Repository navigation
SHARD-214: embed the shim in the daemon and ad-hoc sign it at first use - #178
Merged
Merged
Conversation
presmihaylov
commented
Sep 19, 2026
presmihaylov
commented
Sep 19, 2026
presmihaylov
commented
Sep 19, 2026
presmihaylov
force-pushed
the
shard-214-shim-signing
branch
from
September 19, 2026 13:59
eb6cda6 to
f29733e
Compare
presmihaylov
force-pushed
the
shard-214-shim-signing
branch
from
September 19, 2026 14:10
88a3051 to
114241d
Compare
presmihaylov
commented
Sep 19, 2026
presmihaylov
commented
Sep 19, 2026
presmihaylov
commented
Sep 19, 2026
presmihaylov
force-pushed
the
shard-213-vz-driver
branch
from
September 19, 2026 18:07
0ba3f75 to
d667a40
Compare
presmihaylov
force-pushed
the
shard-214-shim-signing
branch
from
September 19, 2026 18:07
3fae012 to
d409cbe
Compare
presmihaylov
force-pushed
the
shard-213-vz-driver
branch
from
September 19, 2026 18:16
d667a40 to
e3c7b27
Compare
presmihaylov
force-pushed
the
shard-214-shim-signing
branch
from
September 19, 2026 18:16
d409cbe to
2a0bf53
Compare
The daemon embeds shard-vz-shim and its entitlements, writes the shim into the shard root on first use, and signs it there with codesign --sign -. Only the shim carries com.apple.security.virtualization; the daemon and the CLI keep the Go linker's plain ad-hoc signature. make build-darwin builds and signs the shim, then the Mac daemon that embeds it. docs/macos-signing.md says what an ad-hoc signature can and cannot do, what a Developer ID adds, and what an MDM block looks like.
…mon, and make the install race-free The shim imports pkg/vz, so an embed there made every build carry the previous one and no two builds hashed the same. pkg/vzshim holds the asset and only the daemon links it. Install signs a temporary copy of its own and publishes it by rename, so sixteen first-use callers leave one signed shim and no debris.
…eps it, and prove it at the binary level
…one-line comments, and the install wiring is named as SHARD-218's
presmihaylov
force-pushed
the
shard-214-shim-signing
branch
from
September 19, 2026 18:29
2a0bf53 to
f421e2a
Compare
…request The kernel job compiles Linux twice per arch, 13 minutes, and ran on every PR that touched the Makefile. The kernel changes rarely and the manual release run already proves reproducibility.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SHARD-214. Fifth of the M10 stack, stacked on #177.
Why. Virtualization.framework refuses a VM to a process without the
com.apple.security.virtualizationentitlement, which needs a signature. Only the shim carries it.How.
pkg/vzshim/vzshim.go: its own package, because the shim importspkg/vzand an embed there would carry its previous build. Without the binary the build still compiles andErrNoShimnames the fix.versionverb referencesvzshim.Embedded(); a test checks the built daemon withgo tool nm.Installwrites a temp file, signs, renames, then stamps a.sha256of the embedded bytes, since codesign rewrites the file.codesignis enough; no Xcode.Installbefore its first boot in SHARD-218; here thepkg/vzboot test is the caller.What.
make build-darwin,pkg/vzshim,docs/macos-signing.mdwith thecodesign -d --entitlementsoutput.