| """Exercise package signing and native verification with generated credentials.""" |
|
|
| import itertools |
| import json |
| import os |
| import shutil |
| import ssl |
| import subprocess |
| import sys |
| import tempfile |
| import unittest |
| import zipfile |
| from pathlib import Path |
|
|
| import provisioned_macos_cli_package as bundle |
| from test_provisioned_macos_cli_package import ProvisioningTestCase |
|
|
| NATIVE_TOOL = """#!/usr/bin/env python3 |
| import json, os, plistlib, sys |
| from pathlib import Path |
| name = Path(sys.argv[0]).name |
| args = sys.argv[1:] |
| with open(os.environ["CALL_LOG"], "a") as log: |
| log.write(json.dumps([name, *args]) + "\\n") |
| if name == "codesign": |
| for arg in args: |
| if arg.startswith("--extract-certificates="): |
| Path(arg.split("=", 1)[1] + "0").write_bytes(Path(os.environ["MOCK_CERTIFICATE"]).read_bytes()) |
| if "--test-requirement" in args and os.environ.get("MOCK_WRONG_SIGNING_IDENTITY"): |
| print("code failed to satisfy specified code requirement(s)", file=sys.stderr) |
| sys.exit(1) |
| if "--entitlements" in args: |
| target = Path(args[-1]).name |
| if target == "CodexCLI.app": |
| source = Path(os.environ["CODEX_REPO_ROOT"]) / "signing-verification/codex-provisioned-entitlements.plist" |
| elif target in ("codex", "codex-code-mode-host"): |
| source = Path(os.environ["MOCK_SIGNING_SCRIPTS"]) / (target + ".entitlements.plist") |
| else: |
| sys.exit(0) |
| if os.environ.get("MOCK_WRONG_ENTITLEMENTS"): |
| sys.stdout.buffer.write(plistlib.dumps({"unexpected": True})) |
| else: |
| sys.stdout.buffer.write(source.read_bytes()) |
| elif name == "plutil": |
| source = Path(args[-1]) |
| target = Path(args[args.index("-o") + 1]) if "-o" in args else source |
| target.write_bytes(plistlib.dumps(plistlib.loads(source.read_bytes()))) |
| """ |
|
|
|
|
| class MacosSigningTests(ProvisioningTestCase): |
| def fixture(self, root, provisioned, target="aarch64-apple-darwin"): |
| source = Path(bundle.__file__).parent |
| common = Path(os.path.commonpath((source, bundle.SIGNING))) |
| helpers = root / source.relative_to(common) |
| scripts = root / bundle.SIGNING.relative_to(common) |
| helpers.mkdir(parents=True, exist_ok=True) |
| scripts.mkdir(parents=True, exist_ok=True) |
| for name in ("provisioned_macos_cli_package.py", "sign_macos_cli_package.py"): |
| shutil.copyfile(source / name, helpers / name) |
| for path in bundle.SIGNING.glob("*.entitlements.plist"): |
| shutil.copyfile(path, scripts / path.name) |
| (root / "record.py").write_text( |
| "import json, os, sys\n" |
| "with open(os.environ['CALL_LOG'], 'a') as log:\n" |
| " log.write(json.dumps(sys.argv[1:]) + '\\n')\n" |
| "if os.environ.get('FAIL_TOOL') == sys.argv[1]:\n" |
| " print('fixture stdout', flush=True)\n" |
| " print('fixture stderr', file=sys.stderr, flush=True)\n" |
| " sys.exit(17)\n" |
| ) |
| for name in ("sign_macos_code.sh", "notarize_macos_binary_with_akv.sh"): |
| (scripts / name).write_text( |
| 'python3 "$CODEX_REPO_ROOT/record.py" "$(basename "$0")" "$@"\n' |
| ) |
| (scripts / "notarize_with_akv.py").write_text( |
| "import os, runpy, sys\n" |
| "sys.argv.insert(1, 'notarize_with_akv.py')\n" |
| "runpy.run_path(os.environ['CODEX_REPO_ROOT'] + '/record.py')\n" |
| ) |
| for name in ("rcodesign", "codesign", "lipo", "plutil"): |
| path = root / name |
| path.write_text(NATIVE_TOOL) |
| path.chmod(0o755) |
| certificate_der = self.profile["DeveloperCertificates"][0] |
| certificate = root / "certificate.pem" |
| certificate.write_text(ssl.DER_cert_to_PEM_cert(certificate_der)) |
| (root / "certificate.der").write_bytes(certificate_der) |
| package = root / "package with spaces" |
| for relative in ("bin/codex", *bundle.HELPERS): |
| path = package / relative |
| path.parent.mkdir(parents=True, exist_ok=True) |
| path.write_text("#!/bin/sh\nexit 0\n") |
| path.chmod(0o755) |
| (package / "codex-package.json").write_text( |
| json.dumps( |
| { |
| "variant": "codex", |
| "layoutVersion": 1, |
| "target": target, |
| "entrypoint": "bin/codex", |
| } |
| ) |
| ) |
| env = { |
| key: value |
| for key, value in os.environ.items() |
| if key not in ("GITHUB_WORKSPACE", "CODEX_PROVISIONING_HELPER") |
| } |
| env.update( |
| CODEX_REPO_ROOT=str(root), |
| RUNNER_TEMP=str(root), |
| TARGET=target, |
| PATH=f"{root}{os.pathsep}{os.environ['PATH']}", |
| CALL_LOG=str(root / "calls.jsonl"), |
| PROVISIONED_MACOS=str(provisioned).lower(), |
| OAI_AKV_SIGNING_CERTIFICATE_PEM=str(certificate), |
| MOCK_CERTIFICATE=str(root / "certificate.der"), |
| MOCK_SIGNING_SCRIPTS=str(scripts), |
| ) |
| return package, helpers / "sign_macos_cli_package.py", env |
|
|
| def run_driver(self, driver, operation, package, env): |
| return subprocess.run( |
| [ |
| sys.executable, |
| str(driver), |
| operation, |
| str(package), |
| "--profile", |
| str(self.configuration.profile), |
| "--profile-sha256", |
| self.configuration.profile_sha256, |
| "--certificate-sha256", |
| self.configuration.certificate_sha256, |
| "--team-id", |
| self.configuration.team_id, |
| ], |
| env=env, |
| capture_output=True, |
| text=True, |
| timeout=30, |
| check=False, |
| ) |
|
|
| def test_standard_and_provisioned_signing_and_verification(self): |
| for provisioned, target in itertools.product( |
| (False, True), ("aarch64-apple-darwin", "x86_64-apple-darwin") |
| ): |
| with ( |
| self.subTest(provisioned=provisioned, target=target), |
| tempfile.TemporaryDirectory() as directory, |
| ): |
| root = Path(directory).resolve() |
| package, driver, env = self.fixture(root, provisioned, target) |
| result = self.run_driver(driver, "sign", package, env) |
| self.assertEqual(result.returncode, 0, result.stderr) |
| result = self.run_driver(driver, "verify", package, env) |
| self.assertEqual(result.returncode, 0, result.stderr) |
| calls = [ |
| json.loads(line) |
| for line in (root / "calls.jsonl").read_text().splitlines() |
| ] |
| signing = [call for call in calls if call[0] == "sign_macos_code.sh"] |
| self.assertEqual( |
| [call[call.index("--target") + 1] for call in signing], |
| [ |
| str(package / relative) |
| for relative in ( |
| bundle.APP if provisioned else "bin/codex", |
| *bundle.HELPERS, |
| ) |
| ], |
| ) |
| self.assertEqual( |
| signing[0][signing[0].index("--entitlements") + 1], |
| str( |
| root |
| / "signing-verification/codex-provisioned-entitlements.plist" |
| ) |
| if provisioned |
| else str( |
| Path(env["MOCK_SIGNING_SCRIPTS"]) / "codex.entitlements.plist" |
| ), |
| ) |
| self.assertEqual( |
| ["--entitlements" in call for call in signing], |
| [True, True, False, False], |
| ) |
| self.assertEqual( |
| [call[0] for call in calls if call[0].startswith("notarize")], |
| ["notarize_with_akv.py"] |
| if provisioned |
| else ["notarize_macos_binary_with_akv.sh"] * 4, |
| ) |
| self.assertEqual( |
| [call[1:] for call in calls if call[0] == "lipo"], |
| [ |
| [ |
| str(package / relative), |
| "-verify_arch", |
| "arm64" if target.startswith("aarch64") else "x86_64", |
| ] |
| for relative in ( |
| bundle.EXECUTABLE if provisioned else "bin/codex", |
| *bundle.HELPERS, |
| ) |
| ], |
| ) |
| if provisioned: |
| with zipfile.ZipFile(root / "provisioned-cli.zip") as archive: |
| self.assertEqual( |
| archive.read( |
| "CodexCLI.app/Contents/embedded.provisionprofile" |
| ), |
| self.configuration.profile.read_bytes(), |
| ) |
| self.assertEqual( |
| archive.read("bin/codex").decode(), bundle.LAUNCHER |
| ) |
| self.assertTrue( |
| all( |
| helper in archive.namelist() |
| for helper in bundle.HELPERS |
| ) |
| ) |
|
|
| def test_signing_and_notarization_failures_stop_the_driver(self): |
| for tool in ("sign_macos_code.sh", "notarize_with_akv.py"): |
| with self.subTest(tool=tool), tempfile.TemporaryDirectory() as directory: |
| root = Path(directory).resolve() |
| package, driver, env = self.fixture(root, True) |
| result = self.run_driver( |
| driver, "sign", package, {**env, "FAIL_TOOL": tool} |
| ) |
| self.assertNotEqual(result.returncode, 0) |
| calls = [ |
| json.loads(line) |
| for line in (root / "calls.jsonl").read_text().splitlines() |
| ] |
| self.assertEqual(calls[-1][0], tool) |
| if tool == "notarize_with_akv.py": |
| self.assertEqual( |
| (root / "signing-verification/notarization.log").read_text(), |
| "fixture stdout\nfixture stderr\n", |
| ) |
| self.assertIn("fixture stdout\nfixture stderr\n", result.stdout) |
| else: |
| self.assertFalse((root / "provisioned-cli.zip").exists()) |
|
|
| def test_verification_rejects_wrong_signing_identity_and_entitlements(self): |
| for provisioned, failure in itertools.product( |
| (False, True), ("MOCK_WRONG_SIGNING_IDENTITY", "MOCK_WRONG_ENTITLEMENTS") |
| ): |
| with ( |
| self.subTest(provisioned=provisioned, failure=failure), |
| tempfile.TemporaryDirectory() as directory, |
| ): |
| root = Path(directory).resolve() |
| package, driver, env = self.fixture(root, provisioned) |
| signed = self.run_driver(driver, "sign", package, env) |
| self.assertEqual(signed.returncode, 0, signed.stderr) |
| result = self.run_driver( |
| driver, "verify", package, {**env, failure: "true"} |
| ) |
| self.assertNotEqual(result.returncode, 0) |
| if failure == "MOCK_WRONG_SIGNING_IDENTITY": |
| self.assertIn( |
| "code failed to satisfy specified code requirement(s)", |
| result.stderr, |
| ) |
| else: |
| self.assertIn("unexpected", result.stdout) |
|
|
| def test_cli_requires_independent_profile_configuration(self): |
| with tempfile.TemporaryDirectory() as directory: |
| result = subprocess.run( |
| [ |
| sys.executable, |
| str(Path(bundle.__file__).with_name("sign_macos_cli_package.py")), |
| "verify", |
| directory, |
| ], |
| capture_output=True, |
| text=True, |
| check=False, |
| ) |
| self.assertEqual(result.returncode, 2) |
| self.assertIn("the following arguments are required", result.stderr) |
|
|
|
|
| if __name__ == "__main__": |
| unittest.main() |
|
|
