<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Additionally, I was thinking that the binary downloads of ports might be codesigned. That would prevent people from all having to buy a certificate themselves (and self-signed is not really an option, these are generally ignored, maybe not if you mark them as trusted). You can of course also create your own PKI and add its root cert as trusted in your own systems. There are a few avenues here.<div class=""><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><div class="">Gerben Wierda (<a href="https://www.linkedin.com/in/gerbenwierda" class="">LinkedIn</a>)</div><div class=""><a href="https://ea.rna.nl/" class="">R&A IT Strategy</a> (main site)<br class="">Book: <a href="https://ea.rna.nl/the-book/" class="">Chess and the Art of Enterprise Architecture</a><br class="">Book: <a href="https://ea.rna.nl/the-book-edition-iii/" class="">Mastering ArchiMate</a><br class=""></div></div></div></div></div></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 11 Mar 2022, at 15:16, Gerben Wierda via macports-dev <<a href="mailto:macports-dev@lists.macports.org" class="">macports-dev@lists.macports.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">I’ve recently moved from macOS Mojave with MacPorts to macOS Monterey with MacPorts</div><div class=""><br class=""></div><div class="">I’ve had serious trouble with the application level firewall (alf/socketfilterfw). I now suspect that one reason is that Apple is getting stricter and stricter about only allowing binaries that have been code signed. This might play more and more havoc with using open source e,g. via MacPorts.</div><div class=""><br class=""></div><div class="">For instance, at this point, I cannot turn on socketfilterfw because it blocks (in weird ways sometimes) my mail server. Even if I allow a certain binary to run, socketfilterfw will report error like the “-67062’ error, which stands for</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">% security error -67062</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Error: 0xFFFEFA0A -67062 code object is not signed at all</span></div></div><div class=""><br class=""></div><div class="">I’ve seen the socketfilterfw either block or not block in that situation. There is not discernible method. It seems macOS becomes more and more unreliable when faced with unsigned apps, which is something that is the default when using open source installs.</div><div class=""><br class=""></div><div class="">Apple itself signs everything. Even simple command line executables now have an embedded signature:</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">gerben@hermione Downloads % codesign -v -d /bin/echo</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Executable=/bin/echo</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Identifier=com.apple.echo</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Format=Mach-O universal (x86_64 arm64e)</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">CodeDirectory v=20400 size=583 flags=0x0(none) hashes=13+2 location=embedded</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Platform identifier=13</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Signature size=4442</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Signed Time=18 Dec 2021 at 18 December 01:20:02</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Info.plist=not bound</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">TeamIdentifier=not set</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Sealed Resources=none</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Internal requirements count=1 size=64</span></div></div><div class=""><br class=""></div><div class="">There are more and more parts of macOS where the security screws are being tightened more and more and code signing is a key element. </div><div class=""><br class=""></div><div class="">I am therefore wondering if it will become necessary to add code signing to the MacPorts install process, to support it in some way.</div><div class=""><br class=""></div><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><div class="">Gerben Wierda (<a href="https://www.linkedin.com/in/gerbenwierda" class="">LinkedIn</a>)</div><div class=""><a href="https://ea.rna.nl/" class="">R&A IT Strategy</a> (main site)<br class="">Book: <a href="https://ea.rna.nl/the-book/" class="">Chess and the Art of Enterprise Architecture</a><br class="">Book: <a href="https://ea.rna.nl/the-book-edition-iii/" class="">Mastering ArchiMate</a><br class=""></div></div></div></div></div></div></div></div></div>
</div>
<br class=""></div></div></blockquote></div><br class=""></div></body></html>