fix(equalizer): make the privileged helper installable on a real Mac - #370
Merged
Merged
Conversation
The picker only matched Apple Development, so a machine with a Developer ID Application certificate still fell back to the self-signed local identity. Both leaves carry the team in subject.OU, which is what the equalizer helper's requirement pins, but only Developer ID produces a build that can be handed to anyone else.
…real Mac Four faults that only appear on a signed machine, none of which CI can see: - The client treated SMAppService's .notFound as fatal. A daemon that has never been registered reports exactly that, so the first enable could never register anything. - It connected to the helper immediately after register(), before launchd had the job up, and read the resulting failure as a broken helper. - Its retry path unregistered an approved service and registered again, which needs the user's approval a second time. Since the version marker it keyed on is only written after a successful install, every enable threw the approval away and asked again. - The helper was signed with com.apple.security.get-task-allow in Debug builds. launchd refuses to run a Developer ID daemon carrying it, so the job never loaded.
isaaclins
changed the title
…tly failing Enabling the equalizer on a machine that has not allowed Spotiglass to run in the background did nothing visible: the switch sprang back and the pane stayed blank. launchd answers register() with EPERM in that state, the client reported it as a generic registrationFailed, and install failures are deliberately log-only because the operating system's own prompt is normally the whole user experience. That rule is right for every install failure except this one, which is a pending user decision and the only one the app cannot resolve by itself. Missing approval is now its own case end to end. It is never retried, because retrying cannot grant it and re-registering would discard an approval that had already been given. The settings pane shows what happened and offers the trip to Login Items, which is the only place it can be granted. Also records what this cost to find: the helper is a LaunchDaemon, so macOS enforces a launch constraint demanding the Developer ID validation category. An Apple Development build is refused with OS_REASON_CODESIGNING after registering successfully, and an unnotarized Developer ID build never registers at all. There is no local-development path for the equalizer, only a notarized one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two related things, both found by installing a signed build and actually turning the equalizer on. #367 landed the mechanism but it had never been run end to end on a machine.
Signing
LOCAL_SIGN_IDENTITYonly matchedApple Development, so a machine holding a Developer ID Application certificate still fell back to the self-signed "Spotiglass Local Dev" identity, andmake sign-driverhad the same blind spot. Developer ID is now preferred. Verified with the real certificate installed:and likewise for
SpotiglassEQDriver.driveragainst the driver requirement.Four faults in the install path
None of these can fail in CI, because CI never registers a daemon:
SMAppServicereports.notFoundfor a daemon that has never been registered. The client treated that as fatal, so the very first enable could never install anything.register()returns, before launchd has the job up. It now waits for the service to report.enabled.com.apple.security.get-task-allowin Debug builds (Xcode injects it), and launchd will not run a Developer ID daemon that carries it: the registration succeeded and the job silently never loaded. The helper target now setsCODE_SIGN_INJECT_BASE_ENTITLEMENTS = NO.Verified on the machine
Still unverified
The daemon had not loaded by the end of the session, because the Background Task Management database held a stale record from earlier registrations made while the app lived in DerivedData.
sfltool resetbtmwas run to clear it, and Apple's own dialog says to reboot afterwards; the reboot has not happened yet. So the last two steps, the driver appearing in /Library/Audio/Plug-Ins/HAL and Spotiglass EQ showing up as an output device, still need a human on a rebooted Mac.