New issue
Advanced search Search tips

Issue 789936 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner: ----
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Task



Sign in to add a comment

Remove custom codesigning resource rules

Reported by panda2...@gmail.com, Nov 30 2017

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5

Steps to reproduce the problem:
1. Download Google Chrome from official site
2. Drag and drop app to Application folder
3. run command codesign --verify -vv "/Applications/Google Chrome.app//Contents/MacOS/Google Chrome"
4. run command codesign -d -vv "/Applications/Google Chrome.app//Contents/MacOS/Google Chrome"

What is the expected behavior?
valid on disk
satisfies its Designated Requirement

What went wrong?
/Applications/Google Chrome.app//Contents/MacOS/Google Chrome: resource envelope is obsolete (custom omit rules) 

Authority=Developer ID Application: Google, Inc. (EQHXZ8M8AV)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Nov 10, 2017, 7:05:42 AM

Did this work before? N/A 

Chrome version: <62.0.3202.94  Channel: stable
OS Version: OS X 10.12.6
Flash Version: 

Other binary files have valid sign.
eg.:
/Applications/Google Chrome.app//Contents/Versions/62.0.3202.94/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper: valid on disk
/Applications/Google Chrome.app//Contents/Versions/62.0.3202.94/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper: satisfies its Designated Requirement
 
chrome.txt
1.2 KB View Download
helper.txt
2.7 KB View Download

Comment 1 by rsesek@chromium.org, Nov 30 2017

Cc: mark@chromium.org rsesek@chromium.org kerrnel@chromium.org
Components: Internals>Installer
Labels: -Type-Bug-Security -Pri-2 -Restrict-View-SecurityTeam Pri-3 Type-Task
Status: Available (was: Unconfirmed)
Summary: Remove custom codesigning resource rules (was: Binary file have obsolete certificate)
This isn't a security issue, nor is it an issue with the certificate. We use a custom omit rule in our codesigning configuration (https://cs.chromium.org/chromium/src/chrome/installer/mac/app_resource_rules.plist.in?sq=package:chromium&dr). Those are technically not supported anymore, but they still works. We should move off of it at some point, but it is not urgent, and changing it requires some significant changes to our bundle and update structure.
Mergedinto: 496298
Status: Duplicate (was: Available)

Sign in to add a comment