1690118 - macOS Nightly builds crash due to signing entitlement error

Status: RESOLVED MOVED

(Thunderbird :: Build Config, defect)

Description

[Rob Lemley [:rjl]]

The Info.plist data is outdated and the OS says that the entitlements are not valid.
This seems to only cause issues when running on aarch64 hardware, my Intel mac runs the build without issues.

Looks like at a minimum need to port bug 1634765 bug 1656273 and bug 1675437.

Comment 1

[Rob Lemley [:rjl]]

I'm seeing the same error on both x86_64 and aarch64 machines on Big Sur. 10.15. Disabling the System Integrity Protection allows Thunderbird to run but the real fix is to get our enetitlements in order.

But first, need to make sure that the iscript fix from bug 1689232 comment 19 got applied to the Thunderbird signing macs as well. Aki, are those puppetized and getting updates with the Firefox macs now?

Comment 2

[Aki Sasaki (not active)]

(In reply to Rob Lemley [:rjl] from comment #1)

I'm seeing the same error on both x86_64 and aarch64 machines on Big Sur. 10.15. Disabling the System Integrity Protection allows Thunderbird to run but the real fix is to get our enetitlements in order.

But first, need to make sure that the iscript fix from bug 1689232 comment 19 got applied to the Thunderbird signing macs as well. Aki, are those puppetized and getting updates with the Firefox macs now?

Yeah, the tb signing macs are updated against the latest puppet, and should continue to do so.

Comment 3

[Rob Lemley [:rjl]]

I will backed out just the universal dmg repack commit from bug 1678775 so that tomorrow's build will be just Intel again and in theory will have a valid signature.

Comment 6

[Attila Zsiros]

Today build is not good :(

Comment 7

[Attila Zsiros]

Attachment: daily_20210203_1507.rtf

Today build is not good :(

Comment 8

[Rob Lemley [:rjl]]

Thanks. I suspected the problem would still be there. I did not see anything obvious in the log files; maybe Aki will be able to help later on today.

Comment 9

[Rob Lemley [:rjl]]

This error showed up on the early builds of 78.7.1 this morning, suggesting that the problem is with the signing mac.
Ben H just reran Puppet on the Thunderbird signing macs and I was able to run today's daily after re-running the signing. (So for whatever reason the Thunderbird signing macs were not updated with the Firefox ones.)

Here is a build that should work for anyone who wishes to verify:
https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/Lh_9_YiSTyKYUH7V4jW6Qg/runs/0/artifacts/public/build/target.tar.gz
(Intel only)

I will reland the Universal DMG backout mentioned in comment 3 now and then test that build as well so tomorrow's Daily will work.

Comment 10

[Rob Lemley [:rjl]]

The Universal DMG relanded on comm-central:
https://hg.mozilla.org/comm-central/rev/a10316300ce27538e95ee4e73e1bb4aff6cd6ec2

The resulting build produced a Universal application: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/TJAAQS7URKWCJ8p_OL-zKQ/runs/0/artifacts/public/build/target.tar.gz

The Thunderbird Daily.app from the tarball shows proper entitlements when queried and runs successfully on Silicon and Intel macs running Big Sur.

Comment 11

[Attila Zsiros]

(In reply to Rob Lemley [:rjl] from comment #10)

The Universal DMG relanded on comm-central:
https://hg.mozilla.org/comm-central/rev/a10316300ce27538e95ee4e73e1bb4aff6cd6ec2

The resulting build produced a Universal application: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/TJAAQS7URKWCJ8p_OL-zKQ/runs/0/artifacts/public/build/target.tar.gz

The Thunderbird Daily.app from the tarball shows proper entitlements when queried and runs successfully on Silicon and Intel macs running Big Sur.

working!

Comment 12

[Dave Miller [:justdave]]

Can confirm it runs on Intel/Catalina.

Comment 13

[Rob Lemley [:rjl]]

And I confirmed the Daily build on M1 Big Sur.

Comment 14

[Magnus Melin [:mkmelin]]

MOVED since fixed elsewhere.