Re: [racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[Norman Gray]

Seamus, hello.

On 3 Jul 2017, at 23:17, Seamus Brady wrote:


I got a bit further than Norman :)


Well done!  I've added to the Stackoverflow question, a pointer to this 
discussion.


The trick from Matthew did the trick and that Racket based app gets 
signed and passes all the local GateKeeper checks :) Great stuff.


Great stuff indeed.

All the best,

Norman


--
Norman Gray  :  https://nxg.me.uk
SUPA School of Physics and Astronomy, University of Glasgow, UK

--
You received this message because you are subscribed to the Google Groups "Racket 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[David Storrs]

I'm in the process of building a commercial application for Racket, so this
is really good to know.  Thank you, Seamus -- this would have had me
tearing my hair out.

Dave

PS:  I read through this entire thread, understanding the information and
the references and finding it useful, while simultaneously wondering why
you were talking about codesigning code and who was designing it with you.
I literally just realized as I started to type this that you're saying
"code signing" not "co-designing".

On Mon, Jul 3, 2017 at 6:17 PM, Seamus Brady  wrote:

> On Monday, 3 July 2017 15:18:07 UTC+1, Matthew Flatt  wrote:
> > At Mon, 3 Jul 2017 08:15:38 -0600, Matthew Flatt wrote:
> > > to make progress for now, you can
> > > change
> > >
> > >  collects/compiler/private/mach-o.rkt
> > >
> > > and replace the call on line 164 to `detect-linkedit-padding` with the
> > > constant 12 --- since 12 seems to be the right number for the v6.9
> > > build, but `detect-linkedit-padding` thinks it's 8.
> >
> > Make that 4 instead of 12 if you're using `raco exe --gui`.
>
> Thank you Matthew and Norman for taking the time to reply. I got a bit
> further than Norman :)
>
> The trick from Matthew did the trick and that Racket based app gets signed
> and passes all the local GateKeeper checks :) Great stuff.  This means that
> I get create a commercial grade application using Racket - I am delighted.
> Thank you, thank you.
>
> As some extra feedback that may be useful to other readers, I also had to
> edit the app slightly to conform to Apples latest app guidelines:
>
> https://developer.apple.com/library/content/documentation/
> MacOSX/Conceptual/BPFrameworks/Concepts/FrameworkAnatomy.html
>
> I needed to add  Resources folder and an Info.plist with the correct
> CFBundleIdentifier set for the Racket Framework:
>
> 
> http://www.apple.com/DTDs/PropertyList-1.0.dtd;>
> 
> 
> CFBundleDevelopmentRegion
> English
> CFBundleExecutable
> Racket
> CFBundleIdentifier
> org.racket-lang.Racket
> CFBundleIconFile
> Starter
> CFBundleInfoDictionaryVersion
> 6.0
> CFBundlePackageType
> APPL
> CFBundleSignature
> MrSt
> CFBundleVersion
> 6.9
> CFBundleShortVersionString
> 6.9
> NSPrincipalClass
> NSApplicationMain
> NSHighResolutionCapable
> 
> NSSupportsAutomaticGraphicsSwitching
> 
> 
> 
>
> Then I updated the framework folders using the bash script below so that
> they conform to the new folder structure as outlined in the Apple docs:
>
> cd ..app/Contents/Frameworks/Racket.framework/Versions/
> ln -s ./6.9_3m Current
> cd ./.app/Contents/Frameworks/Racket.framework/
> ln -s ./Versions/Current/Racket Racket
> ln -s ./Versions/Current/Resources Resources
>
> Then I signed the app using the codesign utility as outlined below:
>
> https://successfulsoftware.net/2012/08/30/how-to-sign-
> your-mac-os-x-app-for-gatekeeper/
>
> I hope that helps. Again, many thanks. I am very grateful to get this
> working. I would have lost weeks ot work otherwise!
>
> Regards
>
> Seamus
>
> --
> You received this message because you are subscribed to the Google Groups
> "Racket Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to racket-users+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[Seamus Brady]

On Monday, 3 July 2017 15:18:07 UTC+1, Matthew Flatt  wrote:
> At Mon, 3 Jul 2017 08:15:38 -0600, Matthew Flatt wrote:
> > to make progress for now, you can
> > change
> > 
> >  collects/compiler/private/mach-o.rkt
> > 
> > and replace the call on line 164 to `detect-linkedit-padding` with the
> > constant 12 --- since 12 seems to be the right number for the v6.9
> > build, but `detect-linkedit-padding` thinks it's 8.
> 
> Make that 4 instead of 12 if you're using `raco exe --gui`.

Thank you Matthew and Norman for taking the time to reply. I got a bit further 
than Norman :)

The trick from Matthew did the trick and that Racket based app gets signed and 
passes all the local GateKeeper checks :) Great stuff.  This means that I get 
create a commercial grade application using Racket - I am delighted. Thank you, 
thank you.

As some extra feedback that may be useful to other readers, I also had to edit 
the app slightly to conform to Apples latest app guidelines:

https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPFrameworks/Concepts/FrameworkAnatomy.html

I needed to add  Resources folder and an Info.plist with the correct 
CFBundleIdentifier set for the Racket Framework:


http://www.apple.com/DTDs/PropertyList-1.0.dtd;>


CFBundleDevelopmentRegion
English
CFBundleExecutable
Racket
CFBundleIdentifier
org.racket-lang.Racket
CFBundleIconFile
Starter
CFBundleInfoDictionaryVersion
6.0
CFBundlePackageType
APPL
CFBundleSignature
MrSt
CFBundleVersion
6.9
CFBundleShortVersionString
6.9
NSPrincipalClass
NSApplicationMain
NSHighResolutionCapable

NSSupportsAutomaticGraphicsSwitching




Then I updated the framework folders using the bash script below so that they 
conform to the new folder structure as outlined in the Apple docs:

cd ..app/Contents/Frameworks/Racket.framework/Versions/
ln -s ./6.9_3m Current
cd ./.app/Contents/Frameworks/Racket.framework/
ln -s ./Versions/Current/Racket Racket
ln -s ./Versions/Current/Resources Resources

Then I signed the app using the codesign utility as outlined below:

https://successfulsoftware.net/2012/08/30/how-to-sign-your-mac-os-x-app-for-gatekeeper/

I hope that helps. Again, many thanks. I am very grateful to get this working. 
I would have lost weeks ot work otherwise!

Regards

Seamus

-- 
You received this message because you are subscribed to the Google Groups 
"Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[Matthew Flatt]

At Mon, 3 Jul 2017 08:15:38 -0600, Matthew Flatt wrote:
> to make progress for now, you can
> change
> 
>  collects/compiler/private/mach-o.rkt
> 
> and replace the call on line 164 to `detect-linkedit-padding` with the
> constant 12 --- since 12 seems to be the right number for the v6.9
> build, but `detect-linkedit-padding` thinks it's 8.

Make that 4 instead of 12 if you're using `raco exe --gui`.

-- 
You received this message because you are subscribed to the Google Groups 
"Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[Matthew Flatt]

It looks like there's a problem with the part of `raco exe` that
removes the signature from the starting executable as it creates a new
one.

Specifically, it looks like `raco exe` fails to detect how much padding
was added to the original `__LINKEDIT` segment to add a code signature,
which is necessary for `raco exe` to remove that signature.

I'll try to fix that problem, but to make progress for now, you can
change

 collects/compiler/private/mach-o.rkt

and replace the call on line 164 to `detect-linkedit-padding` with the
constant 12 --- since 12 seems to be the right number for the v6.9
build, but `detect-linkedit-padding` thinks it's 8.

At Sun, 2 Jul 2017 14:57:29 -0700 (PDT), Seamus Brady wrote:
> Hi guys
> 
> I have a Racket based executable that I created using race exe / raco 
> distribute on macOS.
> I am trying to code sign it now so it passes through the macOS GateKeeper.
> 
> I had to add a few symlinks and edit the Info.plist to get the Racket 
> framework signed. That worked fine. But when I try to sign the actual main 
> executable in the app and the app itself, I am getting the error below:
> 
> "codesign_allocate: file not in an order that can be processed (link edit 
> information does not fill the __LINKEDIT segment)"
> 
> As a result the app gets rejected by the spctl assess check.
> 
> I cannot find any bug reports or Stackoverflow issues about Racket binaries 
> and codesigning on macOS but there seems to be similar problems with other 
> open sources binaries (such as binaries produced by PyInstaller).  The 
> problem 
> is a known one.
> 
> I was hoping that someone could provide some advice if anyone has seen 
> similar 
> problems.
> 
> Thanks in advance
> 
> Seamus
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Racket Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to racket-users+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 
You received this message because you are subscribed to the Google Groups 
"Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[Norman Gray]

Seamus, hello.

On 2 Jul 2017, at 22:57, Seamus Brady wrote:

I cannot find any bug reports or Stackoverflow issues about Racket 
binaries and codesigning on macOS but there seems to be similar 
problems with other open sources binaries (such as binaries produced 
by PyInstaller).  The problem is a known one.


I was hoping that someone could provide some advice if anyone has seen 
similar problems.


I'm not sure if it's exactly the same problem, but I attempted something 
similar a few years ago [1], and concluded that it was infeasible, then. 
 It seems that signing involves editing the OS X binary, and that is 
hard to do after linking.


Apologies if you've already found [1] on stackoverflow -- I mention it 
here since the post has a title that isn't obviously about code-signing.


Best wishes,

Norman


[1] 
https://stackoverflow.com/questions/4022495/how-can-i-add-sections-to-an-existing-os-x-executable


--
Norman Gray  :  https://nxg.me.uk
SUPA School of Physics and Astronomy, University of Glasgow, UK

--
You received this message because you are subscribed to the Google Groups "Racket 
Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[racket-users] Error when codesigning Racket created executable - codesign_allocate: file not in an order that can be processed

[Seamus Brady]

Hi guys

I have a Racket based executable that I created using race exe / raco 
distribute on macOS.
I am trying to code sign it now so it passes through the macOS GateKeeper.

I had to add a few symlinks and edit the Info.plist to get the Racket framework 
signed. That worked fine. But when I try to sign the actual main executable in 
the app and the app itself, I am getting the error below:

"codesign_allocate: file not in an order that can be processed (link edit 
information does not fill the __LINKEDIT segment)"

As a result the app gets rejected by the spctl assess check.

I cannot find any bug reports or Stackoverflow issues about Racket binaries and 
codesigning on macOS but there seems to be similar problems with other open 
sources binaries (such as binaries produced by PyInstaller).  The problem is a 
known one.

I was hoping that someone could provide some advice if anyone has seen similar 
problems.

Thanks in advance

Seamus

-- 
You received this message because you are subscribed to the Google Groups 
"Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to racket-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.