Commit 48cf984
doc: add steps about signing the binary in single-executable docs
We didn't catch this in #45038
because the binary wasn't signed by default unlike the official Node.js
binary, which is signed by the Node.js Foundation identity by default.
Refs: nodejs/postject#76 (macOS arm64 part only)
Fixes: nodejs/postject#75
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #46764
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 760a351 commit 48cf984
1 file changed
Lines changed: 38 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -33,7 +33,24 @@ tool, [postject][]: | |||
| 33 | 33 | $ cp $(command -v node) hello | |
| 34 | 34 | ``` | |
| 35 | 35 | ||
| 36 | - 3. Inject the JavaScript file into the copied binary by running `postject` with | ||
| 36 | + 3. Remove the signature of the binary: | ||
| 37 | + | ||
| 38 | + * On macOS: | ||
| 39 | + | ||
| 40 | + ```console | ||
| 41 | + $ codesign --remove-signature hello | ||
| 42 | + ``` | ||
| 43 | + | ||
| 44 | + * On Windows (optional): | ||
| 45 | + | ||
| 46 | + [signtool][] can be used from the installed [Windows SDK][]. If this step is | ||
| 47 | + skipped, ignore any signature-related warning from postject. | ||
| 48 | + | ||
| 49 | + ```console | ||
| 50 | + $ signtool remove /s hello | ||
| 51 | + ``` | ||
| 52 | + | ||
| 53 | + 4. Inject the JavaScript file into the copied binary by running `postject` with | ||
| 37 | 54 | the following options: | |
| 38 | 55 | ||
| 39 | 56 | * `hello` - The name of the copy of the `node` executable created in step 2. | |
@@ -61,7 +78,24 @@ tool, [postject][]: | |||
| 61 | 78 | --macho-segment-name NODE_JS | |
| 62 | 79 | ``` | |
| 63 | 80 | ||
| 64 | - 4. Run the binary: | ||
| 81 | + 5. Sign the binary: | ||
| 82 | + | ||
| 83 | + * On macOS: | ||
| 84 | + | ||
| 85 | + ```console | ||
| 86 | + $ codesign --sign - hello | ||
| 87 | + ``` | ||
| 88 | + | ||
| 89 | + * On Windows (optional): | ||
| 90 | + | ||
| 91 | + A certificate needs to be present for this to work. However, the unsigned | ||
| 92 | + binary would still be runnable. | ||
| 93 | + | ||
| 94 | + ```console | ||
| 95 | + $ signtool sign /fd SHA256 hello | ||
| 96 | + ``` | ||
| 97 | + | ||
| 98 | + 6. Run the binary: | ||
| 65 | 99 | ```console | |
| 66 | 100 | $ ./hello world | |
| 67 | 101 | Hello, world! | |
@@ -132,9 +166,11 @@ to help us document them. | |||
| 132 | 166 | [ELF]: https://en.wikipedia.org/wiki/Executable_and_Linkable_Format | |
| 133 | 167 | [Mach-O]: https://en.wikipedia.org/wiki/Mach-O | |
| 134 | 168 | [PE]: https://en.wikipedia.org/wiki/Portable_Executable | |
| 169 | + [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/ | ||
| 135 | 170 | [`process.execPath`]: process.md#processexecpath | |
| 136 | 171 | [`require()`]: modules.md#requireid | |
| 137 | 172 | [`require.main`]: modules.md#accessing-the-main-module | |
| 138 | 173 | [fuse]: https://www.electronjs.org/docs/latest/tutorial/fuses | |
| 139 | 174 | [postject]: https://github.com/nodejs/postject | |
| 175 | + [signtool]: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool | ||
| 140 | 176 | [single executable applications]: https://github.com/nodejs/single-executable | |
0 commit comments