Ad-hoc re-sign bootstrap dotnet on macOS to prevent SIGKILL#13513
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a macOS-specific mitigation to the bootstrap build so the downloaded/copied bootstrap dotnet doesn’t get immediately terminated by Gatekeeper (SIGKILL / exit code 137), which otherwise breaks tests that shell out to the bootstrap dotnet (e.g., RoslynCodeTaskFactory scenarios).
Changes:
- Add a macOS-only
codesign --force --sign -step at the end of theBootstrapNetCoretarget. - Document the rationale inline in
BootStrapMsBuild.targetsto clarify the Gatekeeper/SIGKILL behavior.
Contributor
Author
|
I'm not 100% sure how this is not failing the unit tests in CI for Mac, maybe it is configured more loosely 🤔 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Expert Review — 24-Dimension Analysis
PR #13513: Ad-hoc re-sign bootstrap dotnet on macOS to prevent SIGKILL
Clean, well-scoped fix for a real macOS developer pain point. All 24 review dimensions pass.
Summary Table
| # | Dimension | Verdict | Notes |
|---|---|---|---|
| 1 | Backwards Compatibility | ✅ LGTM | Build infra only; no user-facing change |
| 2 | ChangeWave Discipline | ✅ LGTM | Not needed — no behavior change |
| 3 | Performance & Allocation Awareness | ✅ LGTM | Single sub-second codesign call |
| 4 | Test Coverage & Completeness | ✅ LGTM | Validated by bootstrap usage; manual testing documented |
| 5 | Error Message Quality | ✅ LGTM | Exec propagates codesign errors naturally |
| 6 | Logging & Diagnostics | ✅ LGTM | Exec task auto-logs to binlog |
| 7 | String Comparison Correctness | ✅ N/A | No string comparisons |
| 8 | API Surface Discipline | ✅ N/A | No API changes |
| 9 | Target Authoring Quality | ✅ LGTM | Correctly placed after all Copy steps |
| 10 | Cross-Platform Correctness | ✅ LGTM | IsOSPlatform('osx') correct; \ normalized to / on macOS; " handles spaces; Windows/Linux unaffected |
| 11 | Code Simplification | ✅ LGTM | Minimal, clean 4-line addition |
| 12 | Concurrency Safety | ✅ LGTM | Sequential within target; no shared state |
| 13 | Naming & Clarity | ✅ LGTM | Comment explains why (Gatekeeper + exit code 137) |
| 14 | SDK Integration Boundary | ✅ LGTM | Properly scoped to bootstrap infrastructure |
| 15 | Evaluation Model Integrity | ✅ N/A | Not evaluation code |
| 16 | Correctness & Edge Cases | ✅ LGTM | DependsOnTargets="AcquireSdk" guarantees binary exists; --force makes it idempotent; Exec fails build on error (correct) |
| 17 | Dependency Management | ✅ LGTM | codesign is a macOS system binary; no new deps |
| 18 | Security & Trust | ✅ LGTM | Ad-hoc signing is canonical for local dev; InstallDir is a local property not injectable externally; --force needed to replace the now-invalid original sig |
| 19 | Build Infrastructure Care | ✅ LGTM | End-of-target placement correct; sub-second overhead; no CI regression |
| 20 | Documentation Accuracy | ✅ LGTM | Inline comment is accurate and actionable |
| 21 | Binary Log Completeness | ✅ LGTM | Exec task events captured automatically |
| 22 | Scope Discipline | ✅ LGTM | Single concern, minimal diff, well-documented |
| 23 | Design Before Implementation | ✅ LGTM | Ad-hoc re-signing is the standard macOS solution |
| 24 | Ecosystem Impact | ✅ LGTM | Only affects local dev/test builds on macOS |
Key Validations
- Path correctness:
$(InstallDir)has trailing\→ MSBuild normalizes to/on macOS →codesignreceives valid POSIX path with"..."quoting. - Idempotency:
--forceallows repeated runs without error. - Fail-fast:
Execdefaults toIgnoreExitCode="false", so a codesign failure immediately surfaces rather than causing a confusing downstream SIGKILL. - No regressions: Windows/Linux gated out by
IsOSPlatform('osx'). TheBootstrapFulltarget (Windows-only) is unaffected.
Verdict: APPROVE — All 24 dimensions clean. No blocking issues, no suggestions.
Generated by Expert Code Review (on open) for issue #13513 · ● 4.5M
ViktorHofer
approved these changes
Apr 9, 2026
Member
|
Does |
Contributor
Author
|
@ViktorHofer it doesn't, it should be designed to run as a regular user. |
Member
|
@jankratochvilcz please merge with squash next time |
This was referenced Jun 10, 2026
This was referenced Jun 26, 2026
github-actions Bot
pushed a commit
to IntelliTect/Multitool
that referenced
this pull request
Jun 29, 2026
Updated [Microsoft.Build](https://github.com/dotnet/msbuild) from 18.6.3 to 18.7.1. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Build's releases](https://github.com/dotnet/msbuild/releases)._ ## 18.7.1 ## What's Changed * Fix TraceEngine file contention deadlock in multithreaded mode by @JanProvaznik in dotnet/msbuild#13446 * Remove duplicate test cases in MultithreadableTaskAnalyzer by @Youssef1313 in dotnet/msbuild#13483 * Ensure ThreadSafeTaskAnalyzer.Tests is considered as a unit test project by @Youssef1313 in dotnet/msbuild#13481 * Fix MSBuildTask0002 analyzer warnings in already-migrated tasks by @JanProvaznik in dotnet/msbuild#13466 * Fix race conditions in task host path resolution by @AR-May in dotnet/msbuild#13485 * Migrate ToolTask and Al task to TaskEnvironment API by @OvesN in dotnet/msbuild#13423 * Bump main to 18.7, add vs18.6 to merge flow by @MichalPavlik in dotnet/msbuild#13472 * Avoid allocations in GetHashCode implementations by @DustinCampbell in dotnet/msbuild#13475 * Add PATs rotation to agentic workflow(s) by @JanKrivanek in dotnet/msbuild#13496 * Fix ASP.NET WebSite projects to copy netstandard.dll facade when required by @JanProvaznik in dotnet/msbuild#13058 * Migrate AspNetCompiler to TaskEnvironment API by @OvesN in dotnet/msbuild#13424 * Add review workflow by @JanKrivanek in dotnet/msbuild#13503 * Strengthen reviewer skill: add step-back analysis dimensions by @JanProvaznik in dotnet/msbuild#13504 * Add 'Request Speedometer Perf Run' to VS experimental insertion build policies by @Copilot in dotnet/msbuild#13505 * Remove duplicate @ prefix from issueAuthor in GitOps by @akoeplinger in dotnet/msbuild#13492 * Improve review aw by @JanKrivanek in dotnet/msbuild#13510 * Migrates unit tests to use RoslynCodeTaskFactory to enable running tests under .NET Core by @jankratochvilcz in dotnet/msbuild#13500 * Fix cross-AppDomain TaskItem modifier cache regression by @DustinCampbell in dotnet/msbuild#13493 * Discourage review agent from approving PRs by @JanKrivanek in dotnet/msbuild#13512 * Stop trying to deploy ValueTuple by @rainersigwald in dotnet/msbuild#13507 * Ad-hoc re-sign bootstrap dotnet on macOS to prevent SIGKILL by @jankratochvilcz in dotnet/msbuild#13513 * RoslynCodeTaskFactory: Log MSB3753 when task class does not implement ITask by @jankratochvilcz in dotnet/msbuild#13517 * Update gh-aw (upon mcp policy changes) by @JanKrivanek in dotnet/msbuild#13526 * Eliminate XmlChildNodes allocations in GetXmlNodeInnerContents by @nareshjo in dotnet/msbuild#13509 * Fix telemetry allocation regression: per-engine collector ownership by @JanProvaznik in dotnet/msbuild#13516 * Migrate to xunit.v3 by @Youssef1313 in dotnet/msbuild#13482 * Fix stray brace in HandleBuildCancel trace string causing MSB1025 by @Copilot in dotnet/msbuild#13535 * Bumping to 10.0.4 runtime packages by @MichalPavlik in dotnet/msbuild#13533 * Remove early return in GetCanonicalForm, always call System.IO.Path by @OvesN in dotnet/msbuild#13532 * Do not overwrite GetCopyToOutputDirectoryItemsDependsOn, just add new… by @snechaev in dotnet/msbuild#13474 * Migrate GetReferenceAssemblyPaths task to TaskEnvironment API by @OvesN in dotnet/msbuild#13495 * Stabilize ToolTaskThatTimeoutAndRetry test by @rainersigwald in dotnet/msbuild#13489 * [automated] Merge branch 'vs18.6' => 'main' by @github-actions[bot] in dotnet/msbuild#13506 * Add extra test assertions around tests by @Youssef1313 in dotnet/msbuild#13536 * Add static eval for repo skills/agents via skill-validator by @JanKrivanek in dotnet/msbuild#13537 * Migrate SGen task to Task environment API by @OvesN in dotnet/msbuild#13457 * Fix TerminalLogger assert failure for metaproj files and cached project eval ID by @OvesN in dotnet/msbuild#13480 * Filter out approving review from pr-reviewer agent by @JanKrivanek in dotnet/msbuild#13553 * Use a unique task name per invocation to tabilize RoslynCodeTaskFactory_ReuseCompilation test by @huulinhnguyen-dev in dotnet/msbuild#13551 * Brief doc on feedback/logging/data systems by @rainersigwald in dotnet/msbuild#13554 * Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 13881982 by @dotnet-bot in dotnet/msbuild#13437 * Stage 3: Forward BuildProjectFile* callbacks from OOP TaskHost to worker node by @JanProvaznik in dotnet/msbuild#13350 * Enable TaskHost Callbacks by default by @JanProvaznik in dotnet/msbuild#13579 * Remove unactionable info from reviewer agent by @JanKrivanek in dotnet/msbuild#13578 * Enlighten RequiresFramework35SP1Assembly task for multithreaded mode by @jankratochvilcz in dotnet/msbuild#13575 * Make SdkResolver-provided environment variables take precedence over ambient environment by @Copilot in dotnet/msbuild#12655 * Add dotnet/skills marketplace and enable plugins by @Evangelink in dotnet/msbuild#13582 * The skills/agents check filters-in only touched files by @JanKrivanek in dotnet/msbuild#13586 * Fix skill-validation workflow failing when agents directory is deleted by @JeremyKuhne in dotnet/msbuild#13592 ... (truncated) Commits viewable in [compare view](dotnet/msbuild@v18.6.3...v18.7.1). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Jun 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
I found this because on my Mac some unit tests are failing, namely RoslynCodeTaskFactory_Tests.
On macOS, the bootstrap
dotnetbinary atartifacts/bin/bootstrap/core/dotnetis frequently killed by Gatekeeper with SIGKILL (exit code 137) immediately upon execution. This happens because thedotnet-install.shscript downloads and copies the apphost binary into the bootstrap directory, and macOS code-signing enforcement rejects it in its new location.This causes any test that invokes the bootstrap
dotnetto fail — most visibly tests usingRoslynCodeTaskFactory, which shells out todotnet csc.dllto compile inline tasks. The failure manifests as:MSB6006: "csc.exe" exited with code 137Killed: 9when running the bootstrap dotnet directlyThe error is confusing because exit code 137 typically suggests OOM, but the real cause is macOS security policy.
Solution
Add an
Execstep at the end of theBootstrapNetCoretarget ineng/BootStrapMsBuild.targetsthat ad-hoc re-signs the bootstrapdotnetbinary on macOS:This runs automatically as part of every bootstrap build, so macOS developers never need to manually troubleshoot this issue. The
--force --sign -flags replace the existing signature with an ad-hoc local signature that macOS accepts. The condition ensures this only runs on macOS — Windows and Linux are unaffected.Testing
rm -rf artifacts/)./build.sh -v quiet— build succeeded, codesign step ran automaticallyartifacts/bin/bootstrap/core/dotnet --versionworks (previously:Killed: 9)dotnet test src/Tasks.UnitTests/ --filter BothForceAndMultiThreadedWork— passed ✅