Extend identity confirmation for unsigned slices#953
Merged
Conversation
github-actions
Bot
added
lang/objc++
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughVerifyingHasher facade now supports unsigned Mach-O binaries by splitting verification into signed and unsigned paths. The Expected contract captures filesystem identity (stat tuple) and optionally signed expectations. Unsigned verification validates the stat tuple before reading; signed verification uses the signed_check path. Tests, fixture, BUILD, and CLI were updated. ChangesUnsigned Verification Support
Sequence DiagramsequenceDiagram
participant App
participant Run as VerifyingHasher::Run
participant Stat as fstat
participant Core as VerifyingHasherCore
App->>Run: Run(fd, exp)
alt unsigned (exp.signed_check unset)
Run->>Stat: validate (dev, ino, size, mtime)
alt stat match
Run->>Core: create reader (size=exp.stat.size), Run()
Core-->>Run: core_status, CDHash
alt core_status == kNoSignature
Run-->>App: kMatchUnsigned + sha256
else
Run-->>App: kError
end
else stat mismatch
Run-->>App: kError (no sha256)
end
else signed (exp.signed_check set)
Run->>Core: create reader (size=exp.stat.size), Run()
Core-->>Run: core_status, CDHash
alt cdhash matches signed_check
Run-->>App: kMatch + sha256
else
Run-->>App: kError
end
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…ty confirmation Adds a new identity-confirmation mode to the VerifyingHasher facade for Mach-O slices that do not carry an embedded code signature. Confirmation is via a (dev, ino, size, mtime) stat tuple captured at AUTH EXEC and compared against fstat(fd) on the same fd inside the facade. ### Public surface Expected becomes a flat struct: a required StatTuple stat and an optional Signed sub-struct. When signed_check is engaged, Run() verifies the slice via cdhash / signing_id / team_id (existing behavior). When signed_check is nullopt, Run() requires the slice to have no embedded signature and confirms identity via the stat tuple, compared across all four fields including nanosecond mtime. The new Status::kMatchUnsigned reports this success outcome. | Type | Change | | --- | --- | | `Expected::Signed` | Nested in `Expected` and wrapped in `optional<Signed> signed_check` | | `Expected::stat` | New required `StatTuple` | | `StatTuple` | New: `dev`, `ino`, `size`, `mtime` (nanosecond precision) | | `Status::kMatchUnsigned` | New variant for stat-confirmed unsigned success | ### Behavior The facade no longer calls fstat() on the path that consumes signed_check; the file-reader size hint comes from exp.stat.size, which callers supply from the ES event. On the path that does not consume signed_check, the facade fstats once at entry and returns kError with sha256 nullopt if the stat tuple does not match — no file read in that case. kMatchUnsigned requires both: the fstat-derived stat tuple matches Expected.stat across all four fields, AND Core reports kNoSignature for the slice. The two requirements are independent and both load-bearing. ### Testing Adds an unsigned thin arm64 fixture (testdata/hw_unsigned) and 11 new facade tests covering the happy path, per-field stat-mismatch (5 fields including nanosecond mtime), cross-kind anomalies in both directions, kNoSignature-gating against non-Mach-O input, fstat-failure handling, and baseline preservation of the empty-signed_check behavior. Existing tests migrated to the new Expected shape. The OneOffs exerciser gains a -u flag and the smoke test gains a case exercising it end-to-end against a codesign-stripped binary.
mlw
force-pushed
the
mlw/unsigned-binary-verify
branch
from
2f8068d to
921e236
Compare
russellhancox
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new identity-confirmation mode to the VerifyingHasher facade for Mach-O slices that do not carry an embedded code signature. Confirmation is via a (dev, ino, size, mtime) stat tuple captured at AUTH EXEC and compared against fstat(fd) on the same fd inside the facade.
Public surface
Expected becomes a flat struct: a required StatTuple stat and an optional Signed sub-struct. When signed_check is engaged, Run() verifies the slice via cdhash / signing_id / team_id (existing behavior). When signed_check is nullopt, Run() requires the slice to have no embedded signature and confirms identity via the stat tuple, compared across all four fields including nanosecond mtime. The new Status::kMatchUnsigned reports this success outcome.
Expected::SignedExpectedand wrapped inoptional<Signed> signed_checkStatTupledev,ino,size,mtime(nanosecond precision)Behavior
The facade no longer calls fstat() on the path that consumes signed_check; the file-reader size hint comes from exp.stat.size, which callers supply from the ES event. On the path that does not consume signed_check, the facade fstats once at entry and returns kError with sha256 nullopt if the stat tuple does not match — no file read in that case.
kMatchUnsigned requires both: the fstat-derived stat tuple matches Expected.stat across all four fields, AND Core reports kNoSignature for the slice. The two requirements are independent and both load-bearing.
Testing
Adds an unsigned thin arm64 fixture (testdata/hw_unsigned) and 11 new facade tests covering the happy path, per-field stat-mismatch (5 fields including nanosecond mtime), cross-kind anomalies in both directions, kNoSignature-gating against non-Mach-O input, fstat-failure handling, and baseline preservation of the empty-signed_check behavior. Existing tests migrated to the new Expected shape. The OneOffs exerciser gains a -u flag and the smoke test gains a case exercising it end-to-end against a codesign-stripped binary.