[patch] PE and Mach-O format for code signing
Robert Smith <[email protected]> Fri, 17 Apr 2026 22:42:39 +0000
| Newsgroups | gmane.lisp.steel-bank.devel |
|---|---|
| Message-ID | <i3ke7Jh_CEhOLKXQ7YS_kcmonMt6Eo30MyUsOJWD4_7VTHF3hQ0hkqV70ZvEBOI3MEUbaxuV8GmU1zkKpSwWbRd8RdaPMopjUdjozmoedFs=@stylewarning.com> |
Hello SBCL friends: I've been building an app that I want to actually distribute to real, human people on the internet for Windows, Mac, and Linux. In order to make the experience seamless, the app should be code-signed. As you may know, code-signing does not work out-of-the-box on Windows and Mac with SBCL-produced executables, because either (a) signing clobbers the executable in some way, or (b) signing tools reject it as an executable with an invalid format. There are various workarounds with different trade-offs, but in my limited experience with code signing so far, the right answer is to just make executables that are of a valid structured format. It seems there was some work to do this with ELF in the tree already, but I'm not sure people on Linux care about code signing. (?) As such, please take a look at this patch: https://github.com/sbcl/sbcl/compare/master...stylewarning:sbcl:signable-executables The commit message describes everything which I won't recap here. The TL;DR for posterity: - It allows coreparse to understand when cores are located in an executable section on Windows and 64-bit Mac, while maintaining backward compatibility with the concatenated core. - It adds a utility script that allows taking a core + a runtime and creating a proper, signable executable. I don't really know the right place for the tools-for-build/make-embedded-core-executable.lisp file. It's not really a "tool for building". I originally extended S-L-A-D with additional options, but the code became a bloated mess of over 1000 lines of reading environment variables, parsing them, trying to find a working $CC, invoking linkers from the SBCL process, etc. I decided that if we want this to be "built-in" in the future, we can, but to start with the minimum useful surface area first. I also originally added the make-embedded...lisp file to install.sh, but removed it, since it might be confusing to users since it's not in the documentation anywhere. Perhaps most importantly, I am actively using this branch to produce valid, code-signed artifacts for Windows and Mac that "just work". Please let me know if you have any comments. Robert