Skip to content

Update ad-hoc signing in HostModel for changed codesign behaviour (code directory page size) in macOS 26+#131283

Open
elinor-fung wants to merge 3 commits into
dotnet:mainfrom
elinor-fung:hostmodel-codedirectory-pagesize
Open

Update ad-hoc signing in HostModel for changed codesign behaviour (code directory page size) in macOS 26+#131283
elinor-fung wants to merge 3 commits into
dotnet:mainfrom
elinor-fung:hostmodel-codedirectory-pagesize

Conversation

@elinor-fung

@elinor-fung elinor-fung commented Jul 23, 2026

Copy link
Copy Markdown
Member

macOS 26 changed codesign to hash arm64/arm64_32 Mach-O objects with a 16 KiB code directory page size instead of 4 KiB, so HostModel's managed ad-hoc signer no longer matched codesign on arm64. This change uses the Mach-O CPU type to determine the code directory page size, matching codesign on macOS 26+. The larger page size should still work on older arm64 macOS versions.

Also validated by manually kicking off a run for the host tests on the osx.15.arm64 queue.

Fixes #121825 

elinor-fung and others added 2 commits July 23, 2026 10:34
macOS 26 changed codesign to hash arm64/arm64_32 Mach-O objects using 16 KiB
code directory pages instead of 4 KiB. HostModel's ad-hoc signer hardcoded a
4 KiB page size, so its arm64 signatures no longer matched codesign's output.
This is why the MatchesCodesignOutput test was disabled.

Select the code directory page size from the Mach-O CPU type (16 KiB for
arm64/arm64_32, 4 KiB otherwise) and thread it into the CodeDirectory's
Log2PageSize and code-slot hashing. HostModel always uses the macOS 26 value so
signing stays deterministic and independent of the build machine's OS; a 16 KiB
code directory page is valid on all arm64 macOS versions.

Re-enable MatchesCodesignOutput. codesign's own default arm64 page size still
depends on the macOS version, so the test skips the arm64 comparison on macOS
older than 26 (where codesign defaults to 4 KiB) and otherwise compares against
codesign's default output.

Related to dotnet#121825

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 82bef6d1-1499-4926-b4bf-9949f4765c7e
AllocateCodeSignatureLoadCommand sized the code signature via
EmbeddedSignatureBlob.GetSignatureSize, which counted code slots using the
default 4 KiB page size. Now that arm64 objects are signed with 16 KiB pages,
that produced a declared LC_CODE_SIGNATURE/__LINKEDIT size larger than the
actual signature, leaving ~960 bytes of trailing zero padding in every signed
arm64 binary (the signature still verified and ran, but was not compact and
diverged from codesign).

Thread the object's code directory page size through GetSignatureSize so the
declared size matches the signature that CreateSignature actually writes.
Extract the arch-based page size selection into a CodeDirectoryPageSize property
shared by CreateSignature and AllocateCodeSignatureLoadCommand.

Make the page size an explicit, required argument everywhere it is used so a
caller cannot silently fall back to 4 KiB (the default that caused the
mismatch): remove the default from CodeDirectoryBlob.GetCodeSlotCount, and make
CodeDirectoryBlob.Create take a required pageSize (moved before the optional
hashType). GetLargestSizeEstimate passes the 4 KiB page size explicitly, since
the smallest page size yields the maximum slot count for a safe upper bound when
reserving buffer capacity.

Related to dotnet#121825

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 82bef6d1-1499-4926-b4bf-9949f4765c7e
Copilot AI review requested due to automatic review settings July 23, 2026 18:57
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the HostModel managed Mach-O ad-hoc signer to match newer codesign behavior by selecting the CodeDirectory hashing “page size” based on the Mach-O CPU type (16 KiB for arm64/arm64_32, 4 KiB otherwise). It also re-enables the previously skipped MatchesCodesignOutput test, with a conditional runtime skip for pre-macOS 26 arm64 scenarios where codesign defaults differ.

Changes:

  • Add CPU-type-based CodeDirectory page size selection to HostModel signing and propagate it through CodeDirectory/signature sizing.
  • Update CodeDirectory header writing to emit the correct log2(pageSize) value (4 KiB vs 16 KiB).
  • Re-enable MatchesCodesignOutput and add a targeted skip for pre-macOS 26 arm64 comparisons.
Show a summary per file
File Description
src/installer/tests/Microsoft.NET.HostModel.Tests/MachObjectSigning/SigningTests.cs Re-enables MatchesCodesignOutput, adds pre-macOS 26 arm64 skip logic, and introduces an arm64 file detector helper.
src/installer/managed/Microsoft.NET.HostModel/MachO/MachObjectFile.cs Determines CodeDirectory page size from Mach-O CPU type and uses it when building/sizing signatures.
src/installer/managed/Microsoft.NET.HostModel/MachO/Enums/MachCpuType.cs Adds minimal CPU type enum values needed to detect arm64/arm64_32.
src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/Blobs/EmbeddedSignatureBlob.cs Threads page size into signature sizing and uses 4 KiB for worst-case size estimation.
src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/Blobs/CodeDirectoryBlob.cs Accepts explicit page size, encodes correct Log2PageSize, and uses page size for code slot hashing/count.

Copilot's findings

  • Files reviewed: 5/5 changed files
  • Comments generated: 1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 23, 2026 20:02

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot's findings

  • Files reviewed: 5/5 changed files
  • Comments generated: 0 new

@elinor-fung
elinor-fung requested a review from jtschuster July 23, 2026 22:08

@jtschuster jtschuster left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

Update ad-hoc signing in HostModel for changed codesign behaviour in macOS 26

3 participants