Skip to content

qemu: ask to sign QEMU binary when the binary is not properly signed#1743

Merged
AkihiroSuda merged 1 commit into
lima-vm:masterfrom
AkihiroSuda:sign-qemu-binary
Aug 14, 2023
Merged

qemu: ask to sign QEMU binary when the binary is not properly signed#1743
AkihiroSuda merged 1 commit into
lima-vm:masterfrom
AkihiroSuda:sign-qemu-binary

Conversation

@AkihiroSuda

@AkihiroSuda AkihiroSuda commented Aug 13, 2023 •
edited
Loading

Copy link
Copy Markdown
Member 
$ limactl start
INFO[0000] Using the existing instance "default"        
WARN[0000] QEMU binary "/usr/local/bin/qemu-system-x86_64" is not properly signed with the "com.apple.security.hypervisor" entitlement  error="failed to run [codesign --verify /usr/local/bin/qemu-system-x86_64]: exit status 1 (out=\"/usr/local/bin/qemu-system-x86_64: invalid signature (code or signature have been modified)\\nIn architecture: x86_64\\n\")"
? Try to sign "/usr/local/bin/qemu-system-x86_64" with the "com.apple.security.hypervisor" entitlement? (Y/n)
...

Workaround for:

This workaround is needed because Homebrew's QEMU binary is not properly signed since v8.0.4. Homebrew/homebrew-core#139409 (comment)

@AkihiroSuda AkihiroSuda added this to the v0.17.2 milestone Aug 13, 2023
@AkihiroSuda
AkihiroSuda requested a review from a team August 13, 2023 15:30
@AkihiroSuda

AkihiroSuda commented Aug 13, 2023

Copy link
Copy Markdown
Member Author

cc @lima-vm/maintainers

I'll release v0.17.2 after merging this workaround.

@afbjorklund

afbjorklund commented Aug 13, 2023

Copy link
Copy Markdown
Member

Wouldn't this sign any random qemu binary in the path ?

@AkihiroSuda

AkihiroSuda commented Aug 13, 2023

Copy link
Copy Markdown
Member Author

Wouldn't this sign any random qemu binary in the path ?

Sorry what do you mean?

@afbjorklund

afbjorklund commented Aug 13, 2023 •
edited
Loading

Copy link
Copy Markdown
Member

How do we know that the current qemu is the authentic homebrew ?

But maybe this is not so much about authenticating the prebuilt binary, as it is about adding com.apple.security.hypervisor entitlement to the existing program. Otherwise it seems like homebrew made a bug, and the right fix would be for them to make another "package" (well, tarball) revision where they sign it properly.

@AkihiroSuda

AkihiroSuda commented Aug 13, 2023

Copy link
Copy Markdown
Member Author

How do we know that the current qemu is the authentic homebrew ?

We may check if the binary path contains "/Cellar/" ?

@AkihiroSuda AkihiroSuda changed the title qemu: automatically sign QEMU binary when the binary is not properly signed qemu: ask to sign QEMU binary when the binary is not properly signed Aug 14, 2023
@AkihiroSuda
AkihiroSuda marked this pull request as draft August 14, 2023 02:07
@AkihiroSuda
qemu: ask to sign QEMU binary when the binary is not properly signed
c0b48a9 
Workaround for issue 1742 .
This workaround is needed because Homebrew's QEMU binary is not properly signed since v8.0.4.

Signed-off-by: Akihiro Suda <[email protected]>
@AkihiroSuda

AkihiroSuda commented Aug 14, 2023

Copy link
Copy Markdown
Member Author

Modified to open a Y/n prompt before signing.
NOP if tty is not available.

@AkihiroSuda
AkihiroSuda marked this pull request as ready for review August 14, 2023 02:24
AkihiroSuda
AkihiroSuda commented Aug 14, 2023
View reviewed changes
Comment thread pkg/start/start.go
"github.com/lima-vm/lima/pkg/driver"
"github.com/lima-vm/lima/pkg/driverutil"
"github.com/lima-vm/lima/pkg/qemu"
"github.com/lima-vm/lima/pkg/qemu/entitlementutil"

@AkihiroSuda AkihiroSuda Aug 14, 2023

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I don't want to let pkg/start depend on a specific driver, but I'm going to merge this right now anyway, as the Homebrew issue #1742 is critical. We can refactor this later.)

@AkihiroSuda
AkihiroSuda merged commit bee0502 into lima-vm:master Aug 14, 2023
@AkihiroSuda AkihiroSuda mentioned this pull request Aug 23, 2023
Closed
@AkihiroSuda AkihiroSuda mentioned this pull request Sep 4, 2023
Closed
@mggluscevic59

mggluscevic59 commented Nov 30, 2023

Copy link
Copy Markdown

On Mac Big Sur entitlement check exits on: codesign --display --entitlements - --xml /usr/local/bin/qemu-system-x86_64 because that command is a bit different - it does not have --xml

Is there a way to turn off entitlements check all together?

@AkihiroSuda

AkihiroSuda commented Nov 30, 2023

Copy link
Copy Markdown
Member Author

Big Sur

Addressed in:

Will be in v0.19

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

component/qemu QEMU priority/high

Projects

None yet

Milestone

v0.17.2

Development

Successfully merging this pull request may close these issues.

3 participants

@AkihiroSuda @afbjorklund @mggluscevic59