Merge pull request #10652 from nextcloud/backport/10597/stable-34.0

[stable-34.0] fix(mac-crafter): Verify all components are signed with matching team identifiers

Author: mgallien

.github/workflows/mac-crafter-ci.yml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+name: mac-crafter CI
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["master"]
+    types: [opened, reopened, synchronize, ready_for_review]
+
+jobs:
+  tests:
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
+    name: Test mac-crafter
+    timeout-minutes: 15
+    runs-on: macos-26
+    defaults:
+      run:
+        working-directory: admin/osx/mac-crafter
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Setup Xcode
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
+        with:
+          xcode-version: latest-stable
+
+      - name: Run tests
+        run: swift test

admin/osx/mac-crafter/Package.swift

@@ -26,5 +26,9 @@ let package = Package(
                 .enableUpcomingFeature("StrictConcurrency")
             ]
         ),
+        .testTarget(
+            name: "mac-crafter-tests",
+            dependencies: ["mac-crafter"]
+        ),
     ]
 )

admin/osx/mac-crafter/Sources/Commands/Build.swift

@@ -434,7 +434,10 @@ struct Build: AsyncParsableCommand {
             try await Signer.signMainBundle(
                 at: clientAppURL,
                 codeSignIdentity: codeSignIdentity,
-                entitlements: entitlements
+                entitlements: entitlements,
+                expectedTeamIdentifier: try CMakeConfiguration.developmentTeamIdentifier(
+                    at: repoRootURL.appendingPathComponent("NEXTCLOUD.cmake")
+                )
             )
         }
 

admin/osx/mac-crafter/Sources/Utils/CMakeConfiguration.swift

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import Foundation
+
+///
+/// Reads signing-related values from the client's CMake configuration.
+///
+enum CMakeConfiguration {
+    static func developmentTeamIdentifier(at file: URL) throws -> String {
+        let contents: String
+
+        do {
+            contents = try String(contentsOf: file, encoding: .utf8)
+        } catch {
+            throw MacCrafterError.signing("Unable to read \(file.path): \(error.localizedDescription)")
+        }
+
+        let pattern = #"(?m)^[ \t]*set[ \t]*\([ \t]*DEVELOPMENT_TEAM[ \t]+[\"]?([^\"\s\)]+)"#
+        guard let expression = try? NSRegularExpression(pattern: pattern),
+              let match = expression.firstMatch(
+                  in: contents,
+                  range: NSRange(contents.startIndex..., in: contents)
+              ),
+              let teamIdentifierRange = Range(match.range(at: 1), in: contents)
+        else {
+            throw MacCrafterError.signing("Unable to find DEVELOPMENT_TEAM in \(file.path)")
+        }
+
+        return String(contents[teamIdentifierRange])
+    }
+}

admin/osx/mac-crafter/Sources/Utils/CodeSignatureVerifier.swift

@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import Foundation
+
+///
+/// Discovers signed code components and verifies their team identifiers.
+///
+enum CodeSignatureVerifier {
+    static func verify(at location: URL, expectedTeamIdentifier: String? = nil) throws {
+        try verify(
+            at: location,
+            expectedTeamIdentifier: expectedTeamIdentifier,
+            isMachO: { isMachO($0) },
+            signatureDetails: { try codesignDetails(at: $0) }
+        )
+    }
+
+    static func verify(
+        at location: URL,
+        expectedTeamIdentifier: String? = nil,
+        isMachO: (URL) -> Bool,
+        signatureDetails: (URL) throws -> String
+    ) throws {
+        let components = try discoverCodeComponents(at: location, isMachO: isMachO)
+        let signatures = try components.map { component in
+            (
+                location: component.path,
+                teamIdentifier: TeamIdentifierVerifier.teamIdentifier(from: try signatureDetails(component))
+            )
+        }
+
+        if let error = TeamIdentifierVerifier.validationError(for: signatures) {
+            throw MacCrafterError.signing(error)
+        }
+
+        if let expectedTeamIdentifier,
+           let error = TeamIdentifierVerifier.validationError(
+               for: signatures,
+               expectedTeamIdentifier: expectedTeamIdentifier
+           )
+        {
+            throw MacCrafterError.signing(error)
+        }
+
+        Log.info("Verified matching TeamIdentifier for \(signatures.count) code components")
+    }
+
+    static func discoverCodeComponents(at url: URL, isMachO: (URL) -> Bool) throws -> [URL] {
+        let codeBundleExtensions = ["app", "appex", "framework", "xpc"]
+        let codeSearchDirectories = ["/Contents/MacOS/", "/Contents/Frameworks/", "/Contents/PlugIns/"]
+        var components = [URL]()
+
+        guard let enumerator = FileManager.default.enumerator(
+            at: url,
+            includingPropertiesForKeys: [.isRegularFileKey]
+        ) else {
+            throw MacCrafterError.environmentError("Failed to get enumerator for: \(url.path)")
+        }
+
+        for case let candidate as URL in enumerator {
+            let pathExtension = candidate.pathExtension.lowercased()
+
+            if codeBundleExtensions.contains(pathExtension) || pathExtension == "dylib" {
+                components.append(candidate)
+                continue
+            }
+
+            guard codeSearchDirectories.contains(where: candidate.path.contains),
+                  try candidate.resourceValues(forKeys: [.isRegularFileKey]).isRegularFile == true,
+                  isMachO(candidate)
+            else {
+                continue
+            }
+
+            components.append(candidate)
+        }
+
+        return [url] + components.sorted { $0.path < $1.path }
+    }
+
+    private static func isMachO(_ file: URL) -> Bool {
+        let task = Process()
+        let outputPipe = Pipe()
+        task.executableURL = URL(fileURLWithPath: "/usr/bin/file")
+        task.arguments = ["-b", file.path]
+        task.standardOutput = outputPipe
+        task.standardError = Pipe()
+
+        do {
+            try task.run()
+        } catch {
+            return false
+        }
+
+        let output = String(data: outputPipe.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+        task.waitUntilExit()
+        return task.terminationStatus == 0 && output.contains("Mach-O")
+    }
+
+    private static func codesignDetails(at location: URL) throws -> String {
+        let task = Process()
+        let standardOutput = Pipe()
+        let standardError = Pipe()
+        task.executableURL = URL(fileURLWithPath: "/usr/bin/codesign")
+        task.arguments = ["--display", "--verbose=4", location.path]
+        task.standardOutput = standardOutput
+        task.standardError = standardError
+
+        do {
+            try task.run()
+        } catch {
+            throw MacCrafterError.signing("Unable to inspect the code signature of \(location.path): \(error.localizedDescription)")
+        }
+
+        let outputData = standardOutput.fileHandleForReading.readDataToEndOfFile()
+        let errorData = standardError.fileHandleForReading.readDataToEndOfFile()
+        task.waitUntilExit()
+
+        guard task.terminationStatus == 0 else {
+            let errorOutput = String(data: errorData, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "unknown codesign error"
+            throw MacCrafterError.signing("Unable to inspect the code signature of \(location.path): \(errorOutput)")
+        }
+
+        return [outputData, errorData]
+            .compactMap { String(data: $0, encoding: .utf8) }
+            .joined(separator: "\n")
+    }
+}

admin/osx/mac-crafter/Sources/Utils/Signer.swift

@@ -293,13 +293,15 @@ enum Signer: Signing {
         }
     }
 
-    private static func verify(at location: URL) async throws {
+    private static func verify(at location: URL, expectedTeamIdentifier: String?) async throws {
         Log.info("Verifying: \(location.path)")
         let code = await shell("codesign --verify --deep --strict --verbose=2 \"\(location.path)\"")
 
         if code > 0 {
             throw MacCrafterError.signing("Signing verification failed because the codesign command terminated with code \(code)")
         }
+
+        try CodeSignatureVerifier.verify(at: location, expectedTeamIdentifier: expectedTeamIdentifier)
     }
 
     // MARK: - Public
@@ -310,7 +312,8 @@ enum Signer: Signing {
     static func signMainBundle(
         at location: URL,
         codeSignIdentity: String,
-        entitlements: [String: URL]
+        entitlements: [String: URL],
+        expectedTeamIdentifier: String? = nil
     ) async throws {
         // Signing is inside-out: nested code first, the containing bundle last. Login items come
         // before the app for that reason, and the outer sign is deliberately not --deep.
@@ -390,7 +393,7 @@ enum Signer: Signing {
         }
 
         await sign(at: location, with: codeSignIdentity, entitlements: mainAppEntitlements)
-        try await verify(at: location)
+        try await verify(at: location, expectedTeamIdentifier: expectedTeamIdentifier)
     }
 
     ///

admin/osx/mac-crafter/Sources/Utils/TeamIdentifierVerifier.swift

@@ -0,0 +1,61 @@
+// SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import Foundation
+
+///
+/// Team identifier verification helpers.
+///
+enum TeamIdentifierVerifier {
+    static func teamIdentifier(from codesignOutput: String) -> String? {
+        let prefix = "TeamIdentifier="
+
+        guard let line = codesignOutput.split(whereSeparator: \.isNewline).first(where: { $0.hasPrefix(prefix) }) else {
+            return nil
+        }
+
+        let teamIdentifier = line.dropFirst(prefix.count).trimmingCharacters(in: .whitespacesAndNewlines)
+        return teamIdentifier == "not set" || teamIdentifier.isEmpty ? nil : teamIdentifier
+    }
+
+    static func validationError(for components: [(location: String, teamIdentifier: String?)]) -> String? {
+        guard let firstComponent = components.first else {
+            return "Signing verification failed because no signed code components were found"
+        }
+
+        guard let expectedTeamIdentifier = firstComponent.teamIdentifier else {
+            return "Signing verification failed because \(firstComponent.location) has no TeamIdentifier"
+        }
+
+        for component in components.dropFirst() {
+            guard let teamIdentifier = component.teamIdentifier else {
+                return "Signing verification failed because \(component.location) has no TeamIdentifier"
+            }
+
+            guard teamIdentifier == expectedTeamIdentifier else {
+                return "Signing verification failed because \(component.location) has TeamIdentifier \(teamIdentifier), expected \(expectedTeamIdentifier) from \(firstComponent.location)"
+            }
+        }
+
+        return nil
+    }
+
+    static func validationError(
+        for components: [(location: String, teamIdentifier: String?)],
+        expectedTeamIdentifier: String
+    ) -> String? {
+        guard let component = components.first else {
+            return "Signing verification failed because no signed code components were found"
+        }
+
+        guard let teamIdentifier = component.teamIdentifier else {
+            return "Signing verification failed because \(component.location) has no TeamIdentifier"
+        }
+
+        guard teamIdentifier == expectedTeamIdentifier else {
+            return "Signing verification failed because \(component.location) has TeamIdentifier \(teamIdentifier), expected \(expectedTeamIdentifier) from NEXTCLOUD.cmake"
+        }
+
+        return nil
+    }
+}