Alan Parra
8302d467d1
Since #12794 we now build `tsh` binaries with touch ID capabilities. This calls for a more sophisticated mechanism to determine if touch ID functions should be enabled, as compile-time support only is not enough. I've added the following checks, on top of compile-time / `touchid` build tag: Binary is signed Binary has entitlements Machine is touch ID capable Machine has a Secure Enclave Put together this give us a much better proxy on whether to enable touch ID. I've also added the `tsh touchid diag` command, mentioned in the Passwordless macOS RFD (see https://github.com/gravitational/teleport/blob/master/rfd/0054-passwordless-macos.md#tsh-support-commands). #9160 * Improved touch ID availability and diagnostics * Add the `tsh touchid diag` command * Set min macOS version to 10.12 (macOS Sierra)
tshdev
The tshdev app skeleton is used to test features that require a
signed/entitled tsh binary in development environments (eg, touch ID).
Instructions
skel=build.assets/macos/tshdev
go build -tags=touchid ./tool/tsh # at Teleport root
mkdir -p $skel/tsh.app/Contents/MacOS/
cp tsh $skel/tsh.app/Contents/MacOS/ # copy binary to .app
$skel/sign.sh $skel/tsh.app # sign .app
$skel/tsh.app/Contents/MacOS/tsh touchid ls # use tsh
Alternatively, you may install tshdev.provisionprofile locally, then sign and
run the "naked" binary. To install the profile, open it using Finder.
skel=build.assets/macos/tshdev
go build -tags=touchid ./tool/tsh # at Teleport root
$skel/sign.sh tsh # sign tsh binary
./tsh touchid ls # use tsh
Structure
tsh.app- macOS .app skeletontshdev.entitlements- entitlements claimed by tsh the binarytshdev.provisionprofile- provisioning profile (also embedded in .app)
Useful commands
security find-identity -vp codesigning # list codesign identities
security cms -D -i /path/to/profile # inspect provisioning profile
codesign -d --entitlements /path/to/binary # shows binary entitlements
# Extract plist and certificate from profile
security cms -D -i /path/to/my.provisionprofile -o my.plist
/usr/libexec/PlistBuddy -c 'Print :DeveloperCertificates:0' my.plist > my0.cer
certtool d tshdev0.cer
One-time setup
This section explains how the tshdev skeleton was built. You don't have to go through the steps here unless you are trying to recreate parts of the skeleton (or trying to create a new skeleton).
-
Create a provisioning profile on https://developer.apple.com/account/resources/profiles/list
In order to create the profile, a Developer ID certificate and a Developer ID app are necesary.
For
tshdevwe use:- Team
K497G57PDJ/ apple-developer@goteleport.com - App
com.goteleport.tshdev - Developer ID certificate
A5604F285B0957134EA099AC515BD9E0787228AC - See https://developer.apple.com/account/resources/profiles/review/JGACZBU48V
Make sure the profile contains the necessary entitlements and that the .app claims those entitlements as well.
- Team
-
Install the developer certificates via XCode
-
Prepare a daemon-in-app skeleton
See https://developer.apple.com/documentation/xcode/signing-a-daemon-with-a-restricted-entitlement.
The app and bundle must match the provisioning profile above. Use the provisioning profile downloaded from Apple instead of letting XCode manage it.
-
Export the app using XCode
For example, click "build" and copy the app using "Product -> Show Build Folder in Finder".