{"id":33842,"date":"2021-10-06T17:01:29","date_gmt":"2021-10-06T21:01:29","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=33842"},"modified":"2021-10-06T17:01:29","modified_gmt":"2021-10-06T21:01:29","slug":"reproducible-code-signing-on-apple-silicon","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2021\/10\/06\/reproducible-code-signing-on-apple-silicon\/","title":{"rendered":"Reproducible Code Signing on Apple Silicon"},"content":{"rendered":"

Keith Smiley<\/a>:<\/p>\n

\n

For people who expect reproducible builds<\/a>, Apple Silicon machines\nprovide an interesting challenge.<\/p>\n

[…]<\/p>\n

The gist of this logic is to fetch the UUID embedded in every binary and use that to derive the identifier. The reason this isn’t reproducible across architectures is because the UUID is based on the content of each binary, which differs across architectures.<\/p>

[…]<\/p>

While this was a very informative deep dive into this logic, if you rely\non reproducible binaries and want to support Apple Silicon machines, you\nneed to do 2 things for binaries without Info.plist<\/tt> files:<\/p>

  1. Don’t allow the linker to automatically sign your binaries by passing\n-no_adhoc_codesign<\/code><\/li>
  2. Pass an explicit identifier when linking binaries with --identifier<\/code>\nto the codesign<\/code> invocation<\/li><\/ol><\/blockquote>\n\n

    Previously:<\/p>\n