Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support .NET on Apple Silicon with Rosetta 2 emulation #44897

Closed
5 of 6 tasks
sdmaclea opened this issue Nov 18, 2020 · 117 comments
Closed
5 of 6 tasks

Support .NET on Apple Silicon with Rosetta 2 emulation #44897

sdmaclea opened this issue Nov 18, 2020 · 117 comments
Labels
arch-arm64 area-VM-coreclr Bottom Up Work Not part of a theme, epic, or user story os-macos-bigsur (macOS11) runtime-coreclr specific to the CoreCLR runtime tracking-external-issue The issue is caused by external problem (e.g. OS) - nothing we can do to fix it directly User Story A single user-facing feature. Can be grouped under an epic.
Milestone

Comments

@sdmaclea
Copy link
Contributor

sdmaclea commented Nov 18, 2020

Apple has announced plans to transition its Mac hardware line to a new Arm64-based chip that they refer to as “Apple Silicon”.

Initial .NET support will be through .NET running on the Rosetta 2 emulator. Longer term native support for Apple Silicon is planned for .NET 6.

While it is hoped that Rosetta 2 emulation will just work, the .NET runtime is complicated and real issues will make this a non-trivial task.

Current known issues

  • Apple Silicon uses a 16K memory page size. The .NET 5 stack probe code doesn't handle this yet. [release/5.0] Use minimum supported PAGE_SIZE as stack probe step #45226. Per Apple this only affects the DTK and is fixed on M1 Silicon. Edit: I've verified that on real M1 device, the page size is 4K and the related issue doesn't occur.

  • Rosetta 2 emulation crashes with a fatal failure when calling with thread_get_state x86_FLOAT_STATE64. This is because the emulator does not emulate AVX support, but the function should simply return an error. Edit: This is fixed in the macOS 11.2 beta release.

  • Rosetta 2 emulation doesn't populate exceptionState.__trapno for other kernel entry than hardware exceptions (for example for syscalls). This means we fail to inject code necessary for garbage collection and sometimes deadlock. Edit: This is at least partially fixed in the macOS 11.2 beta release, but I can still see hangs during .NET runtime / tests managed parts compilation. It is being investigated at the Apple side.

  • With [release/5.0] Use minimum supported PAGE_SIZE as stack probe step #45226 & janvorli@aee81ac 19 runtime tests are failing under Rosetta 2 emulation which pass on macOS native x64
    All the coreclr Pri 1 tests are now passing except two tests (mentioned in the comments below) that are failing with: assertion failed: GPR thread_set_state is unsupported while in sa_tramp. (ThreadContextRegisterState.cpp:1250 thread_set_state_gpr_64)

  • Debugging using VS Code doesn't work. It was partially fixed in the macOS 11.2 beta release, now it is possible to successfully run an application under the debugger and break on a breakpoint. But attempt to single step or continue from that state still fails. It is caused by iret instruction emulation that doesn't honor the trace flag. Edit: This is fixed in macOS 11.2 beta 2

  • New issue in macOS 11.2 beta - dotnet build and posibly other .NET applications often fail with assertion failed [abi_info.u.translated_code.instruction_extents.kind == InstructionOffsetKind::Syscall]: on sigreturn exit path but instruction isn't marked as a syscall (ThreadContextRegisterState.cpp:381 x86_gpr_state_from_arm_state) Edit: This is fixed in macOS 11.2 beta 2

@sdmaclea sdmaclea added this to the 5.0.x milestone Nov 18, 2020
@sdmaclea sdmaclea added this to To do in Enable .NET Core on Apple Silicon via automation Nov 18, 2020
@Dotnet-GitSync-Bot Dotnet-GitSync-Bot added the untriaged New issue has not been triaged by the area owner label Nov 18, 2020
@Dotnet-GitSync-Bot
Copy link
Collaborator

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

@sdmaclea sdmaclea added arch-arm64 os-macos-bigsur (macOS11) runtime-coreclr specific to the CoreCLR runtime area-VM-coreclr Team Epic and removed untriaged New issue has not been triaged by the area owner labels Nov 18, 2020
@sdmaclea sdmaclea changed the title Support .NET Core 5 on Apple Silicon with Rosetta emulation Support .NET Core 5 on Apple Silicon with Rosetta 2 emulation Nov 18, 2020
@sdmaclea
Copy link
Contributor Author

@janvorli
Copy link
Member

I've modified the details on the __trapno issue.

@richlander richlander changed the title Support .NET Core 5 on Apple Silicon with Rosetta 2 emulation Support .NET 5 on Apple Silicon with Rosetta 2 emulation Nov 19, 2020
@k15tfu
Copy link
Contributor

k15tfu commented Nov 21, 2020

@richlander Is this issue also for .NET Core 3.1?

@mikaora
Copy link

mikaora commented Nov 22, 2020

.NET Core 3.1 support would be highly appreciated as it is the current LTS version thus being the version AWS Lambda supports as a runtime until next LTS version (.net 6).

@zwarich
Copy link

zwarich commented Nov 25, 2020

@sdmaclea I'm the main developer of Rosetta 2, and I'm particularly interested in the last item that you mention:

Several hundred runtime tests are failing under Rosetta 2 emulation which pass on macOS native x64

What's the simplest set of commands I can run on a runtime checkout to see these failures? I'm not completely clear on which combination of Release/Debug components I should be using.

@sdmaclea
Copy link
Contributor Author

@zwarich So the exact number of failing tests was actually 76. Rerunning the tests with #45226 fixed most of them.

The most of the remaining failed tests look like they are possibly related to division emulation. These are the currently failing tests:

# Divide modulo failures
./artifacts/tests/coreclr/OSX.x64.Release/JIT/IL_Conformance/Old/Conformance_Base/rem_i8/rem_i8.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/IL_Conformance/Old/Conformance_Base/div_i8/div_i8.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/Directed/coverage/oldtests/ovfldiv1_il_d/ovfldiv1_il_d.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/Directed/coverage/oldtests/ovflrem1_il_d/ovflrem1_il_d.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/Directed/coverage/oldtests/ovfldiv1_il_r/ovfldiv1_il_r.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/Directed/coverage/oldtests/ovflrem1_il_r/ovflrem1_il_r.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/DivConst_r/DivConst_r.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/ModConst_r/ModConst_r.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/DivConst_ro/DivConst_ro.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/ModConst_do/ModConst_do.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/DivConst_d/DivConst_d.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/ModConst_ro/ModConst_ro.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/DivConst_do/DivConst_do.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/CodeGenBringUpTests/ModConst_d/ModConst_d.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/jit64/regress/vsw/543645/test/test.sh

# Rosetta 2 CPU ID is not recognized (not surprising).
./artifacts/tests/coreclr/OSX.x64.Release/JIT/HardwareIntrinsics/X86/X86Base/CpuId_r/CpuId_r.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/HardwareIntrinsics/X86/X86Base/CpuId_ro/CpuId_ro.sh

# assertion failed: GPR thread_set_state is unsupported while in sa_tramp
./artifacts/tests/coreclr/OSX.x64.Release/JIT/Regression/CLR-x86-JIT/V1.1-M1-Beta1/b143840/b143840/b143840.sh
./artifacts/tests/coreclr/OSX.x64.Release/baseservices/exceptions/regressions/V1/SEH/VJ/ExternalException/ExternalException.sh

The simplest set of commands to build and reproduce the failed tests.

# build on macos x64 (Intel)

# checkout https://github.com/dotnet/runtime/tree/release/5.0
git checkout origin/release/5.0

# Install build dependencies (once) using homebrew 
brew bundle --no-lock --file eng/Brewfile

# Apply patches as needed
# See https://github.com/dotnet/runtime/pull/45226
# Possibly see https://github.com/dotnet/runtime/issues/45222#issuecomment-734016047

#build the .NET core runtime
./build.sh clr+libs -x64 -c release

# build the tests 
src/coreclr/build-test.sh -release -priority1

# compress tests on build host
tar -zcf rosetta5_4k.tgz artifacts/tests/coreclr/OSX.x64.Release artifacts/bin/coreclr/OSX.x64.Release artifacts/tests/coreclr/OSX.x64.Release/Tests/Core_Root artifacts/obj/coreclr/OSX.x64.Release/tests

# uncompress on Apple Silicon
tar -xf rosetta5_4k.tgz
# The individual test can be run like 
export test=./artifacts/tests/coreclr/OSX.x64.Release/JIT/IL_Conformance/Old/Conformance_Base/rem_i8/rem_i8.sh
chmod u+x $test
$test -coreroot=$PWD/artifacts/tests/coreclr/OSX.x64.Release/Tests/Core_Root

@zwarich
Copy link

zwarich commented Nov 26, 2020

@sdmaclea Thanks for the informative reply. I'll try to reproduce these failures on my own.

As far as #45226 is concerned, Rosetta 2 uses 4 KB pages on M1. The use of 16 KB pages was a limitation of the DTK. That said, you probably need the same fix for a native port.

@zwarich
Copy link

zwarich commented Nov 30, 2020

# Rosetta 2 CPU ID is not recognized (not surprising).
./artifacts/tests/coreclr/OSX.x64.Release/JIT/HardwareIntrinsics/X86/X86Base/CpuId_r/CpuId_r.sh
./artifacts/tests/coreclr/OSX.x64.Release/JIT/HardwareIntrinsics/X86/X86Base/CpuId_ro/CpuId_ro.sh

These actually pass on an M1 machine (rather than a DTK).

# assertion failed: GPR thread_set_state is unsupported while in sa_tramp
./artifacts/tests/coreclr/OSX.x64.Release/JIT/Regression/CLR-x86-JIT/V1.1-M1-Beta1/b143840/b143840/b143840.sh
./artifacts/tests/coreclr/OSX.x64.Release/baseservices/exceptions/regressions/V1/SEH/VJ/ExternalException/ExternalException.sh

I was running without the activations-via-signals patch, where you see a different issue, which can be worked around by using X86_FLOAT_STATE64 rather than X86_FLOAT_STATE.

This assertion indicates that one thread was trying to use thread_set_state on a thread that was logically in the first x86 instruction in userspace after signal delivery. This is not supported (at the moment) by Rosetta. However, it is also difficult to write a correct program that does this. In this case, the target thread was probably delivering INJECT_ACTIVATION_SIGNAL. This .NET runtime specifies that this signal be masked in its own handler, so the signal would be masked at this point. If you call thread_set_state on this thread, it will execute code elsewhere with the signal indefinitely masked, preventing further delivery of INJECT_ACTIVATION_SIGNAL. Of course, you could try to reset the signal mask in every function where you redirect control flow. In general, it's probably best to commit to using either Mach exceptions or BSD signals and not mix them too much.

There might be other issues that I am not aware of, but I have investigated all of the ones mentioned here and I believe they can all be addressed in Rosetta. There should be no workarounds required in .NET (at least on M1, as opposed to the DTK).

@sdmaclea What commands/scripts should I use to test further whether .NET is working correctly, e.g. longer tests and stress tests?

@janvorli
Copy link
Member

@zwarich thank you so much for all the insight! Regarding the INJECT_ACTIVATION_SIGNAL vs thread_set_state issue, with the change to use signal, we use the thread_set_state to redirect a thread only in case of a hardware exception (access violation, division by zero, ...) on that thread. From what you've said, it seems that such a mechanism cannot work on Rosetta in presence of any signals handling. So even if the didn't use a signal for activation injection, other process can still send a signal to the process running .NET app and result in the same assert in case it happened at the same time as a hardware exception. Such signals can be e.g. SIGCHLD, SIGINT, SIGTERM etc.
Just to make sure I fully understand what's going on, let me summarize it:

  • A signal is sent to a thread.
  • A hardware exception occurs on that thread. It can be e.g. dereferencing a null reference in managed code
  • OS suspends the thread and sends a message to an exception port
  • OS attempts to deliver the signal to the target thread since that thread is suspended, it doesn't change its context to point to the signal handler (thread_get_state still returns context of our code), but internally, it has some flag or something like that set that indicates that once that thread returns to user mode, it would start to execute the signal handler.
  • Our exception handling thread receives the hardware exception related message from the exception port. It tries to change its context to our exception handler function using the thread_set_state and then resume the thread. But the thread_set_state asserts.

Is there a way to workaround such an issue so that we can still redirect the failing thread to our code that can handle the exception? It seems that if thread_set_state returned an error code instead of asserting, we could possibly just resume the thread without changing the context. The signal handler would execute then and after it returns, the hardware exception triggering instruction would be re-executed, the whole process above will repeat, but this time the thread_set_state would succeed.
Or is there a way to somehow detect that the thread is going to handle a signal and skip the thread_set_state? I was originally thinking that the get_thread_state would return the context of the signal handler, but we have verified it is not the case and it still returns the context of the hardware exception point.

@sdmaclea
Copy link
Contributor Author

sdmaclea commented Nov 30, 2020

@zwarich Thanks.

We have lots of different stress test modes. We will try to light them up in CI when we get sufficient M1 hardware.

I am not sure which of them to point you at. There are a lot of tests. Many of them are focused on functional correctness and stressing the JIT or the GC. I am not sure how the coverage would be in terms of Rosetta emulation coverage.

  • @Maoni0 Do you recommend the full GC stress tests? The long running GC tests? Where would the best instructions currently reside?
  • @BruceForstall Do you recommend a particular set of JIT stress tests?
  • @danmosemsft Are there good instructions for running the Libraries tests manually?

One of the most difficult tests is actually getting the SDK stable enough to build a large project. So building the runtime on M1 might be a good smoke test. This was failing with deadlock 90% of the time. (Presumably due to the X86_FLOAT_STATE64 issue)

So you could build the native runtime on M1. Almost the same instruction I gave you above.

# build .NET 6.0 master on macos arm64 on (M1)
# checkout https://github.com/dotnet/runtime
git checkout origin/master

# Install build dependencies (once) using homebrew 
# Last I checked I had to hack this a bit to get it to work on DTK
# Last time I cheated and did 
#`arch -arch x86_64 brew bundle --no-lock --file eng/Brewfile` 
# for at least a subset of the dependencies
brew bundle --no-lock --file eng/Brewfile

# Apply patches as needed
# See https://github.com/dotnet/runtime/pull/45226
# Possibly see https://github.com/dotnet/runtime/issues/45222#issuecomment-734016047

#build the .NET core runtime
./build.sh clr+libs -arm64 -c release

# build the tests 
src/coreclr/build-test.sh -release -arm64 -priority1

@BruceForstall
Copy link
Member

I'd be surprised if JIT stress modes would exhibit uniquely challenging behavior on Rosetta. However, to run the most common JIT stress, set environment variable COMPlus_JitStress to 1 or 2 before running the tests. This requires you to be using a Checked (or Debug) build configuration (not Release), so, e.g., ./build.sh clr+libs -arm64 -c checked.

@sandreenko Can also advise.

GC Stress would likely be more "stressful" to the system. The two most common settings are setting environment variable COMPlus_GCStress to 3 or C. This works on a Release build as well as Checked.

btw, running the tests locally can be done with python ./src/tests/run.py and passing some number of arguments, depending on the setup (use -h to see the options).

@Maoni0
Copy link
Member

Maoni0 commented Nov 30, 2020

for GC you'd want to run the GC functional tests + stress which is documented here (it looks like when the test src was moved, this file was not moved) -

https://github.com/dotnet/coreclr/blob/release/3.0/tests/src/GC/Stress/stress_run_readme.txt

this should be in the same place in the new test src location.

@Maoni0
Copy link
Member

Maoni0 commented Nov 30, 2020

my bad...I forgot that the file was moved but to a different location. however the file, which is now at docs/workflow/testing/coreclr/gc-stress-run-readme.md, needs to be updated, and @cshung is working on updating it: #45392.

@sdmaclea
Copy link
Contributor Author

sdmaclea commented Nov 30, 2020

The two most common settings are setting environment variable COMPlus_GCStress to 3 or C

Per @janvorli gcstress mode C is not supported on macos yet. #42025

@janvorli
Copy link
Member

@danwalmsley thank you!

@richlander
Copy link
Member

I installed the .tar.gz option for 5.0.3 @ https://dotnet.microsoft.com/download/dotnet/5.0. Is that build unsigned? It is behaving as if it were (tons of malicious software warnings). If I use the .pkg option, I get expected behavior. I see the same behavior with the nightly 6.0 P1 build. I would like to use the .tar.gz option so that I can play with any .NET version privately (no global install).

Actual download: https://download.visualstudio.microsoft.com/download/pr/3de2d949-fcb5-4586-a217-2c33854d295f/943f0d92252338e11fd11b002a3a3861/dotnet-sdk-5.0.103-osx-x64.tar.gz

@richlander
Copy link
Member

I cannot get .NET 5 ASP.NET amd64 container images to work on M1. It is apparently supposed to work.

An Arm64 image works:

rich@MacBook-Air ~ % docker run --rm -p 8080:80  mcr.microsoft.com/dotnet/samples:aspnetapp

A small sample works with amd64:

docker run --platform linux/amd64 --rm -p 8080:80  mcr.microsoft.com/dotnet/samples

My experience with the aspnetapp sample as amd64:

rich@MacBook-Air ~ % docker run --platform linux/amd64 --rm -p 8080:80  mcr.microsoft.com/dotnet/samples:aspnetapp
Unhandled exception. System.IO.IOException: Function not implemented
   at System.IO.FileSystemWatcher.StartRaisingEvents()
   at System.IO.FileSystemWatcher.StartRaisingEventsIfNotDisposed()
   at System.IO.FileSystemWatcher.set_EnableRaisingEvents(Boolean value)
   at Microsoft.Extensions.FileProviders.Physical.PhysicalFilesWatcher.TryEnableFileSystemWatcher()
   at Microsoft.Extensions.FileProviders.Physical.PhysicalFilesWatcher.CreateFileChangeToken(String filter)
   at Microsoft.Extensions.FileProviders.PhysicalFileProvider.Watch(String filter)
   at Microsoft.Extensions.Configuration.FileConfigurationProvider.<.ctor>b__1_0()
   at Microsoft.Extensions.Primitives.ChangeToken.OnChange(Func`1 changeTokenProducer, Action changeTokenConsumer)
   at Microsoft.Extensions.Configuration.FileConfigurationProvider..ctor(FileConfigurationSource source)
   at Microsoft.Extensions.Configuration.Json.JsonConfigurationSource.Build(IConfigurationBuilder builder)
   at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build()
   at Microsoft.Extensions.Hosting.HostBuilder.BuildAppConfiguration()
   at Microsoft.Extensions.Hosting.HostBuilder.Build()
   at aspnetapp.Program.Main(String[] args) in /source/aspnetapp/Program.cs:line 16
qemu: uncaught target signal 6 (Aborted) - core dumped

@sdmaclea
Copy link
Contributor Author

@richlander Based on:

  • the qemu: uncaught target signal 6 (Aborted) - core dumped above
  • the docker M1 tech preview comment However, attempts to run Intel-based containers on Apple M1 machines can crash as QEMU sometimes fails to run the container.

I would assume docker is using qemu rather than Rosetta to make this work.

@sdmaclea
Copy link
Contributor Author

sdmaclea commented Feb 17, 2021

Is that build unsigned?

It appears to be unsigned.

dotnet is adhoc signed

$ codesign -dvvv dotnet
Executable=/Users/stmaclea/git/dotnet-sdk-5.0.103-osx-x64/dotnet
Identifier=dotnet-55554944b2da1d4ea11a33dbabc8bfe88ecd1722
Format=Mach-O thin (x86_64)
CodeDirectory v=20100 size=960 flags=0x2(adhoc) hashes=22+5 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=a73826b25ee1b05734de9ca3560c399a8fccac4d
CandidateCDHashFull sha256=a73826b25ee1b05734de9ca3560c399a8fccac4df0ce0a774e547440891312ee
Hash choices=sha256
CMSDigest=a73826b25ee1b05734de9ca3560c399a8fccac4df0ce0a774e547440891312ee
CMSDigestType=2
CDHash=a73826b25ee1b05734de9ca3560c399a8fccac4d
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=0 size=12

libraries are unsigned.

$ find . -name \*.dylib -print -exec codesign -dvvv '{}' ';'
./host/fxr/5.0.3/libhostfxr.dylib
./host/fxr/5.0.3/libhostfxr.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libcoreclr.dylib
./shared/Microsoft.NETCore.App/5.0.3/libcoreclr.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Native.dylib
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Native.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libSystem.IO.Compression.Native.dylib
./shared/Microsoft.NETCore.App/5.0.3/libSystem.IO.Compression.Native.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Security.Cryptography.Native.Apple.dylib
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Security.Cryptography.Native.Apple.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libmscordaccore.dylib
./shared/Microsoft.NETCore.App/5.0.3/libmscordaccore.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Net.Security.Native.dylib
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Net.Security.Native.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libmscordbi.dylib
./shared/Microsoft.NETCore.App/5.0.3/libmscordbi.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libhostpolicy.dylib
./shared/Microsoft.NETCore.App/5.0.3/libhostpolicy.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Security.Cryptography.Native.OpenSsl.dylib
./shared/Microsoft.NETCore.App/5.0.3/libSystem.Security.Cryptography.Native.OpenSsl.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libdbgshim.dylib
./shared/Microsoft.NETCore.App/5.0.3/libdbgshim.dylib: code object is not signed at all
./shared/Microsoft.NETCore.App/5.0.3/libclrjit.dylib
./shared/Microsoft.NETCore.App/5.0.3/libclrjit.dylib: code object is not signed at all
./packs/Microsoft.NETCore.App.Host.osx-x64/5.0.3/runtimes/osx-x64/native/libnethost.dylib
./packs/Microsoft.NETCore.App.Host.osx-x64/5.0.3/runtimes/osx-x64/native/libnethost.dylib: code object is not signed at all

@richlander
Copy link
Member

richlander commented Feb 18, 2021

Thanks on that. Sent mail to folks to get a resolution on the signing.

@leecow
Copy link
Member

leecow commented Feb 18, 2021

Hm, I downloaded and installed a fresh 5.0.103 from dot.net and everything checks out. Example ...

Executable=/usr/local/share/dotnet/host/fxr/5.0.3/libhostfxr.dylib
Identifier=libhostfxr
Format=Mach-O thin (x86_64)
CodeDirectory v=20500 size=3414 flags=0x10000(runtime) hashes=101+2 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=a9b0dd7d25ba9fb90f955011ffb78e5133c545e1
CandidateCDHashFull sha256=a9b0dd7d25ba9fb90f955011ffb78e5133c545e1d585791fb9a695056e92adc0
Hash choices=sha256
CMSDigest=a9b0dd7d25ba9fb90f955011ffb78e5133c545e1d585791fb9a695056e92adc0
CMSDigestType=2
CDHash=a9b0dd7d25ba9fb90f955011ffb78e5133c545e1
Signature size=8978
Authority=Developer ID Application: Microsoft Corporation (UBF8T346G9)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Jan 25, 2021 at 5:54:12 PM
Info.plist=not bound
TeamIdentifier=UBF8T346G9
Runtime Version=10.15.0
Sealed Resources=none
Internal requirements count=1 size=172

cc @rbhanda @mmitche

@sdmaclea
Copy link
Contributor Author

@mmitche
Copy link
Member

mmitche commented Feb 18, 2021

Where are the download.visualstudio.com links populated from?

@rbhanda
Copy link
Contributor

rbhanda commented Feb 18, 2021

https://github.com/dotnet/core/blob/master/release-notes/5.0/releases.json is the one which drives the downloads. These are generated during the release process and the bits are tested and picked from the release file drops.

@leecow
Copy link
Member

leecow commented Feb 18, 2021

I believe we only sign and notarize pkgs. @mmitche, can you confirm that?

@mmitche
Copy link
Member

mmitche commented Feb 18, 2021

I believe that is correct. I don't think you can notarize a non-pkg.

@sdmaclea
Copy link
Contributor Author

sdmaclea commented Feb 18, 2021

We need to create an issue for this somewhere.

  • It makes no sense for us to distribute unsigned macos tar.gz on our release download pages. They will trigger malicious code warnings on BigSur (at least on Apple Silicon)
  • We have the signed files in our installer pkg
  • Macos does have signing tools to sign files codesign -s <signing cert> <path-to-sign>

@janvorli
Copy link
Member

I think it still makes sense to distribute macos tar.gz. We've been doing that forever and I was always using that package and never had any issues except of the M1. It still works on my Mac Mini x64 with BigSur installed and SIP enabled. Our builds use the .tar.gz packages too without problems.

@sdmaclea
Copy link
Contributor Author

Ack. We should create an issue. So we can have a formal discussion in an appropriate place.

@ViktorHofer
Copy link
Member

It makes no sense for us to distribute unsigned macos tar.gz on our release download pages. They will trigger malicious code warnings on BigSur (at least on Apple Silicon)

cc @mmitche

@mmitche
Copy link
Member

mmitche commented Feb 18, 2021

I think this could be done in 5.0 reasonably easily, and I think it would apply to the current 6.0 process. Otherwise we could modify the post-build signing in 6.0 to handle tar.gz files.

@deeprobin
Copy link
Contributor

Is this still relevant for the .NET 5 milestone? (The EOS for this version is already on May 8, 2022).

@danmoseley
Copy link
Member

@richlander for that q.

@jkotas
Copy link
Member

jkotas commented Feb 4, 2022

.NET 6 is the first fully supported SDK for Rosetta 2 emulation.

See dotnet/sdk#22380 for details.

@jkotas jkotas closed this as completed Feb 4, 2022
Enable .NET Core on Apple Silicon automation moved this from In progress to Done Feb 4, 2022
@dotnet dotnet locked as resolved and limited conversation to collaborators Mar 6, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
arch-arm64 area-VM-coreclr Bottom Up Work Not part of a theme, epic, or user story os-macos-bigsur (macOS11) runtime-coreclr specific to the CoreCLR runtime tracking-external-issue The issue is caused by external problem (e.g. OS) - nothing we can do to fix it directly User Story A single user-facing feature. Can be grouped under an epic.
Development

No branches or pull requests