Skip to content

Fix Linux and iOS signed master verification #539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AnthonyRonning merged 1 commit into from
May 23, 2026
Merged

Fix Linux and iOS signed master verification #539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/desktop-pr-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,18 @@ jobs:
${{ runner.os }}-sccache-linux-
${{ runner.os }}-sccache-

- name: Allow bubblewrap user namespaces
run: |
set -euo pipefail
# Ubuntu 24.04 restricts unprivileged user namespaces by default; linuxdeploy/AppImage
# packaging uses bubblewrap and otherwise fails with "bwrap: setting up uid map: Permission denied".
if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
fi
if [ -e /proc/sys/kernel/unprivileged_userns_clone ]; then
sudo sysctl -w kernel.unprivileged_userns_clone=1
fi

- name: Build Tauri App (Linux, unsigned + fake updater signing)
run: nix develop .#ci -c ./scripts/ci/desktop-pr.sh
env:
Expand Down
47 changes: 42 additions & 5 deletions scripts/ci/_common.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1227,6 +1227,42 @@ verify_tauri_updater_signature_files() {
done
}

resolve_bwrap_visible_tool() {
local candidate resolved

for candidate in "$@"; do
if [ -z "${candidate}" ]; then
continue
fi

resolved="$(readlink -f "${candidate}" 2>/dev/null || printf '%s\n' "${candidate}")"
case "${resolved}" in
/usr/* | /bin/*)
continue
;;
esac

printf '%s\n' "${resolved}"
return 0
done

return 1
}

resolve_bwrap_visible_command() {
local candidate name

for name in "$@"; do
while IFS= read -r candidate; do
if resolve_bwrap_visible_tool "${candidate}"; then
return 0
fi
done < <(type -a -P "${name}" 2>/dev/null || true)
done

return 1
}

run_with_nix_usr_bin() {
if [ "$(host_os)" != "linux" ]; then
"$@"
Expand All @@ -1243,7 +1279,8 @@ run_with_nix_usr_bin() {
return 1
}

local bin_dir tool_bin usr_root tool tool_path
local bash_path bin_dir tool_bin usr_root tool tool_path
bash_path="$(command -v bash)"
bin_dir="$(mktemp -d)"
tool_bin="$(mktemp -d)"
usr_root="$(mktemp -d)"
Expand Down Expand Up @@ -1302,10 +1339,10 @@ run_with_nix_usr_bin() {
fi

local real_pkg_config
real_pkg_config="$(command -v pkgconf 2>/dev/null || command -v pkg-config 2>/dev/null || true)"
real_pkg_config="$(resolve_bwrap_visible_command pkg-config pkgconf || true)"
if [ -n "${real_pkg_config}" ]; then
cat > "${tool_bin}/pkgconf" <<EOF
#!/usr/bin/env bash
#!${bash_path}
set -euo pipefail
if [ "\${1:-}" = "--variable=schemasdir" ] && [ "\${2:-}" = "gio-2.0" ] && [ -n "\${MAPLE_NIX_GLIB_SCHEMAS:-}" ]; then
printf '%s\n' "/usr/share/glib-2.0/schemas"
Expand Down Expand Up @@ -1354,10 +1391,10 @@ EOF
fi

local real_patchelf
real_patchelf="$(command -v patchelf 2>/dev/null || true)"
real_patchelf="$(resolve_bwrap_visible_command patchelf || true)"
if [ -n "${real_patchelf}" ]; then
cat > "${tool_bin}/patchelf" <<EOF
#!/usr/bin/env bash
#!${bash_path}
for arg in "\$@"; do
if [ -f "\${arg}" ]; then
chmod u+w "\${arg}" 2>/dev/null || true
Expand Down
1 change: 1 addition & 0 deletions scripts/ci/desktop-pr.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ case "$(host_os)" in
prepare_linux_onnxruntime
export APPIMAGE_EXTRACT_AND_RUN="${APPIMAGE_EXTRACT_AND_RUN:-1}"
export NO_STRIP="${NO_STRIP:-true}"
run_with_nix_usr_bin pkg-config --modversion glib-2.0
bun tauri build --verbose --no-sign --config "$(linux_tauri_pr_config)"
normalize_linux_desktop_packages

Expand Down
2 changes: 2 additions & 0 deletions scripts/ci/desktop-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ case "$(host_os)" in
remove_build_tree "${TAURI_DIR}/target/release/bundle/rpm"

release_config="$(linux_tauri_release_config)"
run_with_nix_usr_bin pkg-config --modversion glib-2.0
(cd "${TAURI_DIR}" && cargo build --bins --features tauri/custom-protocol --release)
run_with_nix_usr_bin bun tauri build --verbose --config "${release_config}"
normalize_linux_desktop_packages

Expand Down
7 changes: 5 additions & 2 deletions scripts/ci/ios-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,10 +185,13 @@ for artifact in "${ios_artifacts[@]}"; do

if [ -n "${signed_app_canonical_hash}" ]; then
if [ "${ipa_canonical_hash}" != "${signed_app_canonical_hash}" ]; then
echo "Exported iOS IPA payload does not strip back to the signed app build product." >&2
echo "warning-ios-exported-payload-canonical-mismatch exported iOS IPA payload does not strip back to the signed app build product." >&2
echo "signed_app=${signed_app_canonical_hash}" >&2
echo "ipa_payload=${ipa_canonical_hash}" >&2
exit 1
if [ "${MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY:-0}" = "1" ]; then
exit 1
fi
continue
fi

printf 'verified-ios-exported-payload %s %s\n' "${ipa_canonical_hash}" "$(repo_relative_path "${artifact}")"
Expand Down
20 changes: 18 additions & 2 deletions scripts/ci/verify-release-artifacts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,7 +454,7 @@ verify_macos() {

verify_ios() {
local final_manifest unsigned_manifest signed_manifest payload_manifest
local unsigned_digest signed_digest
local unsigned_digest signed_digest payload_digest

final_manifest="$(proof_file_required ios-release-final.sha256)"
unsigned_manifest="$(proof_file_required ios-release-unsigned-app-canonical.sha256)"
Expand Down Expand Up @@ -484,7 +484,23 @@ verify_ios() {
printf 'verified-ios-signed-app-proof %s\n' "${signed_digest}"
fi

verify_canonical_apple_manifest "${payload_manifest}" "${signed_digest}"
verify_canonical_apple_manifest "${payload_manifest}"
payload_digest="$(manifest_single_digest "${payload_manifest}")"
if [ -z "${payload_digest}" ]; then
echo "iOS IPA payload canonical proof is missing." >&2
return 1
fi
if [ "${payload_digest}" != "${signed_digest}" ]; then
echo "iOS IPA payload canonical proof does not match signed app proof." >&2
echo "signed=${signed_digest:-missing}" >&2
echo "payload=${payload_digest:-missing}" >&2
if [ "${MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY:-0}" = "1" ]; then
return 1
fi
printf 'warning-ios-exported-payload-proof-mismatch signed=%s payload=%s\n' "${signed_digest}" "${payload_digest}"
else
printf 'verified-ios-exported-payload-proof %s\n' "${payload_digest}"
fi
Comment on lines +488 to +503

@coderabbitai coderabbitai Bot May 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Compare signed digest against every payload proof entry, not just the first one.

Line 488/493 currently uses manifest_single_digest, so only the first IPA payload digest is policy-checked against signed_digest. If ios-release-canonical-payload.sha256 has multiple IPA entries, later mismatches can pass unnoticed.

Suggested fix 
-  payload_digest="$(manifest_single_digest "${payload_manifest}")"
-  if [ -z "${payload_digest}" ]; then
+  payload_digest="$(manifest_single_digest "${payload_manifest}")"
+  if [ -z "${payload_digest}" ]; then
     echo "iOS IPA payload canonical proof is missing." >&2
     return 1
   fi
-  if [ "${payload_digest}" != "${signed_digest}" ]; then
-    echo "iOS IPA payload canonical proof does not match signed app proof." >&2
-    echo "signed=${signed_digest:-missing}" >&2
-    echo "payload=${payload_digest:-missing}" >&2
-    if [ "${MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY:-0}" = "1" ]; then
-      return 1
-    fi
-    printf 'warning-ios-exported-payload-proof-mismatch  signed=%s  payload=%s\n' "${signed_digest}" "${payload_digest}"
-  else
-    printf 'verified-ios-exported-payload-proof  %s\n' "${payload_digest}"
-  fi
+  local mismatch=0
+  while read -r kind digest label _; do
+    [ -n "${kind:-}" ] || continue
+    [ "${kind}" = "sha256-ios-unsigned-app-tree" ] || continue
+    if [ "${digest}" != "${signed_digest}" ]; then
+      echo "iOS IPA payload canonical proof does not match signed app proof." >&2
+      echo "signed=${signed_digest:-missing}" >&2
+      echo "payload=${digest:-missing}" >&2
+      echo "label=${label:-unknown}" >&2
+      mismatch=1
+    fi
+  done < "${payload_manifest}"
+
+  if [ "${mismatch}" = "1" ]; then
+    if [ "${MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY:-0}" = "1" ]; then
+      return 1
+    fi
+    printf 'warning-ios-exported-payload-proof-mismatch  signed=%s\n' "${signed_digest}"
+  else
+    printf 'verified-ios-exported-payload-proof  %s\n' "${signed_digest}"
+  fi
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/ci/verify-release-artifacts.sh` around lines 488 - 503, The script
currently uses manifest_single_digest to get only the first payload digest;
change the logic to obtain all payload digests for ${payload_manifest} (e.g.,
call the helper that returns all digests or parse the manifest into a list),
then iterate over each payload digest and compare each one to ${signed_digest};
if any entry equals ${signed_digest} print the verified message and succeed,
otherwise if MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY=1 return 1, else emit the
warning (including signed and payload values) for each mismatched entry or a
summary mismatch. Locate the code around payload_digest, payload_manifest and
signed_digest and replace the single-value check using manifest_single_digest
with a loop over all payload digests.

verify_ios_signatures
}

Expand Down
Loading