Skip to content

Update ad-hoc signing in HostModel to only hash the __TEXT segment #121825

New issue
New issue
Open
#121826
Open
Update ad-hoc signing in HostModel to only hash the __TEXT segment#121825
#121826
Assignees
copilot-swe-agent
Labels
area-HostModelMicrosoft.NET.HostModel issues
Milestone
11.0.0
@elinor-fung

Description

@elinor-fung
elinor-fung
opened on Nov 19, 2025

It looks like the new behavior of codesign is to only hash the __TEXT segment, whereas it used to hash the entire file. It looks like this doesn't affect whether or not Mac allows the file to be run. We could disable the test to get this in and file an issue for the fix. It may be simple enough for copilot.

Originally posted by @jtschuster in #121373 (comment)

The MatchesCodesignOutput test was temporarily disabled due a change in the behaviour of codesign in macOS 26.

runtime/src/installer/tests/Microsoft.NET.HostModel.Tests/MachObjectSigning/SigningTests.cs

Lines 80 to 83 in e40a978

[Theory(Skip = "Temporarily disabled due to macOS 26 codesign behavior change - only hashing __TEXT segment")]
[MemberData(nameof(GetTestFilePaths), nameof(MatchesCodesignOutput))]
[PlatformSpecific(TestPlatforms.OSX)]
void MatchesCodesignOutput(string filePath, TestArtifact _)

We should update the ad-hoc signing in HostModel to account for this new behaviour and re-enable the tests. The end result should work on both macOS 26 and macOS 15.

Metadata

Metadata

Assignees

Labels

area-HostModelMicrosoft.NET.HostModel issues

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions