Add macOS-14 to the test matrix. (#1323 )

Fix: Update code to use the new MOLCodesignChecker interfaces for codesigning info (#1322 )
* Update code to use the new MOLCodesignChecker interfaces for codesigning info.
2026-01-20 19:48:07 -05:00 · 2024-04-05 15:09:04 -04:00 · 2024-04-05 12:27:33 -04:00 · 2024-04-05 10:39:08 -04:00 · 2024-03-28 15:02:01 -04:00
10 changed files with 45 additions and 55 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [macos-11, macos-12, macos-13]
+        os: [macos-11, macos-12, macos-13, macos-14]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
@@ -31,14 +31,14 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [macos-11, macos-12, macos-13]
+        os: [macos-11, macos-12, macos-13, macos-14]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
      - name: Run All Tests
        run: bazel test :unit_tests --define=SANTA_BUILD_TYPE=adhoc --test_output=errors
  test_coverage:
-    runs-on: macos-11
+    runs-on: macos-14
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
      - name: Generate test coverage
--- a/Source/common/SNTXPCControlInterface.m
+++ b/Source/common/SNTXPCControlInterface.m
@@ -34,8 +34,7 @@ NSString *const kBundleID = @"com.google.santa.daemon";
 #else
  MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithSelf];
  // "teamid.com.google.santa.daemon.xpc"
-  NSString *t = cs.signingInformation[@"teamid"];
-  return [NSString stringWithFormat:@"%@.%@.xpc", t, kBundleID];
+  return [NSString stringWithFormat:@"%@.%@.xpc", cs.teamID, kBundleID];
 #endif
 }

--- a/Source/gui/Resources/MessageWindow.xib
+++ b/Source/gui/Resources/MessageWindow.xib
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="20037" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="32700.99.1234" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="20037"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="22689"/>
        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
    </dependencies>
    <objects>
@@ -18,18 +18,18 @@
        </customObject>
        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
-            <windowStyleMask key="styleMask" utility="YES"/>
+        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" titlebarAppearsTransparent="YES" titleVisibility="hidden" id="9Bq-yh-54f" customClass="SNTMessageWindow">
+            <windowStyleMask key="styleMask" titled="YES" utility="YES"/>
            <rect key="contentRect" x="167" y="107" width="540" height="479"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1728" height="1079"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="1916" height="1099"/>
            <view key="contentView" id="Iwq-Lx-rLv">
                <rect key="frame" x="0.0" y="0.0" width="540" height="462"/>
                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                <subviews>
                    <button focusRingType="none" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kiB-jZ-69S">
-                        <rect key="frame" x="16" y="434" width="37" height="32"/>
+                        <rect key="frame" x="16" y="434" width="37" height="23"/>
                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <buttonCell key="cell" type="push" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="rounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
+                        <buttonCell key="cell" type="roundTextured" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="texturedRounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                            <font key="font" metaFont="system"/>
                            <userDefinedRuntimeAttributes>
@@ -128,10 +128,6 @@
                    </textField>
                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
                        <rect key="frame" x="62" y="235" width="15" height="15"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
-                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
-                        </constraints>
                        <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="NSInfo" imagePosition="overlaps" alignment="center" refusesFirstResponder="YES" imageScaling="proportionallyDown" inset="2" id="R72-Qy-Xbb">
                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                            <font key="font" metaFont="system"/>
@@ -139,6 +135,10 @@
                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
                            </userDefinedRuntimeAttributes>
                        </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
+                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
+                        </constraints>
                        <connections>
                            <action selector="showCertInfo:" target="-2" id="dB0-a3-X31"/>
                            <binding destination="-2" name="hidden" keyPath="self.publisherInfo" id="fFR-f3-Oiw">
@@ -241,16 +241,17 @@
                    </textField>
                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
                        <rect key="frame" x="147" y="30" width="126" height="32"/>
-                        <constraints>
-                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
-                        </constraints>
                        <buttonCell key="cell" type="push" title="Open..." bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="X1b-TF-1TL">
                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                            <font key="font" metaFont="system"/>
                            <string key="keyEquivalent" base64-UTF8="YES">
 DQ
 </string>
+                            <modifierMask key="keyEquivalentModifierMask" command="YES"/>
                        </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
+                        </constraints>
                        <connections>
                            <action selector="openEventDetails:" target="-2" id="VhL-ql-rCV"/>
                            <outlet property="nextKeyView" destination="BbV-3h-mmL" id="Xkz-va-iGc"/>
@@ -272,23 +273,19 @@ DQ
                    </textField>
                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
                        <rect key="frame" x="110" y="80" width="319" height="29"/>
-                        <constraints>
-                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
-                        </constraints>
                        <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
                            <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
                            <font key="font" metaFont="smallSystem"/>
                        </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
+                        </constraints>
                        <connections>
                            <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
                        </connections>
                    </button>
                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
                        <rect key="frame" x="271" y="28" width="124" height="34"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
-                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
-                        </constraints>
                        <buttonCell key="cell" type="push" title="Ignore" bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                            <font key="font" metaFont="system"/>
@@ -296,6 +293,10 @@ DQ
 Gw
 </string>
                        </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
+                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
+                        </constraints>
                        <accessibility description="Dismiss Dialog"/>
                        <connections>
                            <action selector="closeWindow:" target="-2" id="qQq-gh-8lw"/>
--- a/Source/gui/SNTBinaryMessageWindowController.m
+++ b/Source/gui/SNTBinaryMessageWindowController.m
@@ -92,6 +92,9 @@
    NSString *eventDetailText = [[SNTConfigurator configurator] eventDetailText];
    if (eventDetailText) {
      [self.openEventButton setTitle:eventDetailText];
+      // Require the button keyEquivalent set to be CMD + Return
+      [self.openEventButton setKeyEquivalent:@"\r"]; // Return Key
+      [self.openEventButton setKeyEquivalentModifierMask:NSEventModifierFlagCommand]; // Command Key
    }
  }

--- a/Source/gui/SNTFileAccessMessageWindowView.swift
+++ b/Source/gui/SNTFileAccessMessageWindowView.swift
@@ -142,6 +142,8 @@ struct SNTFileAccessMessageWindowView: View {

              Text(customText ?? "Open Event...").frame(maxWidth:.infinity)
            })
+            .buttonStyle(.borderedProminent)
+            .keyboardShortcut(.defaultAction)
          }
          Button(action: dismissButton, label: {
            Text("Dismiss").frame(maxWidth:.infinity)
--- a/Source/santactl/Commands/SNTCommandFileInfo.m
+++ b/Source/santactl/Commands/SNTCommandFileInfo.m
@@ -380,21 +380,16 @@ REGISTER_COMMAND_NAME(@"fileinfo")
    NSError *err;
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:&err];

-    NSString *cdhash =
-      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoUnique];
-    NSString *teamID =
-      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];
-    NSString *identifier =
-      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+    NSString *cdhash = csc.cdhash;
+    NSString *teamID = csc.teamID;
+    NSString *identifier = csc.signingID;

    NSString *signingID;
    if (identifier) {
      if (teamID) {
        signingID = [NSString stringWithFormat:@"%@:%@", teamID, identifier];
      } else {
-        id platformID =
-          [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
-        if ([platformID isKindOfClass:[NSNumber class]] && [platformID intValue] != 0) {
+        if (csc.platformBinary) {
          signingID = [NSString stringWithFormat:@"platform:%@", identifier];
        }
      }
@@ -522,21 +517,21 @@ REGISTER_COMMAND_NAME(@"fileinfo")
 - (SNTAttributeBlock)teamID {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
-    return [csc.signingInformation valueForKey:@"teamid"];
+    return csc.teamID;
  };
 }

 - (SNTAttributeBlock)signingID {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
-    return [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+    return csc.signingID;
  };
 }

 - (SNTAttributeBlock)cdhash {
  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
-    return [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoUnique];
+    return csc.cdhash;
  };
 }

--- a/Source/santactl/Commands/SNTCommandRule.m
+++ b/Source/santactl/Commands/SNTCommandRule.m
@@ -259,8 +259,7 @@ REGISTER_COMMAND_NAME(@"rule")
      newRule.identifier = cs.leafCertificate.SHA256;
    } else if (newRule.type == SNTRuleTypeCDHash) {
      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
-      newRule.identifier =
-        [cs.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+      newRule.identifier = cs.signingID;
    } else if (newRule.type == SNTRuleTypeTeamID || newRule.type == SNTRuleTypeSigningID) {
      // noop
    }
--- a/Source/santad/SNTExecutionControllerTest.mm
+++ b/Source/santad/SNTExecutionControllerTest.mm
@@ -387,9 +387,7 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
 }

 - (void)testTeamIDAllowRule {
-  OCMStub([self.mockCodesignChecker signingInformation]).andReturn((@{
-    (__bridge NSString *)kSecCodeInfoTeamIdentifier : @(kExampleTeamID),
-  }));
+  OCMStub([self.mockCodesignChecker teamID]).andReturn(@(kExampleTeamID));

  SNTRule *rule = [[SNTRule alloc] init];
  rule.state = SNTRuleStateAllow;
@@ -405,9 +403,7 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
 }

 - (void)testTeamIDBlockRule {
-  OCMStub([self.mockCodesignChecker signingInformation]).andReturn((@{
-    (__bridge NSString *)kSecCodeInfoTeamIdentifier : @(kExampleTeamID),
-  }));
+  OCMStub([self.mockCodesignChecker teamID]).andReturn(@(kExampleTeamID));

  SNTRule *rule = [[SNTRule alloc] init];
  rule.state = SNTRuleStateBlock;
--- a/Source/santad/SNTPolicyProcessor.m
+++ b/Source/santad/SNTPolicyProcessor.m
@@ -90,22 +90,17 @@
      cd.certSHA256 = csInfo.leafCertificate.SHA256;
      cd.certCommonName = csInfo.leafCertificate.commonName;
      cd.certChain = csInfo.certificates;
-      cd.teamID = teamID
-                    ?: [csInfo.signingInformation
-                         objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];
+      cd.teamID = teamID ?: csInfo.teamID;

      // Ensure that if no teamID exists that the signing info confirms it is a
      // platform binary. If not, remove the signingID.
      if (!cd.teamID && cd.signingID) {
-        id platformID = [csInfo.signingInformation
-          objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
-        if (![platformID isKindOfClass:[NSNumber class]] || [platformID intValue] == 0) {
+        if (!csInfo.platformBinary) {
          cd.signingID = nil;
        }
      }

-      NSDictionary *entitlements =
-        csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];
+      NSDictionary *entitlements = csInfo.entitlements;

      if (entitlementsFilterCallback) {
        cd.entitlements = entitlementsFilterCallback(entitlements);
--- a/2
+++ b/2
@@ -104,7 +104,7 @@ git_repository(

 git_repository(
    name = "MOLCodesignChecker",
-    commit = "7ef66f1df15997defd7651b0ea5d6d9ec65a5b4f",  # tag = "v2.2",
+    commit = "567eca847003b36f61fff61472809c39dcf31ef6",  # tag = "v3.0",
    remote = "https://github.com/google/macops-molcodesignchecker.git",
    shallow_since = "1561303990 -0400",
 )
Author	SHA1	Message	Date
Pete Markowsky	22aca6b505	Add macOS-14 to the test matrix. (#1323 )	2024-04-05 15:09:04 -04:00
Pete Markowsky	375f7bd9cc	Fix: Update code to use the new MOLCodesignChecker interfaces for codesigning info (#1322 ) * Update code to use the new MOLCodesignChecker interfaces for codesigning info.	2024-04-05 12:27:33 -04:00
Matt W	7d58665e87	Bump MOLCodesignChecker tag to latest (#1321 )	2024-04-05 10:39:08 -04:00
Ryan Diers	3b2d02f38d	GUI: Restore `default button type` to `MessageWindow` for blocked events (#1316 )	2024-03-28 15:02:01 -04:00