kcov formula: The next version will require codesigning with the Debugging Tool Entitlement

[SimonKagstrom]

Output of brew config

HOMEBREW_VERSION: 4.0.26
ORIGIN: https://github.com/Homebrew/brew
HEAD: eff45ef570f265e226f14ce91da72d7a6e7d516a
Last commit: 7 weeks ago
Core tap origin: https://github.com/Homebrew/homebrew-core
Core tap HEAD: c18a35db1a25be4c080c81cde6cdf6617392da1f
Core tap last commit: 5 months ago
Core tap branch: master
Core tap JSON: 01 Jul 09:22 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.l7QAcp9s4S/org.macosforge.xquartz:0
HOMEBREW_MAKE_JOBS: 4
Homebrew Ruby: 2.6.10 => /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/2.6.10_1/bin/ruby
CPU: quad-core 64-bit haswell
Clang: 14.0.3 build 1403
Git: 2.41.0 => /usr/local/bin/git
Curl: 7.88.1 => /usr/bin/curl
macOS: 13.4.1-x86_64
CLT: 12.5.0.22.9
Xcode: 14.3.1

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Your Command Line Tools are too outdated.
Update them from Software Update in System Settings.

If that doesn't show you any updates, run:
  sudo rm -rf /Library/Developer/CommandLineTools
  sudo xcode-select --install

Alternatively, manually download them from:
  https://developer.apple.com/download/all/.
You should download the Command Line Tools for Xcode 14.3.


Warning: A newer Command Line Tools release is available.
Update them from Software Update in System Settings.

If that doesn't show you any updates, run:
  sudo rm -rf /Library/Developer/CommandLineTools
  sudo xcode-select --install

Alternatively, manually download them from:
  https://developer.apple.com/download/all/.
You should download the Command Line Tools for Xcode 14.3.


Warning: Some installed kegs have no formulae!
This means they were either deleted or installed manually.
You should find replacements for the following formulae:
  python@2

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  ilmbase
  [email protected]

Warning: You have the following deprecated, official taps tapped:
  Homebrew/homebrew-cask-drivers
Untap them with `brew untap`.

Warning: The following directories do not exist:
/usr/local/sbin

You should create these directories and change their ownership to your user.
  sudo mkdir -p /usr/local/sbin
  sudo chown -R $(whoami) /usr/local/sbin

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  docker
  python@2
  conan
  six
  unbound
  dict
  wireshark

Warning: You have an unnecessary local Cask tap.
This can cause problems installing up-to-date casks.
Please remove it by running:
  brew untap homebrew/cask

Warning: You have an unnecessary local Core tap!
This can cause problems installing up-to-date formulae.
Please remove it by running:
 brew untap homebrew/core
Warning: Formula sdl was renamed to sdl12-compat.

Description of issue

I'm the upstream author of kcov, and have been working on improving the performance of it on Macos for a while. kcov currently uses the LLDB debugger API to set breakpoints to collect coverage information, but since this makes it extremely slow I've written a "raw" implementation which uses the Mach APIs directly to set breakpoints (plus some other things which are less relevant here).

However, this means that the next version of kcov will need to have the com.apple.security.cs.debugger entitlement set to run as non-root. When building it myself I can codesign with my own certificate/identity I created with Xcode, but how will this work with homebrew, which is where most people will get kcov from?

[carlocab]

Does it work with an ad-hoc signature? If it does we could try doing that in post_install. Or show caveats explaining to users that they need to codesign kcov or run it as root.

[SimonKagstrom]

Ah, yes it does!

I just tried

ninja && codesign -s - --entitlements ~/projects/kcov/osx-entitlements.xml -f ./src/kcov

and now have a binary which is able to debug. Thanks!

[SimonKagstrom]

Edit: Actually, when trying it on another machine, where I don't have a certificate/identity, it doesn't seem to work after all (apart from when running as root). Not sure why it works on my regular machine, but perhaps because I've signed it before?

[SimonKagstrom]

I suspect one has to go through the same steps as for gdb, i.e., https://sourceware.org/gdb/wiki/PermissionsDarwin#Sign_and_entitle_the_gdb_binary

Another difference between my machine and the other is that my is an x86 and the other an M1, although both run Ventura.

[alebcay]

This may be something you can add in the build process (for kcov itself) to apply the entitlement when building on Darwin. We already carry some software that requires entitlements and the upstream build process handles this for us.

One example is qemu, which uses Meson for building. They have a script to apply entitlements which might be helpful to refer to.

[SimonKagstrom]

Thanks, I've added a codesigning step to the build process, which uses an ad hoc signature.

However, this seems to work on my own older machine, but not the M1. For now I think I'll just add a printout with some instructions if task_for_pid fails, that the binary then has to be signed manually.

[alebcay]

I do wonder how qemu works around this, since as far as I know users on M1/M2 don't need to take any additional steps to sign the binary in that case (they need com.apple.security.hypervisor) in order to use it.

[SimonKagstrom]

I'll try next week to actually use a proper identity to sign on the M1, I might have done some mistake. I don't see either why it would be different on my machine.

If it doesn't work, I'll add a printout like this,

kcov: error: task_for_pid failed with 5

This usually means that the kcov binary needs to be signed with codesign, when
not running as root. See https://github.com/SimonKagstrom/kcov/blob/master/INSTALL.md
for instructions on how to do that.

Then run

  codesign -s "Apple Development: [email protected] (XXXXXXXXX)" --entitlements <kcov-source>/osx-entitlements.xml -f /Users/ska/projects/build/kcov-release/src/kcov

For users to resolve it for themselves. The only caveat for homebrew is then that the entitlements file exists in the source directory for kcov, but perhaps the formula can copy it to /usr/local/share or something like that?

[SimonKagstrom]

I think I now know why it didn't work on the M1 before. I logged in via ssh to the terminal (being old-fashioned, and this is a terminal app after all..) and ran it. But when I instead use VNC to login, I get a popup with "Developer tools access is trying to take control of another process", which I have to acknowledge with my password.

Only once per login though, and since I can't do that via raw SSH it explains why it didn't work before.

So anyway, homebrew should be safe enough, although it means kcov will only be usable in a graphical session as non-root.