Walletwasabi: Deterministic build fails on macOS

[molnard]

According to Apple documentation, the signature that is used to ensure the integrity of the software is added into the binary itself - so it will manipulate the content of the files.

If the code is universal, the object code for each slice (architecture) is signed separately. This signature is stored within the binary file itself.

Source

According to this, it is impossible to have both deterministic build and code signature on macOS. macOS Gatekeeper won't let you run software without it - thus code signature is prior to the deterministic build.

With the following method you can check the differences by yourself:
You will need to install 7z (or something else) to extract the .dmg. You can do that using sudo apt install p7zip-full command.

7z x Wasabi-1.1.6.dmg -oWasabiOsx
git diff --no-index osx-x64/ WasabiOsx/Wasabi\ Wallet.App/Contents/MacOS/

Related:
https://github.com/zkSNACKs/WalletWasabi/issues/4077

[crwatkins]

From the bitcoin.org issue two questions (not recommendations):

Would it be possible to create a tool to compare the images while ignoring the signature (or perhaps a tool that replaces the signature with a known value)?

Would it be possible to create two distributions for MacOS, one signed to keep Gatekeeper happy and one built deterministically to keep those happy that might value that more?

[nopara73]

@molnard What if we would stop ensuring deterministic builds for installable releases and start releasing portable and only PGP signed releases instead? This way we could have CI to make sure determinism isn't broken by anyone and thus it'd be future proof.