Commit 15280fb
doc: add steps about signing the binary in single-executable docs
We didn't catch this in #45038
because the binary wasn't signed by default unlike the official Node.js
binary, which is signed by the Node.js Foundation identity by default.
Refs: nodejs/postject#76 (macOS arm64 part only)
Fixes: nodejs/postject#75
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #46764
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 671d2c0 commit 15280fb
1 file changed
Lines changed: 38 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -39,7 +39,24 @@ tool, [postject][]: | |||
| 39 | 39 | $ cp $(command -v node) hello | |
| 40 | 40 | ``` | |
| 41 | 41 | ||
| 42 | - 3. Inject the JavaScript file into the copied binary by running `postject` with | ||
| 42 | + 3. Remove the signature of the binary: | ||
| 43 | + | ||
| 44 | + * On macOS: | ||
| 45 | + | ||
| 46 | + ```console | ||
| 47 | + $ codesign --remove-signature hello | ||
| 48 | + ``` | ||
| 49 | + | ||
| 50 | + * On Windows (optional): | ||
| 51 | + | ||
| 52 | + [signtool][] can be used from the installed [Windows SDK][]. If this step is | ||
| 53 | + skipped, ignore any signature-related warning from postject. | ||
| 54 | + | ||
| 55 | + ```console | ||
| 56 | + $ signtool remove /s hello | ||
| 57 | + ``` | ||
| 58 | + | ||
| 59 | + 4. Inject the JavaScript file into the copied binary by running `postject` with | ||
| 43 | 60 | the following options: | |
| 44 | 61 | ||
| 45 | 62 | * `hello` - The name of the copy of the `node` executable created in step 2. | |
@@ -67,7 +84,24 @@ tool, [postject][]: | |||
| 67 | 84 | --macho-segment-name NODE_JS | |
| 68 | 85 | ``` | |
| 69 | 86 | ||
| 70 | - 4. Run the binary: | ||
| 87 | + 5. Sign the binary: | ||
| 88 | + | ||
| 89 | + * On macOS: | ||
| 90 | + | ||
| 91 | + ```console | ||
| 92 | + $ codesign --sign - hello | ||
| 93 | + ``` | ||
| 94 | + | ||
| 95 | + * On Windows (optional): | ||
| 96 | + | ||
| 97 | + A certificate needs to be present for this to work. However, the unsigned | ||
| 98 | + binary would still be runnable. | ||
| 99 | + | ||
| 100 | + ```console | ||
| 101 | + $ signtool sign /fd SHA256 hello | ||
| 102 | + ``` | ||
| 103 | + | ||
| 104 | + 6. Run the binary: | ||
| 71 | 105 | ```console | |
| 72 | 106 | $ ./hello world | |
| 73 | 107 | Hello, world! | |
@@ -138,9 +172,11 @@ to help us document them. | |||
| 138 | 172 | [ELF]: https://en.wikipedia.org/wiki/Executable_and_Linkable_Format | |
| 139 | 173 | [Mach-O]: https://en.wikipedia.org/wiki/Mach-O | |
| 140 | 174 | [PE]: https://en.wikipedia.org/wiki/Portable_Executable | |
| 175 | + [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/ | ||
| 141 | 176 | [`process.execPath`]: process.md#processexecpath | |
| 142 | 177 | [`require()`]: modules.md#requireid | |
| 143 | 178 | [`require.main`]: modules.md#accessing-the-main-module | |
| 144 | 179 | [fuse]: https://www.electronjs.org/docs/latest/tutorial/fuses | |
| 145 | 180 | [postject]: https://github.com/nodejs/postject | |
| 181 | + [signtool]: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool | ||
| 146 | 182 | [single executable applications]: https://github.com/nodejs/single-executable | |
0 commit comments