Prototype stable macOS permission identity without Developer ID

[IgorArkhipov]

EN

Summary

Entropy v0.1.5 and v0.2.0 use ad-hoc signatures.
Each changed binary gets a different cdhash-only designated requirement, so macOS can show Accessibility as enabled while AXIsProcessTrusted() rejects the updated app.

Release builds embed an explicit requirement anchored to that certificate plus com.ergohaven.entropy.
No Apple Developer account or notarization credentials are required.

Limits and security

• This is an experimental compatibility path, not Apple-supported public distribution.
• Apple explicitly advises against shipping self-signed apps.
• Gatekeeper still rejects the artifact as unidentified; Privacy & Security > Open Anyway remains necessary.
• TCC persistence is not proven until the manual two-build test below passes.
• Release private key must remain secret and backed up. Loss or rotation forces permission re-grant; compromise lets attacker produce code matching Entropy permission identity.
• Bundle-ID-only designated requirement is intentionally rejected because any binary could copy it and target Accessibility grants.

Validation

• Two different Mach-O binaries produce different code hashes but identical certificate-root + bundle-ID designated requirements on macOS 26.5.2.
• Full Entropy .app, ZIP, and DMG build succeeds with temporary self-signed identity.
• Signed app passes strict codesign verification and fails spctl as expected.
• Stable-signing unit/e2e tests, shellcheck, actionlint, and git diff --check pass.
• Full Rust suite passes: 133 tests.
• Hosted PR matrix passes deterministic stable-signing validation on Ubuntu, Windows, macOS ARM, and macOS Intel. Real two-binary signing proof ran locally on macOS 26.5.2.

Repository owner steps before Ready for review

Green PR checks do not prove that upstream signing credentials exist.
A repository owner/admin must complete steps below first:

1. On a Mac, open Keychain Access > Certificate Assistant > Create a Certificate.

2. Create one identity with exact settings:

   • Name: Entropy Open Source Release Signing
   • Identity Type: Self Signed Root
   • Certificate Type: Code Signing
   • Enable Let me override defaults and choose a long validity period.

3. Export certificate and private key together as an encrypted .p12 file.

4. Store .p12 and its password in maintainer-controlled offline backup. Never commit or upload private material as a release artifact.

5. Copy base64-encoded P12 value:

   base64 -i entropy-release-signing.p12 | pbcopy

6. In upstream repository Actions secrets settings, create these repository secrets with exact names:

   • MACOS_CERTIFICATE_P12_BASE64: complete base64 value copied above
   • MACOS_CERTIFICATE_PASSWORD: .p12 export password

7. Confirm secrets are stored in upstream ergohaven/entropy. Secret values cannot be viewed again after saving.

8. Use this same P12 for every release. Key loss or rotation changes app identity and forces users to grant permissions again.

9. Produce two different signed builds with this identity and complete manual TCC test below on Apple Silicon and Intel.

10. Click Ready for review only after both machines retain Accessibility/Input Monitoring without re-adding Entropy.

Manual release gate

Keep PR Draft. Before merge or release:

1. Produce two Entropy app builds with different binaries and same identity.
2. Grant Accessibility/Input Monitoring to first build and verify Universal Symbols.
3. Replace it with second build at /Applications/Entropy.app.
4. Verify Universal Symbols still work without removing or re-adding permissions.
5. Repeat on Apple Silicon and Intel machines.

If TCC still requests permissions, do not ship this path. Fall back to ad-hoc artifacts plus explicit permission-reset UX.

RU

Кратко

https://t.me/c/1464748383/37027/131541

PR использует постоянный self-signed release certificate. Он создаёт одинаковый certificate-anchored designated requirement для разных бинарников и потенциально сохраняет TCC identity без Apple account.

Ограничения: Apple не рекомендует shipping self-signed apps, Gatekeeper продолжит отклонять artifact, приватный ключ нужно хранить как release secret, а реальное сохранение Accessibility/Input Monitoring ещё нужно проверить двумя последовательными builds на Apple Silicon и Intel.

Что должны сделать владельцы репозитория до Ready for review

Зеленые PR checks не подтверждают наличие signing credentials.

Оставшиеся необходимые шаги для создания сертификата подписи:

1. На Mac через Keychain Access создать сертификат Entropy Open Source Release Signing: Self Signed Root, Code Signing, с большим сроком действия.
2. Экспортировать сертификат и приватный ключ вместе в зашифрованный .p12.
3. Сохранить .p12 и пароль в защищенную резервную копию. Не коммитить и не прикладывать эти данные к релизу.
4. Выполнить base64 -i entropy-release-signing.p12 | pbcopy.
5. В upstream Actions secrets settings создать repository secrets:
   • MACOS_CERTIFICATE_P12_BASE64: полный base64 из предыдущего шага
   • MACOS_CERTIFICATE_PASSWORD: пароль экспорта .p12
6. Проверить, что secrets добавлены в ergohaven/entropy, а не только в fork.
7. Использовать тот же P12 для всех релизов. Потеря или rotation ключа потребует повторной выдачи permissions.
8. Собрать два разных signed builds и выполнить TCC test на Apple Silicon и Intel.
9. Нажимать Ready for review только если второй build сохраняет Accessibility/Input Monitoring без повторного добавления Entropy.

До этого PR остается Draft. Bundle-ID-only requirement не используется: это небезопасно для Accessibility grants.

Related: #6
Related: #58