# Reproducible codesigning on Apple Silicon

DevFeed: [Reproducible codesigning on Apple Silicon](<https://devfeed.tech/articles/reproducible-codesigning-on-apple-silicon-25405.md>)

Original publisher: [Read original article](<https://smileykeith.com/2021/10/05/codesign-m1/>)

Author: Keith Smiley

Published: 2021-10-06T03:00:00Z

Content type: article

Language: en

Sources: [Keith Smiley](<https://devfeed.tech/sources/keith-smiley.md>)

Topics: [Arm](<https://devfeed.tech/topics/arm.md>), [x86](<https://devfeed.tech/topics/x86.md>), [C](<https://devfeed.tech/topics/c.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [toolchain](<https://devfeed.tech/topics/toolchain.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [apple](<https://devfeed.tech/tags/apple.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [arm](<https://devfeed.tech/tags/arm.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [c](<https://devfeed.tech/tags/c.md>), [clang](<https://devfeed.tech/tags/clang.md>), [code](<https://devfeed.tech/tags/code.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [identifier](<https://devfeed.tech/tags/identifier.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [reproducible-builds](<https://devfeed.tech/tags/reproducible-builds.md>), [signing](<https://devfeed.tech/tags/signing.md>), [source](<https://devfeed.tech/tags/source.md>), [x86](<https://devfeed.tech/tags/x86.md>)

## AI overview

The article explains why codesigning universal macOS binaries can produce different results on Apple Silicon and Intel Macs, despite the binaries being identical before signing. It traces the issue through Apple's open-source code and identifies architecture-dependent UUID handling as the cause of non-reproducible codesigning.

## Source excerpt

For people who expect reproducible builds, Apple Silicon machines provide an interesting challenge. Apple Silicon requires arm64 binaries, including command line tools you build yourself, be codesigned. This change is mostly transparent to developers, because Apple updated their linker to automatically ad-hoc sign binaries1. Unfortunately, if you're interested in producing binaries that support both Intel Macs and Apple Silicon Macs, you likely want to produce a fat binary. When codesigning this binary you hit some behavior that depends on your current machine's architecture. Example You can consistently produce the same result across multiple machines when compiling a binary without signing it. Here's an example with a simple C program: $ echo "int main() { return 0; }" > main.c $ clang main.c -Wl,-no_adhoc_codesign -arch arm64 -arch x86_64 -o main $ shasum main 113033b3d9a247210b49a476bbfadb2e347846fe main The shasum of main should always be the same regardless of your host machine2. On Apple Silicon machines you can see this binary has the same sha1 even if you run clang under Rosetta 23: $ arch -x86_64 clang main.c -Wl,-no_adhoc_codesign -arch arm64 -arch x86_64 -o main $ shasum main 113033b3d9a247210b49a476bbfadb2e347846fe main The issue is introduced when you codesign the binary on Apple Silicon machines versus Intel machines. You can immediately see the difference3: $ codesign --force --sign - main $ shasum main 84631e812bd480c306766ba03a728dd2565dd672 main % arch -x86_64 codesign --force --sign - main % shasum main f631b6c0daf3ffd0bb5f65d19fa045acf447a72d main We get closer to identifying the problem when you compare the details of these differences: $ codesign --force --sign - main $ codesign -dvvv main > arm.txt 2>&1 $ arch -x86_64 codesign --force --sign - main $ codesign -dvvv main > intel.txt 2>&1 $ diff -Nur intel.txt arm.txt --- intel.txt 2021-10-05 21:26:32.731918710 -0700 +++ arm.txt 2021-10-05 21:26:29.473702845 -0700 @@ -1,14 +1,14 @@ Executable=/