Skip to content
This repository has been archived by the owner on Feb 8, 2024. It is now read-only.

Connect: Set up entitlements and provisioning profile #1033

Closed
wants to merge 10 commits into from
Closed

Connect: Set up entitlements and provisioning profile #1033

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
0eb18a7
Update CFBundleIdentifier to match App ID & prov profile
ravicious Jul 26, 2022
4ff4857
Make LSMinimumSystemVersion match tsh.app
ravicious Jul 26, 2022
db38a6a
Add keychain-access-groups to entitlements
ravicious Jul 26, 2022
55e6a4a
Add provisioning profile
ravicious Jul 26, 2022
cbf3ad2
Update com.apple.application-identifier
ravicious Jul 27, 2022
322dff8
Update comment in entitlements
ravicious Jul 27, 2022
46d9dea
Merge branch 'master' into ravicious/provisioning-profile
ravicious Jul 29, 2022
a635a97
Add Team ID to appID on macOS
ravicious Jul 29, 2022
0e52a80
Remove allow-unsigned-executable-memory from entitlements
ravicious Aug 4, 2022
36feb9a
Add entitlements-inherit.mac.plist
ravicious Aug 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added packages/teleterm/assets/connect.provisionprofile
View file
Open in desktop
Binary file not shown.
8 changes: 8 additions & 0 deletions packages/teleterm/assets/entitlements-inherit.mac.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.inherit</key>
<true/>
</dict>
</plist>
13 changes: 11 additions & 2 deletions packages/teleterm/assets/entitlements.mac.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,18 @@
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
<true/>

<!-- com.apple.developer.team-identifier and keychain-access-groups must match those in tsh.app
so that Connect has access to the same Secure Enclave keys as tsh.app. -->
<key>com.apple.developer.team-identifier</key>
<string>QH8AA5B8UP</string>
<key>com.apple.application-identifier</key>
<string>QH8AA5B8UP.com.gravitational.teleport.connect</string>
<key>keychain-access-groups</key>
<array>
<string>QH8AA5B8UP.com.gravitational.teleport.tsh</string>
</array>
</dict>
</plist>
7 changes: 5 additions & 2 deletions packages/teleterm/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,19 +57,22 @@
},
"productName": "Teleport Connect",
"build": {
"appId": "gravitational.teleport.connect",
"appId": "com.gravitational.teleport.connect",
ravicious marked this conversation as resolved.
Show resolved Hide resolved
ravicious marked this conversation as resolved.
Show resolved Hide resolved
"asar": true,
"asarUnpack": "**\\*.{node,dll}",
"afterSign": "notarize.js",
"files": [
"build/app/dist"
],
"mac": {
"appId": "QH8AA5B8UP.com.gravitational.teleport.connect",
"target": "dmg",
"type": "distribution",
"hardenedRuntime": true,
"entitlements": "assets/entitlements.mac.plist",
"entitlementsInherit": "assets/entitlements.mac.plist",
"entitlementsInherit": "assets/entitlements-inherit.mac.plist",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tried it without letting the other processes inherit the entitlements? Ideally we don't the permissions to propagate to binaries other than tsh.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I haven't but that's a good point. Matter of fact, we need only the tsh process to have access to those keychain-access-groups as for now it'd be the only process interacting with Touch ID.

I believe the Electron child processes need to have com.apple.security.cs.allow-jit set to true and guessing from the errors that I've seen, all child processes must have at least com.apple.developer.team-identifier set to the same value as the main process.

I'll see what I can do here.

"provisioningProfile": "assets/connect.provisionprofile",
"minimumSystemVersion": "10.12.0",
"gatekeeperAssess": false,
"extraResources": [
{
Expand Down