Verify Apple codesign immediately after ESRP signing - #27486
Merged
Dongbo Wang (daxian-dbw) merged 1 commit intoMay 20, 2026
Merged
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
Andy Jordan (andyleejordan)
requested a review
from Justin Chung (jshigetomi)
as a code owner
May 20, 2026 17:50
Andy Jordan (andyleejordan)
requested a review
from Aditya Patwardhan (adityapatwardhan)
May 20, 2026 17:50
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aims to fail fast on macOS ESRP “successful but unsigned output” cases by verifying Apple code signatures immediately after expanding the ESRP-returned zip in the Sign_macOS_* jobs, mirroring the verification already performed later in mac-package-build.yml.
Changes:
- Add a codesign --verify --deep --strict verification loop over pwsh and *.dylib in .pipelines/templates/mac.yml right after expanding the ESRP-signed zip.
Sorry, something went wrong.
Comment thread
.pipelines/templates/mac.yml
Andy Jordan (andyleejordan)
marked this pull request as draft
May 20, 2026 18:17
The Sign_macOS_* jobs run on a Windows pool, so we cannot call `codesign`. Scan each Mach-O for the certificate-subject string `Developer ID Application: Microsoft Corporation` that ESRP embeds into the CMS signature blob; if it is absent, ESRP did not actually sign the file and we fail the job. This catches silent ESRP no-ops (statusCode=pass with byte-identical output) in the job that owns the signing rather than one stage later in packaging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Andy Jordan (andyleejordan)
force-pushed
the
andschwa/verify-after-esrp-sign
branch
from
69e866f to
d7c0ee0
Compare
May 20, 2026 18:38
Andy Jordan (andyleejordan)
marked this pull request as ready for review
May 20, 2026 20:13
Copy link
Copy Markdown
Member
Author
|
Updated to work on Windows. I hand checked the script: > cat ./verify-step.ps1
param([string]$signedDir)
$expected = 'Developer ID Application: Microsoft Corporation'
$missing = @()
Get-ChildItem $signedDir -Recurse -Include 'pwsh', '*.dylib' | ForEach-Object {
$bytes = [System.IO.File]::ReadAllBytes($_.FullName)
$text = [System.Text.Encoding]::Latin1.GetString($bytes)
if (-not $text.Contains($expected)) {
$missing += $_.FullName
Write-Host "##[error]Missing '$expected' signature in $($_.FullName)"
} else {
Write-Host "OK: $($_.FullName)"
}
}
if ($missing.Count -gt 0) {
throw "ESRP did not apply a Developer ID signature to $($missing.Count) file(s): $($missing -join ', ')"
}
> ./verify-step.ps1 /tmp/sign76out/
OK: /tmp/sign76out/drop_macos_sign_x64/Signed-x64/libcoreclr.dylib
OK: /tmp/sign76out/drop_macos_sign_x64/Signed-x64/libpsl-native.dylib
OK: /tmp/sign76out/drop_macos_sign_x64/Signed-x64/libSystem.Native.dylib
> ./verify-step.ps1 /tmp/sign74out/
##[error]Missing 'Developer ID Application: Microsoft Corporation' signature in /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libcoreclr.dylib
##[error]Missing 'Developer ID Application: Microsoft Corporation' signature in /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libpsl-native.dylib
##[error]Missing 'Developer ID Application: Microsoft Corporation' signature in /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libSystem.Native.dylib
##[error]Missing 'Developer ID Application: Microsoft Corporation' signature in /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libSystem.Security.Cryptography.Native.OpenSsl.dylib
##[error]Missing 'Developer ID Application: Microsoft Corporation' signature in /tmp/sign74out/drop_macos_sign_x64/Signed-x64/pwsh
Exception: /private/tmp/verify-step.ps1:15
Line |
15 | throw "ESRP did not apply a Developer ID signature to $($missing.Co …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| ESRP did not apply a Developer ID signature to 5 file(s):
| /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libcoreclr.dylib,
| /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libpsl-native.dylib,
| /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libSystem.Native.dylib,
| /tmp/sign74out/drop_macos_sign_x64/Signed-x64/libSystem.Security.Cryptography.Native.OpenSsl.dylib,
| /tmp/sign74out/drop_macos_sign_x64/Signed-x64/pwsh
|
Sorry, something went wrong.
Dongbo Wang (daxian-dbw)
approved these changes
May 20, 2026
9 tasks
9 tasks
9 tasks
Justin Grote (JustinGrote)
pushed a commit
to JustinGrote/PowerShell
that referenced
this pull request
Jun 2, 2026
Thatgfsj (Thatgfsj)
pushed a commit
to Thatgfsj/PowerShell
that referenced
this pull request
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
Add an equivalent of codesign --verify --deep --strict step in the Sign_macOS_* jobs immediately after expanding the zip returned by ESRP. This is similar to the verification already run downstream in mac-package-build.yml, but running it inside the sign job means we fail fast in the producing pipeline instead of discovering the problem later in packaging. And it uses PowerShell to just look at the files so it can run on Windows.
Motivation
In a release build, the Sign_macOS_x64 job's ESRP submission returned statusCode: pass with "1 files signed successfully!", but the returned zip contained byte-identical Mach-O entries with no Developer ID Application signature applied. ESRP silently no-op'd. The failure only surfaced in the downstream packaging pipeline's verify step (added in #27347), one stage later, after we had already published the bad drop_macos_sign_x64 artifact.
Running the same verify here surfaces this class of silent ESRP no-op in the job that owns the signing, so:
PR Context
Defense-in-depth follow-up to #27347.
PR Checklist
[Job-specific change to .pipelines/templates/mac.yml only]