2

I am trying to compile my own copy of Apple's Security.framework, specifically version 55471.14.18, which was included in OS X 10.9.5 and whose source code can be downloaded from https://opensource.apple.com/tarballs/Security/Security-55471.14.18.tar.gz.

I'm using a copy of Mac OS X 10.9.5 in a VM. Xcode 6.2 has been installed, and xcode-select --install has separately been run to acquire system headers.


The readme file included in the source download says:

To build this project in a Darwin environment (as opposed to building in-house at Apple), use the Darwin buildstyle. If you're building with Xcode, select "Darwin" from the "Active Build Style" popup. If you're building from the command line, specify the build style like so:

% xcodebuild -buildstyle Darwin install

But when I run the given command, I'm told:

xcodebuild: error: option '-buildstyle' is no longer supported

Since my copy of Xcode was current at the time this code was released, I'm not sure what to make of this error. I decided to ignore it and press on with just a standard xcodebuild command.


The first problem I ran into was easy to fix, but makes me worried I'm missing something larger. The compiler complains:

/Users/Jonathan/Desktop/Security-55471.14.18/libsecurity_utilities/lib/macho++.cpp:39:18: error: 
unused variable 'MAX_ARCH_COUNT' [-Werror,-Wunused-const-variable]
static const int MAX_ARCH_COUNT = 100;

Since the variable is reportedly unused anyway, I just opened the file and commented out the line static const int MAX_ARCH_COUNT = 100;.


Unfortunately, this is where I ran into a brick wall. Xcodebuild seems to want all sorts of headers that are not on my system or included in the project. For instance:

/Users/Jonathan/Desktop/Security-55471.14.18/libsecurity_utilities/lib/mach++.cpp:33:10: fatal error: 
      'bootstrap_priv.h' file not found
#include <bootstrap_priv.h>

These headers are also open source, and I know where to find them! Bootstrap_priv.h, for example, is part of launchd; the OS X 10.9.5 version can be downloaded from https://opensource.apple.com/tarballs/launchd/launchd-842.92.1.tar.gz

However, I do not understand where I'm supposed to put these headers in order for the compiler to find them! Things I've tried:

  • Copying the launchd project to /usr/include/
  • Copying the launchd project to the root of the security project
  • Copying just Bootstrap_priv.h to /usr/include/
  • Copying just bootstrap_priv.h to the root of the security project
  • Copying just bootstrap_priv.h to the project directory/libsecurity_utilities/lib/

That last attempt actually did let me get past the error (and to see the next missing header, IOPMLibPrivate.h), but I'm quite sure it's not what I'm supposed to do! As I keep adding headers to random places within the project, other source files get stuck finding headers I've already copied elsewhere. Some of the headers themselves get stuck this way, expecting a different relative path for dependencies than what the main project seems to need.


I am feeling extremely out of my depth here! Where are these header files actually supposed to go, and what is the meaning of that -buildstyle option I'm supposed to include but which can't be run? None of this appears to be documented anywhere!

10
  • 1
    This didn't quite fit anywhere in the question, but because I suspect someone is going to ask... my ultimate goal is to backport some newer SSL ciphers to this older version of Security.framework, so that Mavericks can interact with the modern web! Whether I'll actually be able to make that code work is an open question, but one thing at a time—just getting the original to compile is a necessary first step! Jul 19, 2020 at 16:29
  • Looking at the question you need to spend time leaning to manage and build c based projects. So that you know enough to debug this yourself.an answer here would be too long b
    – mmmmmm
    Jul 19, 2020 at 20:09
  • The current cpp includes are at /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/chrono so that could be worth a try. Also there's this way to add include paths to the compiler: stackoverflow.com/questions/5846804/… but all this seems off-topic and good for stackoverflow
    – anki
    Jul 19, 2020 at 20:22
  • Not really I learnt by programming on different os and doing builds a s needed. For builds perhaps look at macports and see how it works and fix some of their tickets. Homebrew might be possible as well
    – mmmmmm
    Jul 19, 2020 at 20:28
  • Usually if you have an xcodeproj file you can open it in xcode, go to build settings, and add it under header search paths. It seems an xcodeproj is indeed included as part of the bundle, so you can try that. I'm also interested in following along on your quest to backport the newer ciphers! Please post something if you make any progress.
    – 1110101001
    Aug 9, 2020 at 5:55

1 Answer 1

1

This ended up being a lot more complicated than I think rightly fits this site's Q&A format. Even so, I didn't want to leave this question hanging, since I did get the framework to build, kindda.

This repository should build fully in 10.9.5 running the latest compatible version of xCode, and using the 10.9 SDK. https://github.com/Wowfunhappy/Wowfunhappy-Mavericks-Security-Framework

I used the "User Framework Search Paths" to add libraries, but because it's an absolute rather than a relative path, you may need to update it on your machine. This should be trivial even if it is a bit tedious—all of the actual frameworks are included in the Git repository. These Frameworks come from a combination of opensource.apple.com (preferred wherever available for obvious reasons), samdmarshall's reverse-engineered private SDK, and the Darling project.

The built Framework does not appear to actually function—replacing it on my hard drive makes the computer (a VM, thankfully) unable to boot. I initially expected this to be a code signing issue, but it doesn't look like that's the problem. But, still, it built!

tl;dr I wasn't making some stupid oversight, Apple's opensource releases are basically impossible to actually build without additional reverse engineering. Luckily, that reverse engineering work has largely been done by various projects, but seemingly not to the point where you can build something that actually works.

8
  • @1110101001 (Because you asked for updates) I did take your advice with a proxy server, all https traffic is now running through Squid and it works great! forums.macrumors.com/threads/… Aug 19, 2020 at 23:17
  • Nice work! (For some reason stackexchange didn't notify me on your mention). You might be able to extract more info on the reason for the boot failure by booting into single user mode. But I have a feeling that perhaps the open-source version of the framework they provide might be missing some of the private functions needed.
    – 1110101001
    Aug 31, 2020 at 8:37
  • 1
    Wow. This source tree is notoriously hard to compile since it depends on internal and private tools that haven’t been documented / released or reverse engineered AFAIK. Thank you so much for the posts
    – bmike
    Sep 30, 2020 at 12:26
  • Did you ever manage to figure out what the missing symbols preventing boot were? Maybe an alternative to compiling the entire Security.framework might be to compile just SecureTransport and then do some re-exporting magic so the symbols in yours override the ones in the system's Security.framework
    – 1110101001
    Apr 11 at 1:07
  • Although I suspect that itself might not be sufficient since the cocoa layer may potentially need to be aware of the new cipher suites (not 100% sure). How about an alternate idea: under the assumption that the majority of cocoa apps will use NSURLConnection, you swizzle that with your own implementation that uses your own openssl.
    – 1110101001
    Apr 11 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .