Fix aspire-managed macOS signing, permissions, and add CI verification by radical · Pull Request #16053 · microsoft/aspire

radical · 2026-04-11T01:28:01Z

Description

Fixes #16043

Problem

The aspire-managed binary on macOS was broken after signing due to multiple issues:

Missing JIT entitlements — macOS hardened runtime blocks CoreCLR JIT (W^X memory mapping) unless the binary carries com.apple.security.cs.allow-jit and related entitlements. The signed binary would crash on launch with HRESULT: 0x80070008.
Lost execute permissions — MicroBuild signing rewrites the binary file, resetting Unix permissions to the default umask (644). The archives shipped non-executable aspire-managed binaries.

Fix

Add macOS entitlements plist (eng/aspire-managed-entitlements.plist) and ad-hoc codesign with entitlements before MicroBuild signing. MicroBuild preserves entitlements from the prior ad-hoc signature when re-signing with the real certificate. This follows the same pattern used by dotnet/sdk for Roslyn managed binaries.
Restore execute permissions (chmod +x) after MicroBuild signing on macOS/Linux, before CreateLayout packs the binary into the archive.
Broaden non-interactive cert trust skip to both macOS and Windows (Linux trust is non-interactive by nature and can proceed). Remove the injected isWindows function in favor of a simpler OperatingSystem.IsLinux() check.

Validation

New CI verification step: Added verify-cli-archive.sh (Linux/macOS) and verify-cli-archive.ps1 (Windows) scripts that run after signing to validate the archive by extracting it, running aspire --version, and creating a project with aspire new. Wired into build_sign_native.yml (osx-arm64, linux-x64) and BuildAndTest.yml (win-x64).
New unit test: EnsureCertificatesTrustedAsync_NonInteractiveNonWindows_WithNotTrustedCert_SkipsTrustOperation validates the macOS CI cert trust behavior.
Updated existing tests to be platform-aware for the broadened non-interactive cert skip.

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
- No
Does the change make any security assumptions or guarantees?
- Yes — macOS entitlements are required for JIT under hardened runtime
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
- No

github-actions · 2026-04-11T01:29:06Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16053

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16053"

davidfowl · 2026-04-11T01:31:25Z

    IInteractionService interactionService,
    AspireCliTelemetry telemetry,
-    ICliHostEnvironment hostEnvironment,
-    Func<bool>? isWindows = null) : ICertificateService


Why did we undo this?

We want to skip it on macOS too, since it needs GUI interaction there.

this is for mocking though right?

Yes, restored it — renamed to isNonInteractiveTrustSupported (defaults to OperatingSystem.IsLinux) so tests can mock the OS check. The original isWindows was too narrow since we now skip trust on both macOS and Windows in non-interactive mode.

Copilot

Pull request overview

Fixes macOS signing/runtime issues for the aspire-managed bundle payload and hardens CI by adding post-signing archive verification, plus fallback Unix permission handling for Windows-built archives.

Changes:

Add macOS JIT entitlements and an ad-hoc pre-signing step to preserve entitlements through MicroBuild signing; restore execute permissions post-sign.
Add CLI archive verification scripts and wire them into pipelines (Windows + macOS/Linux).
Ensure extracted bundle payload files get correct Unix modes when tar entries don’t carry permissions (notably for Windows-created tar archives), including dcptun_c.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
eng/aspire-managed-entitlements.plist	Adds hardened-runtime entitlements needed for CoreCLR JIT and dylib loading on macOS.
eng/pipelines/templates/build_sign_native.yml	Adds macOS ad-hoc codesign + chmod restore + archive verification for runnable RIDs.
eng/pipelines/templates/BuildAndTest.yml	Adds Windows archive verification step after signing.
eng/scripts/verify-cli-archive.sh	New Linux/macOS verification script that exercises `aspire --version` and `aspire new`.
eng/scripts/verify-cli-archive.ps1	New Windows verification script that exercises `aspire --version` and `aspire new`.
src/Aspire.Cli/Bundles/BundleService.cs	Applies fallback Unix modes on extraction when tar entries lack modes; includes `dcptun_c`.
src/Aspire.Cli/Certificates/CertificateService.cs	Skips interactive trust operations in non-interactive mode on macOS/Windows while allowing Linux to proceed.
tests/Aspire.Cli.Tests/Certificates/CertificateServiceTests.cs	Updates/extends tests for the new non-interactive trust behavior across platforms.
tools/CreateLayout/Program.cs	Sets Unix mode bits for key executables when creating tar archives on Windows.

macOS hardened runtime blocks CoreCLR JIT (W^X memory mapping) unless the binary carries com.apple.security.cs.allow-jit and related entitlements. MicroBuild's MacDeveloperHardenWithNotarization signing preserves entitlements from a prior ad-hoc signature, so we codesign with the entitlements plist before Arcade signing. This follows the same pattern used by dotnet/sdk for Roslyn managed binaries (roslyn-entitlements.plist). Fixes #16043 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

MicroBuild rewrites the binary file during signing, which resets Unix file permissions to the default umask (typically 644). The execute bit must be restored before CreateLayout packs the binary into the CLI archive. Without this, macOS and Linux archives contain a non-executable aspire-managed binary. Fixes #16043 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Previously, CertificateService skipped the certificate trust operation only on Windows in non-interactive mode. On macOS, the trust operation would hang waiting for a Keychain password prompt in CI environments. Broaden the skip to both macOS and Windows in non-interactive mode, but allow Linux trust to proceed since it is non-interactive by nature (update-ca-certificates does not prompt). Remove the injected isWindows function in favor of direct OperatingSystem.IsLinux() check, which is simpler and more correct. Add a new test (EnsureCertificatesTrustedAsync_NonInteractiveNonWindows_ WithNotTrustedCert_SkipsTrustOperation) to validate the macOS CI behavior, and update existing tests to be platform-aware. Fixes #16043 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add verify-cli-archive.sh (Linux/macOS) and verify-cli-archive.ps1 (Windows) scripts that validate a signed CLI archive by: 1. Extracting the archive to a temp location 2. Running 'aspire --version' to verify the binary executes 3. Running 'aspire new aspire-starter' to test bundle self-extraction and project creation (exercises aspire-managed) 4. Cleaning up temp state (backs up and restores ~/.aspire) These scripts will be wired into the CI pipeline to catch signing and permissions regressions before they reach users. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add post-signing verification steps to both build_sign_native.yml (macOS/Linux) and BuildAndTest.yml (Windows) that run the verification scripts after the CLI archives are built and signed. Verification runs for RIDs that can fully execute on the build agent: - macOS (Apple Silicon): osx-arm64 only - Linux (amd64): linux-x64 only - Windows: win-x64 This ensures that signing/permissions regressions (like the ones fixed in this PR) are caught during the official build before release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Restore mockable isNonInteractiveTrustSupported parameter in CertificateService for testability (was Func<bool> isWindows) - Fix cert tests to use explicit mocks instead of OS-dependent assertions - Move backup dir into VERIFY_TMPDIR to avoid orphaned temp dirs - Fix BuildAndTest.yml comment to match actual script behavior Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radical · 2026-04-11T03:13:29Z

Re: build_sign_native.yml comment about macOS/Linux

The comment is actually correct — codeSign is not macOS-only. The condition ne(parameters.agentOs, 'windows') runs on any non-Windows agent (macOS and Linux). Keeping the comment as-is.

radical · 2026-04-11T03:17:10Z

Internal validation build triggered: https://dev.azure.com/dnceng/internal/_build/results?buildId=2948628

radical · 2026-04-11T03:47:42Z

/create-issue

github-actions · 2026-04-11T03:49:12Z

Failed tests found on this PR:

/create-issue Aspire.Hosting.Tests.Backchannel.Exec.ContainerResourceExecTests.Exec_NginxContainer_ListFiles_ProducesLogs_Success

📋 /create-issue — Usage

Creates or updates a failing-test issue from CI failures.

/create-issue <test-name>
/create-issue <test-name> <pr|run|job-url>
/create-issue --test "<test-name>"
/create-issue --test "<test-name>" --url <pr|run|job-url>
/create-issue --test "<test-name>" --force-new

radical · 2026-04-11T03:54:19Z

/create-issue Aspire.Hosting.Tests.Backchannel.Exec.ContainerResourceExecTests.Exec_NginxContainer_ListFiles_ProducesLogs_Success

github-actions · 2026-04-11T03:56:14Z

✅ Created failing-test issue #16054: #16054

To disable this test on your PR, comment:

/disable-test Aspire.Hosting.Tests.Backchannel.Exec.ContainerResourceExecTests.Exec_NginxContainer_ListFiles_ProducesLogs_Success https://github.com/microsoft/aspire/issues/16054

github-actions · 2026-04-11T05:01:18Z

🎬 CLI E2E Test Recordings — 58 recordings uploaded (commit 930c75c)

View recordings

Test	Recording
AddPackageInteractiveWhileAppHostRunningDetached	▶️ View Recording
AddPackageWhileAppHostRunningDetached	▶️ View Recording
AgentCommands_AllHelpOutputs_AreCorrect	▶️ View Recording
AgentInitCommand_DefaultSelection_InstallsSkillOnly	▶️ View Recording
AgentInitCommand_MigratesDeprecatedConfig	▶️ View Recording
AllPublishMethodsBuildDockerImages	▶️ View Recording
AspireAddPackageVersionToDirectoryPackagesProps	▶️ View Recording
AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	▶️ View Recording
Banner_DisplayedOnFirstRun	▶️ View Recording
Banner_DisplayedWithExplicitFlag	▶️ View Recording
Banner_NotDisplayedWithNoLogoFlag	▶️ View Recording
CertificatesClean_RemovesCertificates	▶️ View Recording
CertificatesTrust_WithNoCert_CreatesAndTrustsCertificate	▶️ View Recording
CertificatesTrust_WithUntrustedCert_TrustsCertificate	▶️ View Recording
ConfigSetGet_CreatesNestedJsonFormat	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunAspireStarterProjectWithBundle	▶️ View Recording
CreateAndRunEmptyAppHostProject	▶️ View Recording
CreateAndRunJavaEmptyAppHostProject	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateAndRunTypeScriptEmptyAppHostProject	▶️ View Recording
CreateAndRunTypeScriptStarterProject	▶️ View Recording
CreateJavaAppHostWithViteApp	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DashboardRunWithOtelTracesReturnsNoTraces	▶️ View Recording
DescribeCommandResolvesReplicaNames	▶️ View Recording
DescribeCommandShowsRunningResources	▶️ View Recording
DetachFormatJsonProducesValidJson	▶️ View Recording
DoctorCommand_DetectsDeprecatedAgentConfig	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
GlobalMigration_HandlesCommentsAndTrailingCommas	▶️ View Recording
GlobalMigration_HandlesMalformedLegacyJson	▶️ View Recording
GlobalMigration_PreservesAllValueTypes	▶️ View Recording
GlobalMigration_SkipsWhenNewConfigExists	▶️ View Recording
GlobalSettings_MigratedFromLegacyFormat	▶️ View Recording
InitTypeScriptAppHost_AugmentsExistingViteRepoAtRoot	▶️ View Recording
InvalidAppHostPathWithComments_IsHealedOnRun	▶️ View Recording
LegacySettingsMigration_AdjustsRelativeAppHostPath	▶️ View Recording
LogsCommandShowsResourceLogs	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording
PsFormatJsonOutputsOnlyJsonToStdout	▶️ View Recording
PublishWithDockerComposeServiceCallbackSucceeds	▶️ View Recording
RestoreGeneratesSdkFiles	▶️ View Recording
RestoreSupportsConfigOnlyHelperPackageAndCrossPackageTypes	▶️ View Recording
RunFromParentDirectory_UsesExistingConfigNearAppHost	▶️ View Recording
SecretCrudOnDotNetAppHost	▶️ View Recording
SecretCrudOnTypeScriptAppHost	▶️ View Recording
StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	▶️ View Recording
StartAndWaitForTypeScriptSqlServerAppHostWithNativeAssets	▶️ View Recording
StopAllAppHostsFromAppHostDirectory	▶️ View Recording
StopAllAppHostsFromUnrelatedDirectory	▶️ View Recording
StopNonInteractiveMultipleAppHostsShowsError	▶️ View Recording
StopNonInteractiveSingleAppHost	▶️ View Recording
StopWithNoRunningAppHostExitsSuccessfully	▶️ View Recording
UnAwaitedChainsCompileWithAutoResolvePromises	▶️ View Recording

_{📹 Recordings uploaded automatically from CI run #24273345519}

davidfowl

Tests and it works.

joperezr · 2026-04-15T18:18:07Z

/backport to release/13.2

github-actions · 2026-04-15T18:26:02Z

Started backporting to release/13.2 (link to workflow run)

aspire-repo-bot · 2026-04-15T18:26:14Z

@joperezr backporting to release/13.2 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Add macOS JIT entitlements and ad-hoc codesign step for aspire-managed
Using index info to reconstruct a base tree...
M	eng/pipelines/templates/build_sign_native.yml
Falling back to patching base and 3-way merge...
Auto-merging eng/pipelines/templates/build_sign_native.yml
CONFLICT (content): Merge conflict in eng/pipelines/templates/build_sign_native.yml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Add macOS JIT entitlements and ad-hoc codesign step for aspire-managed
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

…rt trust, and CI verification (#16215) * Add macOS JIT entitlements and ad-hoc codesign step for aspire-managed macOS hardened runtime blocks CoreCLR JIT (W^X memory mapping) unless the binary carries com.apple.security.cs.allow-jit and related entitlements. MicroBuild's MacDeveloperHardenWithNotarization signing preserves entitlements from a prior ad-hoc signature, so we codesign with the entitlements plist before Arcade signing. This follows the same pattern used by dotnet/sdk for Roslyn managed binaries (roslyn-entitlements.plist). Fixes #16043 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Restore execute permissions on aspire-managed after MicroBuild signing MicroBuild rewrites the binary file during signing, which resets Unix file permissions to the default umask (typically 644). The execute bit must be restored before CreateLayout packs the binary into the CLI archive. Without this, macOS and Linux archives contain a non-executable aspire-managed binary. Fixes #16043 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Narrow non-interactive cert trust skip to macOS and Windows only Backport of fbdac8a with conflict resolution: - Added EnsureHttpCertificateExists() to ICertificateToolRunner and NativeCertificateToolRunner - Added ICliHostEnvironment parameter to CertificateService constructor - Updated CliTestHelper default CertificateServiceFactory to pass ICliHostEnvironment - Added IsSuccessfulEnsureResult helper method - Added TestCliHostEnvironment and new non-interactive test cases Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Add CLI archive verification scripts Add verify-cli-archive.sh (Linux/macOS) and verify-cli-archive.ps1 (Windows) scripts that validate a signed CLI archive by: 1. Extracting the archive to a temp location 2. Running 'aspire --version' to verify the binary executes 3. Running 'aspire new aspire-starter' to test bundle self-extraction and project creation (exercises aspire-managed) 4. Cleaning up temp state (backs up and restores ~/.aspire) These scripts will be wired into the CI pipeline to catch signing and permissions regressions before they reach users. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Wire CLI archive verification into CI pipelines Add post-signing verification steps to both build_sign_native.yml (macOS/Linux) and BuildAndTest.yml (Windows) that run the verification scripts after the CLI archives are built and signed. Verification runs for RIDs that can fully execute on the build agent: - macOS (Apple Silicon): osx-arm64 only - Linux (amd64): linux-x64 only - Windows: win-x64 This ensures that signing/permissions regressions (like the ones fixed in this PR) are caught during the official build before release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Address PR feedback: restore testability and fix scripts - Restore mockable isNonInteractiveTrustSupported parameter in CertificateService for testability (was Func<bool> isWindows) - Fix cert tests to use explicit mocks instead of OS-dependent assertions - Move backup dir into VERIFY_TMPDIR to avoid orphaned temp dirs - Fix BuildAndTest.yml comment to match actual script behavior Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Add EnsureHttpCertificateExists to shared TestCertificateToolRunner The TestCertificateToolRunner in TestServices/ also needs to implement the EnsureHttpCertificateExists method added to ICertificateToolRunner as part of the backport. Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> * Remove non-entitlement changes from backport Keep only macOS entitlements plist and build_sign_native.yml signing changes. Remove CI verification scripts, cert trust changes, and related test updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add CI verification scripts for signed CLI archives Restore BuildAndTest.yml wiring and verify-cli-archive scripts to validate signed archives work correctly after signing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Ankit Jain <radical@gmail.com> Co-authored-by: joperezr <13854455+joperezr@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Jose Perez Rodriguez <joperezr@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radical requested review from JamesNK, davidfowl and mitchdenny as code owners April 11, 2026 01:28

Copilot AI review requested due to automatic review settings April 11, 2026 01:28

davidfowl reviewed Apr 11, 2026

View reviewed changes

Copilot started reviewing on behalf of radical April 11, 2026 01:32 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread eng/scripts/verify-cli-archive.sh Outdated

Comment thread eng/pipelines/templates/BuildAndTest.yml Outdated

Comment thread eng/pipelines/templates/build_sign_native.yml

Comment thread tests/Aspire.Cli.Tests/Certificates/CertificateServiceTests.cs

radical and others added 5 commits April 10, 2026 22:58

radical force-pushed the fix-macos-aspire-managed branch from 60a6227 to 720df97 Compare April 11, 2026 03:00

radical changed the title ~~Fix aspire-managed macOS signing, permissions, and cert trust~~ Fix aspire-managed macOS signing, permissions, and add CI verification Apr 11, 2026

radical requested a review from joperezr April 11, 2026 03:16

radical requested a review from davidfowl April 11, 2026 03:21

github-actions Bot mentioned this pull request Apr 11, 2026

[pull requests] Review required #13834

Closed

davidfowl approved these changes Apr 11, 2026

View reviewed changes

radical merged commit ca405f9 into main Apr 11, 2026
532 of 535 checks passed

radical deleted the fix-macos-aspire-managed branch April 11, 2026 05:11

joperezr added this to the 13.3 milestone Apr 14, 2026

Copilot AI mentioned this pull request Apr 15, 2026

[release/13.2] Backport PR #16053: Fix macOS signing, permissions, cert trust, and CI verification #16215

Merged

16 tasks

github-actions Bot locked and limited conversation to collaborators May 16, 2026

Conversation

radical commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Problem

Fix

Validation

Checklist

Uh oh!

github-actions Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

davidfowl Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

radical Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

davidfowl Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

radical Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

radical commented Apr 11, 2026

Uh oh!

radical commented Apr 11, 2026

Uh oh!

radical commented Apr 11, 2026

Uh oh!

github-actions Bot commented Apr 11, 2026

Uh oh!

radical commented Apr 11, 2026

Uh oh!

github-actions Bot commented Apr 11, 2026

Uh oh!

github-actions Bot commented Apr 11, 2026

Uh oh!

davidfowl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

joperezr commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

aspire-repo-bot Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

radical commented Apr 11, 2026 •

edited

Loading

github-actions Bot commented Apr 11, 2026 •

edited

Loading