Skip to content

strictVerify types seem wrong #344

Closed
Closed
@t3chguy

Description

@t3chguy

The type is an optional boolean, yet the code has handling for string values.

osx-sign/src/sign.ts

Lines 78 to 85 in 757fa60

opts.strictVerify !== false && compareVersion(osRelease, '15.0.0') >= 0 // Strict flag since darwin 15.0.0 --> OS X 10.11.0 El Capitan
? [
'--strict' +
(opts.strictVerify
? '=' + opts.strictVerify // Array should be converted to a comma separated string
: '')
]
: [],

Worse yet, treating it as a boolean entirely fails in my experience.

  failedTask=build stackTrace=Error: Command failed: codesign --verify --deep --strict=true --verbose=2 /Users/runner/work/element-desktop/element-desktop/dist/mac-universal/Element Nightly.app
invalid strict option - true

Indeed the man page does not list --strict=true as a valid option.

     --strict options
             When validating code, apply additional restrictions beyond the defaults.

             symlinks  Check that symbolic links inside the code bundle point to sealed files inside its bundle.  This means that broken symbolic links are rejected, as are links
                       to places outside the bundle and to places that are not, for whatever reason, sealed by the signature.

             sideband  Check that no resource forks, Finder attributes, or similar sideband data is present in the signed code.  This is now automatically enforced by signing
                       operations.
             Options can be specified as a comma-separated list. Use plain --strict or --strict=all to be as strict as possible. Note that --strict=all may include more checking
             types over time.
             Not all strictness check make sense in all circumstances, which is why these behaviors are not the defualt.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions