Chisel signature replace fails

[nrbrook]

When installing chisel (M1 MBP) I get this error:

% brew reinstall chisel                                      
==> Downloading https://ghcr.io/v2/homebrew/core/chisel/manifests/2.0.1
Already downloaded: /Users/nick/Library/Caches/Homebrew/downloads/752478f3c3981568c1e9509755a9022487f6d2a37ea65142f3c1958c9d8c755b--chisel-2.0.1.bottle_manifest.json
==> Downloading https://ghcr.io/v2/homebrew/core/chisel/blobs/sha256:bd381685bf1bf3682e51c355acbca980b35659b8161f226329b3a0196aab55df
Already downloaded: /Users/nick/Library/Caches/Homebrew/downloads/73a2de687fad93f0f09593cb03592031d01c11b6e735bd249b7ce3f0ff2b9120--chisel--2.0.1.arm64_big_sur.bottle.tar.gz
==> Reinstalling chisel 
==> Pouring chisel--2.0.1.arm64_big_sur.bottle.tar.gz
Error: Failed applying an ad-hoc signature to /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel:
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: replacing existing signature
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: Permission denied

When checking permissions:

% ls -la /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework
total 448
drwxr-xr-x  7 nick  admin     224 20 Sep 13:13 .
drwxr-xr-x  3 nick  admin      96 22 Jul  2020 ..
-r--r--r--  1 nick  wheel  224160 20 Sep 13:13 Chisel
drwxr-xr-x  3 nick  admin      96 22 Jul  2020 Headers
-r--r--r--  1 nick  admin     726 22 Jul  2020 Info.plist
drwxr-xr-x  3 nick  admin      96 22 Jul  2020 Modules
drwxr-xr-x  3 nick  admin      96 22 Jul  2020 _CodeSignature

It seems files in this formula are installed with the wrong permissions/group?

[SMillerDev]

Can you run the install with --debug

[nrbrook]

% brew reinstall chisel --debug
/opt/homebrew/Library/Homebrew/brew.rb (Formulary::FormulaLoader): loading /opt/homebrew/Library/Taps/homebrew/homebrew-core/Formula/chisel.rb
==> Downloading https://ghcr.io/v2/homebrew/core/chisel/manifests/2.0.1
/opt/homebrew/Library/Homebrew/shims/shared/curl --disable --cookie /dev/null --globoff --show-error --user-agent Homebrew/3.6.2\ \(Macintosh\;\ arm64\ Mac\ OS\ X\ 12.5.1\)\ curl/7.79.1 --header Accept-Language:\ en --retry 3 --header Accept:\ application/vnd.oci.image.index.v1\+json --header Authorization:\ Bearer\ QQ== --location --silent --head --request GET https://ghcr.io/v2/homebrew/core/chisel/manifests/2.0.1
Already downloaded: /Users/nick/Library/Caches/Homebrew/downloads/752478f3c3981568c1e9509755a9022487f6d2a37ea65142f3c1958c9d8c755b--chisel-2.0.1.bottle_manifest.json
==> Downloading https://ghcr.io/v2/homebrew/core/chisel/blobs/sha256:bd381685bf1bf3682e51c355acbca980b35659b8161f226329b3a0196aab55df
/opt/homebrew/Library/Homebrew/shims/shared/curl --disable --cookie /dev/null --globoff --show-error --user-agent Homebrew/3.6.2\ \(Macintosh\;\ arm64\ Mac\ OS\ X\ 12.5.1\)\ curl/7.79.1 --header Accept-Language:\ en --retry 3 --header Authorization:\ Bearer\ QQ== --location --silent --head --request GET https://ghcr.io/v2/homebrew/core/chisel/blobs/sha256:bd381685bf1bf3682e51c355acbca980b35659b8161f226329b3a0196aab55df
Already downloaded: /Users/nick/Library/Caches/Homebrew/downloads/73a2de687fad93f0f09593cb03592031d01c11b6e735bd249b7ce3f0ff2b9120--chisel--2.0.1.arm64_big_sur.bottle.tar.gz
==> Reinstalling chisel 
/opt/homebrew/Library/Homebrew/shims/shared/git --version
==> Pouring chisel--2.0.1.arm64_big_sur.bottle.tar.gz
tar --extract --no-same-owner --file /Users/nick/Library/Caches/Homebrew/downloads/73a2de687fad93f0f09593cb03592031d01c11b6e735bd249b7ce3f0ff2b9120--chisel--2.0.1.arm64_big_sur.bottle.tar.gz --directory /private/tmp/d20220920-59959-c69d3d
cp -pR /private/tmp/d20220920-59959-c69d3d/chisel/. /opt/homebrew/Cellar/chisel
==> Changing dylib ID of /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
  from @@HOMEBREW_PREFIX@@/opt/chisel/lib/Chisel.framework/Chisel
    to /opt/homebrew/opt/chisel/lib/Chisel.framework/Chisel
==> Codesigning /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
==> Codesigning (2nd try) /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
Error: Failed applying an ad-hoc signature to /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel:
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: replacing existing signature
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: Permission denied

/opt/homebrew/Library/Homebrew/brew.rb (Formulary::FromPathLoader): loading /opt/homebrew/opt/chisel/.brew/chisel.rb

[carlocab]

What's the output of

/bin/ls -l /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
whoami

?

[carlocab]

Oh, sorry, you already posted this. Not sure why one of those is owned by wheel. Odd.

[carlocab]

Hmm, can't reproduce (using the arm64_big_sur bottle):

❯ /bin/ls -la chisel/2.0.1/lib/Chisel.framework
total 448
drwxr-xr-x  7 carlocab  staff     224 Jul 23  2020 .
drwxr-xr-x  3 carlocab  staff      96 Jul 23  2020 ..
-r--r--r--  1 carlocab  staff  224160 Jul 23  2020 Chisel
drwxr-xr-x  3 carlocab  staff      96 Jul 23  2020 Headers
-r--r--r--  1 carlocab  staff     726 Jul 23  2020 Info.plist
drwxr-xr-x  3 carlocab  staff      96 Jul 23  2020 Modules
drwxr-xr-x  3 carlocab  staff      96 Jul 23  2020 _CodeSignature

[carlocab]

What is the output of brew config and brew doctor?

[nrbrook]

% brew config
HOMEBREW_VERSION: 3.6.2
ORIGIN: https://github.com/Homebrew/brew
HEAD: b8b195cc64a29595797651720ebb2ea09affb682
Last commit: 32 hours ago
Core tap ORIGIN: https://github.com/Homebrew/homebrew-core
Core tap HEAD: f890e2444f92abb7dc791ebef23637556902828f
Core tap last commit: 3 hours ago
Core tap branch: master
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 2.6.8 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 14.0.0 build 1400
Git: 2.37.0 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 7.79.1 => /usr/bin/curl
macOS: 12.5.1-arm64
CLT: 14.0.0.0.1.1661618636
Xcode: 14.0
Rosetta 2: false

% brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: "config" scripts exist outside your system or Homebrew directories.
`./configure` scripts often look for *-config scripts to determine if
software packages are installed, and which additional flags to use when
compiling and linking.

Having additional scripts in your path can confuse software installed via
Homebrew if the config script overrides a system or Homebrew-provided
script of the same name. We found the following "config" scripts:
  /Library/Frameworks/Python.framework/Versions/3.9/bin/python3.9-config
  /Library/Frameworks/Python.framework/Versions/3.9/bin/python3-config
  /usr/local/opt/curl/bin/curl-config

Warning: Unbrewed dylibs were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae, and may need to be deleted.

Unexpected dylibs:
  /usr/local/lib/libctxfuse.2.dylib

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  protobuf

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /opt/homebrew/sbin.
Consider setting your PATH for example like so:
  echo 'export PATH="/opt/homebrew/sbin:$PATH"' >> ~/.zshrc

[gromgit]

I can reproduce on M1 Mac Mini running Monterey, even after running brew update:

$ brew install chisel
==> Downloading https://ghcr.io/v2/homebrew/core/chisel/manifests/2.0.1
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/chisel/blobs/sha256:bd381685bf1bf3682e51c355acbca980b35659b8161f226329b3a0196aab55df
==> Downloading from https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:bd381685bf1bf3682e51c355acbca980b35659b8161f226329b3a0196aab55df?se=2022-09-20T15%3A45%3A00Z&sig=nR9pO9i4n%2F2LMuiODrccKjG1BaYWDLw8M8ZMUsP6z2Y%3D&sp=r&spr=https&sr=b&sv=2019-12-12
######################################################################## 100.0%
==> Pouring chisel--2.0.1.arm64_big_sur.bottle.tar.gz
Error: Failed applying an ad-hoc signature to /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel:
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: replacing existing signature
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: Permission denied
[...]

$ ls -ld /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework
drwxr-xr-x 7 aho admin 224 Sep 20 23:40 /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/

$ ls -l /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
-r--r--r-- 1 aho admin 224160 Sep 20 23:36 /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel

Perhaps the file permissions might have some bearing on this matter.

[carlocab]

Might be a recent change in macOS and codesign.

[gromgit]

UPDATE: Nope, giving the file write permissions doesn't help either:

$ chmod a+w /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel

$ ls -l /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
-rw-rw-rw- 1 aho admin 224160 Sep 20 23:40 /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel

$ codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: replacing existing signature
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: Permission denied

That said, I noticed the following code chunk in the chisel formula:

    # == LD_DYLIB_INSTALL_NAME Explanation ==
    # This make invocation calls xcodebuild, which in turn performs ad hoc code
    # signing. Note that ad hoc code signing does not need signing identities.
    # Brew will update binaries to ensure their internal paths are usable, but
    # modifying a code signed binary will invalidate the signature. To prevent
    # broken signing, this build specifies the target install name up front,
    # in which case brew doesn't perform its modifications.
    system "make", "-C", "Chisel", "install", "PREFIX=#{lib}", \
      "LD_DYLIB_INSTALL_NAME=#{opt_prefix}/lib/Chisel.framework/Chisel"

Does that last line in the comment block mean that brew should not be re-signing this file?

[gromgit]

Might be a recent change in macOS and codesign.

Just noticed this formula hasn't been rebuilt for Monterey, which both @nrbrook and I are running. @carlocab, are you on Big Sur by any chance?

[carlocab]

Nope, I just looked at the extracted bottle. I can reproduce this with brew install chisel, though. Not sure when Chisel picks up the wheel gid though.

[nrbrook]

The permissions in the tar seem incorrect:

Why doesn't homebrew set the correct permissions after extracting?

[nrbrook]

Thanks for your help diagnosing the issue

[carlocab]

Indeed, just giving that file user-write perms is sufficient:

$ chmod u+w /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/_CodeSignature/CodeResources

$ codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime --verbose --verbose /opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: replacing existing signature
/opt/homebrew/Cellar/chisel/2.0.1/lib/Chisel.framework/Chisel: signed bundle with Mach-O universal (i386 x86_64 arm64) [com.facebook.Chisel]

I guess we could make sure those are writable every time we try to codesign something. That could lead to a whole lot of chmod +w && codesign && chmod -ws though.

[nrbrook]

@carlocab if the permissions in the tar are correct, then why is this the first time this issue has occurred? Surely it would have occurred for all formulae that need codesigning?

[carlocab]

To be clear: when I say the permissions are correct, I mean that those are the permissions we want those files to have when they are installed on your system.

The permissions do not seem to be appropriate for codesigning, though. But I believe this is a recent change in macOS 12.5. Security hardening at Apple, I guess.

[dserodio]

I just encountered the same issue with holmesgpt, which is also a Python app. I searched Github issues and couldn't find anything so I filed this issue: Homebrew/brew#19940