-1

Today I built a Makefile-based set of command-line sound-synthesis tools in native arm64 for the first time on my M1 Mac Studio running Ventura 13.4 (I've been building them x86-64 for the past month and running via Rosetta). The primary executable plus its private dylib built and linked without error, and ran blazingly fast on the machine. THEN I needed to modify and recompile 2 source files, and when I did, the program stopped working, getting killed immediately. I reverted the source files and rebuilt, but it still died, with the crash log showing:

Exception Type: EXC_CRASH (SIGKILL (Code Signature Invalid)) Exception Codes: 0x0000000000000000, 0x0000000000000000 Termination Reason: CODESIGNING 1 Taskgated Invalid Signature

and the log showing:

default 15:23:35.989553-0700 kernel proc 70090: load code signature error 2 for file "CMIX" default 15:23:35.990396-0700 kernel ASP: Security policy would not allow process: 70090, /opt/local/src/RTcmix.git/bin/CMIX

This program has never been signed in any fashion, and was not when its first version worked. There were NO config changes between the first working build and the remaining failures. A friend runs the same build on an M1 laptop running MacOS 12.6. and does not have this issue.

Did the rebuild trigger some new security system?

nethack
  • 36
  • 1
  • 1
  • 7
  • More information: Rebooting the machine solved the problem -- up until I did another new compile, at which point the problem returned. – nethack Jun 27 '23 at 15:18

1 Answers1

0

I got the definitive answer on the Apple Dev Forum. The issue is described here, and has to do with overwriting existing binaries during updates. From the dev docs:

[Code which attempts to update a binary by simply overwriting] is incorrect because it modifies the command-line tool’s executable file in place. macOS caches information about the code’s signature in the kernel. It doesn’t flush that cache when you modify the file’s contents. Modifying the file in place yields a mismatch between the file’s contents and the in-kernel cache, which can cause a hard-to-reproduce code-signing crash the next time you run the tool. While this code uses a command-line tool to demonstrate the issue, updating any file that contains signed code might trigger this code-signing crash. That includes executables, frameworks, dynamic libraries, and bundles. To update a file that contains signed code without risking this crash, write the updated code to a temporary file and replace the existing file with that temporary one.

https://developer.apple.com/documentation/security/updating_mac_software

I fixed this by using 'ditto' as my INSTALL macro in my Makefiles when configured for MacOS.

nethack
  • 36
  • 1
  • 1
  • 7
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jun 30 '23 at 19:06