1522409 - Codesign and enable Hardened Runtime on local builds

Status: RESOLVED DUPLICATE of bug 1876902

(Release Engineering :: Release Automation, enhancement)

Description

[Haik Aftandilian [:haik]]

We plan to enable Hardened Runtime on official Mac builds (bug 1470597) which will turn on some new runtime security protections. Enabling Hardened Runtime requires signing the build with new options and entitlements. In order to make try builds and local developer builds have the same security protections as our official builds, we need to run codesign on those builds and enable Hardened Runtime. Running codesign requires a signing identity and we may be able to create a self-signed cert for this purpose automatically during the build. This bug is filed to cover the work needed to determine how to automate signing builds during local and try builds.

Comment 1

[Haik Aftandilian [:haik]]

Hardened Runtime is a 10.14 feature (as in the security protections only work on 10.14+) so until we have 10.14+ running on our try hardware, there isn't much motivation to support this on our Linux build machines. It would be beneficial for developers working on 10.14+ machines though. Perhaps the two should be split into different bugs.

Comment 2

[Aki Sasaki (not active)]

Try should be covered by the work in bug 1471004, but not local builds.

Comment 3

[Haik Aftandilian [:haik]]

(In reply to Haik Aftandilian [:haik] from comment #0)

... This bug is filed to cover the work needed to determine how to automate signing builds during local and try builds.

The work to sign try builds and production builds has long been completed and with bug 1876902, developers can sign local packaged builds using ./mach macos-sign -a </path/to/Nightly.app> as documented here. Closing as a dupe of 1876902.