Optimize macOS code signing with single-pass patch+sign for thin Mach-O binaries - #2588
Open
wolfv wants to merge 1 commit into
Open
Optimize macOS code signing with single-pass patch+sign for thin Mach-O binaries#2588wolfv wants to merge 1 commit into
wolfv wants to merge 1 commit into
Conversation
Replace the `/usr/bin/codesign` subprocess with in-process ad-hoc signing via the arwen-codesign crate when linking prefix-patched binaries on macOS targets. Highlights: - Thin Mach-O binaries are now patched, re-signed and hashed in a single streaming pass: one read of the source, one write of the destination. Previously the flow was write -> spawn codesign (which reads and rewrites the whole file) -> re-read to recompute the hash. In-process signing runs at ~1.3 GB/s and saves ~20-40 ms of process spawn overhead per binary, which adds up over the thousands of dylibs in a typical environment. - Fat (universal) binaries are signed per architecture slice in memory. `/usr/bin/codesign` is kept only as a fallback on macOS hosts for anything the in-process signer cannot handle. - Signing now also works when installing macOS environments from non-macOS hosts (previously spawning /usr/bin/codesign simply failed). - Whether a binary needs re-signing is now decided by scanning the source for the placeholder instead of comparing against the paths.json sha256; binaries in packages that do not record a sha256 were previously modified but never re-signed, leaving them un-runnable on Apple Silicon. - The identifier is derived from the file name, and entitlements are preserved, matching the previous `codesign --force --sign - --preserve-metadata=entitlements` invocation. Tests link real Mach-O fixtures (linker-signed thin + fat) through `link_file` and validate the resulting signatures with `arwen_codesign::verify`; because signing is in-process these tests run on any platform. The arwen-codesign dependency currently points at a git branch and should be switched to the crates.io release once >= 0.1.0 is published. User prompt: "I want to use arwen codesign in rattler instead of calling codesign executable for adhoc signing. We might need to add a 'streaming' high performance adhoc signing ... can you take a look? Also make sure arwen codesign is _PRODUCTION READY_ and crazy ass fast!" Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PWnq7uDMrjDi3q3b9P4qn3
baszalmstra
reviewed
Aug 5, 2026
| apple-native-keyring-store = { version = "1.0.0", default-features = false } | ||
| archspec = "0.2.0" | ||
| # TODO: switch to the crates.io release once arwen-codesign >= 0.1.0 is published | ||
| arwen-codesign = { git = "https://github.com/wolfv/arwen", branch = "claude/arwen-codesign-rattler-frrg3u" } |
Collaborator
There was a problem hiding this comment.
If this is released Id love to pull this in!
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR optimizes the code signing process for macOS binaries during package installation by implementing a single-pass streaming approach for thin Mach-O binaries.
Key improvements:
Single-pass patch+sign+hash for thin Mach-O binaries: Instead of patching the binary, then re-signing it (requiring a full re-read and re-hash), thin Mach-O binaries now flow through a streaming signer in one pass. The patched bytes are signed and hashed on-the-fly, eliminating the extra I/O overhead.
In-process code signing: Replaced reliance on spawning
/usr/bin/codesignwith thearwen_codesigncrate for in-process ad-hoc signing. This is orders of magnitude faster and works cross-platform (e.g., signing macOS binaries from Linux).Smarter signing decisions: Added
binary_content_will_change()to detect whether prefix replacement actually modifies the binary content. If the placeholder doesn't occur in the binary, the original linker signature is preserved, avoiding unnecessary re-signing.Fallback support: On macOS hosts,
/usr/bin/codesignremains available as a fallback for fat binaries and any edge cases the in-process signer cannot handle.Technical changes:
link_file()to compute whether re-signing is needed upfrontpatch_and_sign_single_pass()for the optimized streaming pathapple_codesign.rsto usearwen_codesignfor in-process signingtest_exe_linker_signed,test_exe_fat) for macOS code signing testsFixes #<issue_number>
How Has This Been Tested?
link.rs:test_macho_binary_is_resigned_after_prefix_replacement: Verifies thin Mach-O binaries are re-signed after prefix replacement and the hash/size are correcttest_macho_binary_without_placeholder_is_not_resigned: Confirms that when the placeholder doesn't occur, the original linker signature is preservedtest_fat_macho_binary_is_resigned: Validates fat (universal) binaries are properly re-signed with all architecture slicesChecklist:
https://claude.ai/code/session_01PWnq7uDMrjDi3q3b9P4qn3