fsevents.node is not signed

[jonahgraham]

Wild Web Developer contains some unsigned code which prevents products from being notarized. This file is not signed: org.eclipse.wildwebdeveloper_1.1.2.202311151451/node_modules/fsevents/fsevents.node

The full error I see is as follows, with similar errors for other EPPs.

{
  "logFormatVersion": 1,
  "jobId": "8d36c15c-b650-4242-b817-3bb211054150",
  "status": "Invalid",
  "statusSummary": "Archive contains critical validation errors",
  "statusCode": 4000,
  "archiveFilename": "eclipse-php-2023-12-M3-macosx-cocoa-x86_64-11621221555228008492.dmg",
  "uploadDate": "2023-11-16T18:28:47.503Z",
  "sha256": "13d8a69e550050f48a92a8537e986c996218c5066519d6f7485cfd77bf29c34e",
  "ticketContents": null,
  "issues": [
    {
      "severity": "error",
      "code": null,
      "path": "eclipse-php-2023-12-M3-macosx-cocoa-x86_64-11621221555228008492.dmg/Eclipse.app/Contents/Eclipse/plugins/org.eclipse.wildwebdeveloper_1.1.2.202311151451/node_modules/fsevents/fsevents.node",
      "message": "The binary is not signed.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "eclipse-php-2023-12-M3-macosx-cocoa-x86_64-11621221555228008492.dmg/Eclipse.app/Contents/Eclipse/plugins/org.eclipse.wildwebdeveloper_1.1.2.202311151451/node_modules/fsevents/fsevents.node",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087733",
      "architecture": "x86_64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "eclipse-php-2023-12-M3-macosx-cocoa-x86_64-11621221555228008492.dmg/Eclipse.app/Contents/Eclipse/plugins/org.eclipse.wildwebdeveloper_1.1.2.202311151451/node_modules/fsevents/fsevents.node",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
      "architecture": "arm64"
    },
    {
      "severity": "error",
      "code": null,
      "path": "eclipse-php-2023-12-M3-macosx-cocoa-x86_64-11621221555228008492.dmg/Eclipse.app/Contents/Eclipse/plugins/org.eclipse.wildwebdeveloper_1.1.2.202311151451/node_modules/fsevents/fsevents.node",
      "message": "The signature does not include a secure timestamp.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087733",
      "architecture": "arm64"
    }
  ]
}

[jonahgraham]

I don't know if this is a regression of what wwd builds, or macOS's notarization constantly moving targets to get a fully notarized build.

[jonahgraham]

The full list of affected EPPs are: JEE, PHP, Committers on both aarch64 and x86_64 platforms.

xref: eclipse-packaging/packages#79

[vrubezhny]

@jonahgraham Honestly, I don't know how can I help with this issue...

The whole jars are signed when the release is published, not the individual modules. The content of org.eclipse.wildwebdeveloper_1.1.2.202311151451.jar is extracted when this gets installed into an RCP app - so it should be the same (if jar extractor app doesn't fail).

If on MacOS some "notarization" process takes place after the installation... I don't understand how could I help here?

[jonahgraham]

The issue is the native code library. M2e has a similar issue a while ago and solved it like this eclipse-m2e/m2e-core#593

[akurtakov]

@jonahgraham It is unclear to me - is this issue with MacOS only? The m2e fix is jnilib signing only so it looks like MacOS only. This is extremely fragile way to achieve things and IMHO signing plugin should be fixed proper.

[akurtakov]

IMHO https://github.com/eclipse-cbi/org.eclipse.cbi/tree/main/maven-plugins/eclipse-jarsigner-plugin (and friends) should be fixed and then WWD gets autofixed by rebuilding.

[jonahgraham]

This is macos only (sort of).

It's not the jar that isn't signed, but files inside the jar that aren't signed using the proprietary OS signing method. This is equivalent to how SWT signs the DLLs and jnilibs too before they end up in the jar.

The reason I said sort of is because Windows doesn't (yet) complain if the DLLs aren't signed. So the windows signing should be done at some point. The reason macos is blocker is because the notarization process that windows doesn't have equivalent of.