunately, I did indeed hit issues. codesign bailed with this error:
 ./TBBDir/TorBrowser.app/: unsealed contents present in the bundle root

 Some searching revealed that this likely means there are non-executable
 resources mixed in with our resource directories. I think we may indeed
 have to reorganize the Mac bundle dir again for this.

 mcs+brade: This seems like something you might be able to help with, since
 you reorganized our Mac bundles before? I can get you a Mac "developer"
 certificate if you give me a CSR using those jenkins instructions, if you
 need that. (Though tbh, I don't get what the difference is between the
 developer certs and the app store certs.. if there is no difference from
 our users' point of view, maybe we should find another way to test this..
 Do we even need to involve Apple's official cert process at all to get
 past these errors?)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13252#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online