Update ad-hoc signing in HostModel for changed codesign behaviour (code directory page size) in macOS 26+#131283
Open
elinor-fung wants to merge 3 commits into
Open
Conversation
macOS 26 changed codesign to hash arm64/arm64_32 Mach-O objects using 16 KiB code directory pages instead of 4 KiB. HostModel's ad-hoc signer hardcoded a 4 KiB page size, so its arm64 signatures no longer matched codesign's output. This is why the MatchesCodesignOutput test was disabled. Select the code directory page size from the Mach-O CPU type (16 KiB for arm64/arm64_32, 4 KiB otherwise) and thread it into the CodeDirectory's Log2PageSize and code-slot hashing. HostModel always uses the macOS 26 value so signing stays deterministic and independent of the build machine's OS; a 16 KiB code directory page is valid on all arm64 macOS versions. Re-enable MatchesCodesignOutput. codesign's own default arm64 page size still depends on the macOS version, so the test skips the arm64 comparison on macOS older than 26 (where codesign defaults to 4 KiB) and otherwise compares against codesign's default output. Related to dotnet#121825 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 82bef6d1-1499-4926-b4bf-9949f4765c7e
AllocateCodeSignatureLoadCommand sized the code signature via EmbeddedSignatureBlob.GetSignatureSize, which counted code slots using the default 4 KiB page size. Now that arm64 objects are signed with 16 KiB pages, that produced a declared LC_CODE_SIGNATURE/__LINKEDIT size larger than the actual signature, leaving ~960 bytes of trailing zero padding in every signed arm64 binary (the signature still verified and ran, but was not compact and diverged from codesign). Thread the object's code directory page size through GetSignatureSize so the declared size matches the signature that CreateSignature actually writes. Extract the arch-based page size selection into a CodeDirectoryPageSize property shared by CreateSignature and AllocateCodeSignatureLoadCommand. Make the page size an explicit, required argument everywhere it is used so a caller cannot silently fall back to 4 KiB (the default that caused the mismatch): remove the default from CodeDirectoryBlob.GetCodeSlotCount, and make CodeDirectoryBlob.Create take a required pageSize (moved before the optional hashType). GetLargestSizeEstimate passes the 4 KiB page size explicitly, since the smallest page size yields the maximum slot count for a safe upper bound when reserving buffer capacity. Related to dotnet#121825 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 82bef6d1-1499-4926-b4bf-9949f4765c7e
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the HostModel managed Mach-O ad-hoc signer to match newer codesign behavior by selecting the CodeDirectory hashing “page size” based on the Mach-O CPU type (16 KiB for arm64/arm64_32, 4 KiB otherwise). It also re-enables the previously skipped MatchesCodesignOutput test, with a conditional runtime skip for pre-macOS 26 arm64 scenarios where codesign defaults differ.
Changes:
- Add CPU-type-based CodeDirectory page size selection to HostModel signing and propagate it through CodeDirectory/signature sizing.
- Update CodeDirectory header writing to emit the correct
log2(pageSize)value (4 KiB vs 16 KiB). - Re-enable
MatchesCodesignOutputand add a targeted skip for pre-macOS 26 arm64 comparisons.
Show a summary per file
| File | Description |
|---|---|
| src/installer/tests/Microsoft.NET.HostModel.Tests/MachObjectSigning/SigningTests.cs | Re-enables MatchesCodesignOutput, adds pre-macOS 26 arm64 skip logic, and introduces an arm64 file detector helper. |
| src/installer/managed/Microsoft.NET.HostModel/MachO/MachObjectFile.cs | Determines CodeDirectory page size from Mach-O CPU type and uses it when building/sizing signatures. |
| src/installer/managed/Microsoft.NET.HostModel/MachO/Enums/MachCpuType.cs | Adds minimal CPU type enum values needed to detect arm64/arm64_32. |
| src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/Blobs/EmbeddedSignatureBlob.cs | Threads page size into signature sizing and uses 4 KiB for worst-case size estimation. |
| src/installer/managed/Microsoft.NET.HostModel/MachO/BinaryFormat/Blobs/CodeDirectoryBlob.cs | Accepts explicit page size, encodes correct Log2PageSize, and uses page size for code slot hashing/count. |
Copilot's findings
- Files reviewed: 5/5 changed files
- Comments generated: 1
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
macOS 26 changed
codesignto hash arm64/arm64_32 Mach-O objects with a 16 KiB code directory page size instead of 4 KiB, so HostModel's managed ad-hoc signer no longer matchedcodesignon arm64. This change uses the Mach-O CPU type to determine the code directory page size, matchingcodesignon macOS 26+. The larger page size should still work on older arm64 macOS versions.Also validated by manually kicking off a run for the host tests on the osx.15.arm64 queue.
Fixes #121825