.netcore single file executable codesign fail on macOS

[snakeeye]

Issue Title

netcore single file executable codesign fail on macOS

General

1. Create a console "Hello world" executable on macOS.
2. Generate a single file executable followed: https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotnet-core-3-0#single-file-executables
3. run codesign with this exe.
   You will get error message: main executable failed strict validation
   If you add --no-strict option in codesign, you will get more detailed error messages:

/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate: the __LINKEDIT segment does not cover the end of the file (can't be processed) in: /Volumes/Data/temp/HelloDotNet/bin/Release/netcoreapp3.0/osx.10.12-x64/publish/MacOS/HelloDotNet
/Volumes/Data/temp/HelloDotNet/bin/Release/netcoreapp3.0/osx.10.12-x64/publish/MacOS/HelloDotNet: the codesign_allocate helper tool cannot be found or used

[karelz]

Looks like you don't have compatible version of xcode ... @wfurt any idea?

[wfurt]

not really. I did not experiment with single-file-executables at all.

cc: @safern @wtgodbe

[safern]

I have no idea either. cc: @nguerrera @livarcocc any idea?

[nguerrera]

@swaroop-sridhar

[swaroop-sridhar]

The single-file bundler adds additional contents (the apps's dependencies) at the end of the host-binary. Looks like this is triggering an internal validation (__LINKEDIT doesn't cover EOF) when running codesign.
I'll investigate further.

Related issue: https://github.com/dotnet/core-setup/issues/6518

[MoonStorm]

It fails on windows too. I get an error saying it's looking for the main app's dll. Same setup though with unsigned files works fine.

[swaroop-sridhar]

@MoonStorm the fix for Windows version is in this PR:
dotnet/core-setup#6885

[MoonStorm]

@MoonStorm the fix for Windows version is in this PR:
dotnet/core-setup#6885

Thanks, hopefully that will make it in the next preview (7)?

[swaroop-sridhar]

The Windows fix will be in Preview 7. I opened https://github.com/dotnet/core-setup/issues/7065 to track the MAC signing issue (better tracked in the core-setup repo).

Hence closing this issue.