diff options
author | Andrew <andybons@golang.org> | 2019-11-20 12:06:51 -0500 |
---|---|---|
committer | Andrew Bonventre <andybons@golang.org> | 2019-11-21 14:55:12 +0000 |
commit | 8bbfc51d9ac9ce9472e126cc3654c9a45eceb236 (patch) | |
tree | ac228f2b66d9d7d6064e4f9f4c0f31f8820aacb2 /src/archive | |
parent | 39a9cb4b5dbf1e518b0c66fa3a7b4175f90226fc (diff) | |
download | go-8bbfc51d9ac9ce9472e126cc3654c9a45eceb236.tar.gz go-8bbfc51d9ac9ce9472e126cc3654c9a45eceb236.zip |
all: base64-encode binaries that will cause Apple notarization to fail
Starting with macOS 10.15 (Catalina), Apple now requires all software
distributed outside of the App Store to be notarized. Any binaries we
distribute must abide by a strict set of requirements like code-signing
and having a minimum target SDK of 10.9 (amongst others).
Apple’s notarization service will recursively inspect archives looking to
find notarization candidate binaries. If it finds a binary that does not
meet the requirements or is unable to decompress an archive, it will
reject the entire distribution. From cursory testing, it seems that the
service uses content sniffing to determine file types, so changing
the file extension will not work.
There are some binaries and archives included in our distribution that
are being detected by Apple’s service as potential candidates for
notarization or decompression. As these are files used by tests and some
are intentionally invalid, we don’t intend to ever make them compliant.
As a workaround for this, we base64-encode any binaries or archives that
Apple’s notarization service issues a warning for, as these warnings will
become errors in January 2020.
Updates #34986
Change-Id: I106fbb6227b61eb221755568f047ee11103c1680
Reviewed-on: https://go-review.googlesource.com/c/go/+/208118
Run-TryBot: Andrew Bonventre <andybons@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Diffstat (limited to 'src/archive')
-rw-r--r-- | src/archive/zip/reader_test.go | 34 | ||||
-rw-r--r-- | src/archive/zip/testdata/go-no-datadesc-sig.zip | bin | 330 -> 0 bytes | |||
-rw-r--r-- | src/archive/zip/testdata/go-no-datadesc-sig.zip.base64 | 1 |
3 files changed, 26 insertions, 9 deletions
diff --git a/src/archive/zip/reader_test.go b/src/archive/zip/reader_test.go index 328559cc7d..adca87a8b3 100644 --- a/src/archive/zip/reader_test.go +++ b/src/archive/zip/reader_test.go @@ -8,6 +8,7 @@ import ( "bytes" "encoding/binary" "encoding/hex" + "internal/obscuretestdata" "io" "io/ioutil" "os" @@ -19,11 +20,12 @@ import ( ) type ZipTest struct { - Name string - Source func() (r io.ReaderAt, size int64) // if non-nil, used instead of testdata/<Name> file - Comment string - File []ZipTestFile - Error error // the error that Opening this file should return + Name string + Source func() (r io.ReaderAt, size int64) // if non-nil, used instead of testdata/<Name> file + Comment string + File []ZipTestFile + Obscured bool // needed for Apple notarization (golang.org/issue/34986) + Error error // the error that Opening this file should return } type ZipTestFile struct { @@ -189,8 +191,12 @@ var tests = []ZipTest{ }, { // created by Go, before we wrote the "optional" data - // descriptor signatures (which are required by OS X) - Name: "go-no-datadesc-sig.zip", + // descriptor signatures (which are required by macOS). + // Use obscured file to avoid Apple’s notarization service + // rejecting the toolchain due to an inability to unzip this archive. + // See golang.org/issue/34986 + Name: "go-no-datadesc-sig.zip.base64", + Obscured: true, File: []ZipTestFile{ { Name: "foo.txt", @@ -208,7 +214,7 @@ var tests = []ZipTest{ }, { // created by Go, after we wrote the "optional" data - // descriptor signatures (which are required by OS X) + // descriptor signatures (which are required by macOS) Name: "go-with-datadesc-sig.zip", File: []ZipTestFile{ { @@ -496,8 +502,18 @@ func readTestZip(t *testing.T, zt ZipTest) { rat, size := zt.Source() z, err = NewReader(rat, size) } else { + path := filepath.Join("testdata", zt.Name) + if zt.Obscured { + tf, err := obscuretestdata.DecodeToTempFile(path) + if err != nil { + t.Errorf("obscuretestdata.DecodeToTempFile(%s): %v", path, err) + return + } + defer os.Remove(tf) + path = tf + } var rc *ReadCloser - rc, err = OpenReader(filepath.Join("testdata", zt.Name)) + rc, err = OpenReader(path) if err == nil { defer rc.Close() z = &rc.Reader diff --git a/src/archive/zip/testdata/go-no-datadesc-sig.zip b/src/archive/zip/testdata/go-no-datadesc-sig.zip Binary files differdeleted file mode 100644 index c3d593f44f..0000000000 --- a/src/archive/zip/testdata/go-no-datadesc-sig.zip +++ /dev/null diff --git a/src/archive/zip/testdata/go-no-datadesc-sig.zip.base64 b/src/archive/zip/testdata/go-no-datadesc-sig.zip.base64 new file mode 100644 index 0000000000..1c2c071fbe --- /dev/null +++ b/src/archive/zip/testdata/go-no-datadesc-sig.zip.base64 @@ -0,0 +1 @@ +UEsDBBQACAAAAGWHaECoZTJ+BAAAAAQAAAAHABgAZm9vLnR4dFVUBQAD3lVZT3V4CwABBPUBAAAEFAAAAGZvbwqoZTJ+BAAAAAQAAABQSwMEFAAIAAAAZodoQOmzogQEAAAABAAAAAcAGABiYXIudHh0VVQFAAPgVVlPdXgLAAEE9QEAAAQUAAAAYmFyCumzogQEAAAABAAAAFBLAQIUAxQACAAAAGWHaECoZTJ+BAAAAAQAAAAHABgAAAAAAAAAAACkgQAAAABmb28udHh0VVQFAAPeVVlPdXgLAAEE9QEAAAQUAAAAUEsBAhQDFAAIAAAAZodoQOmzogQEAAAABAAAAAcAGAAAAAAAAAAAAKSBTQAAAGJhci50eHRVVAUAA+BVWU91eAsAAQT1AQAABBQAAABQSwUGAAAAAAIAAgCaAAAAmgAAAAAA |