How to sign a binary with disable-library-validation entitlement?

Question

Marmaladesoul OP

Created Aug ’23

Replies 2

Boosts 0

Participants 3

I'm trying to sign some PHP binaries so that they are happy to run PHP extensions compiled by other people.

I've tried creating a signing-entitlements.plist such as:

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>com.apple.security.cs.disable-library-validation</key>
        <true/>
    </dict>
</plist>

but when trying to run the following:

codesign --entitlements signing-entitlements.plist --force --options runtime --sign '$release_certificate' '$file'

...I get the following error: signing-entitlements.plist: cannot read entitlement data

Do I need to convert the XML to some other format perhaps?

Is it even the right entitlement to achieve what I am trying to do?

Thanks for any help!

Boost

Answer 1

DTS Engineer OP

Apple

Aug ’23

I can’t see anything obviously wrong with your entitlements. The most common cause of problems like this is some hard-to-see malformation, like CR LF line endings or a leading BOM. To fix those, run your property list through plutil:

% plutil -convert xml1 -o reformatted.entitlements original.entitlements

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

1

Answer 2

Haggis OP

Sep ’23

Wow, thanks @eskimo — you were right... as always 😆

plutil reformatted my entitlements to the following, which then worked perfectly:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.cs.disable-library-validation</key>
	<true/>
</dict>
</plist>

The changes were:

<!DOCTYPE moved to its own line
https became http
<dict> entry outdented one tab
a final line ending was added (they were already in "Unix" format according to Sublime Text)

Somewhat annoyingly, I can use codesign -d --entitlements - --xml /path/to/binary to print the binary's entitlement as XML, but it's not in the pedantic format which codesign itself can read.

0