4 ms·
Weird .. macOS is still completely open is my experience. Can you give an example?
by st3fan 5mo ago
Weird .. macOS is still completely open is my experience. Can you give an example?
- gambiting 5mo agoI compile a tool we use, send it to another developer, they can't open it without going through system settings because the OS thinks it's unsafe. There is no blanket easy way to disable this behaviour. We also inject custom dlibs into clang during compilation and starting with Tahoe that started to fail - we discovered that it's because of SIP(system integrity protection). We reached out to apple, got the answer that "we will not discuss any functionality related to operation of SIP". Great. So now we either have to disable SIP on every development machine(which IT is very unhappy about) or re-sign the clang executable with our own dev key so that the OS leaves us alone.
- 10000truths 5mo agoIf SIP is kicking in, it sounds like you're using the clang that comes with Apple's developer tools. Does this same issue occur with clang sourced from homebrew, or from LLVM's own binary releases?
- gambiting 5mo agoYes, it kicks in even with non apple supplied clang(most notably, with the clang supplied as part of the Android toolchain, since we sometimes build Android on MacOS and having to re-sign the google-supplied clang with our own certificate is now a regular thing every time there is an update released).
- fragmede 5mo agoIf it's being sent to another developer then asking them to run xattr -rd com.apple.quarantine on the file so they can run it doesn't seem insurmountable. I agree that it's a non-starter to ask marketing or sales to do that, but developers can manage. Having to sign and then upload the binary to Apple to notarize is also annoying but you put it in a script and go about your day. But Apple being "completely open", it is not.
- saagarjha 5mo ago> We also inject custom dlibs into clang during compilation I am curious what you are doing
- gambiting 5mo agoWe use Unreal Build Accelerator which injects a custom dlib into clang to intercept the compilation process and distribute it to worker machines.
- saagarjha 5mo agoI’m curious why this needs to be code injection and not, like, a shell script?
- gambiting 5mo agoBecause...it's official behaviour that is fully supported by clang? If you want to add a hook on compilation start, it's literally the documented way - you include your own dlib with necessary overrides and then you can call your own methods at each compilation step. Not even sure how you'd do it with a shell script? You need to have knowledge of all the compilation and linking units, which....you have from within Clang.