Add managed MachO signing

[jtschuster]

Moving #107378 to a new PR since it now has little shared history.

This signer is byte-for-byte identical to the output of codesign except for padding at the end of the file and the corresponding size fields in the headers.

The MachObjectFile and CodeSignature store all the relevant headers and signature information to add/remove a signature from a Mach Object. Most other files are details regarding header format and reading files with different endianness.

The new signer uses a MemoryMappedViewAccessor instead of a Stream. Since memory mapped files can't be resized, MachObjectFile.CreateAdHocSignature() will write out the headers and load commands to the memory mapped file, but not the signature blob. The signature blob will instead be written to the destination file stream after the rest of the file is copied from the memory mapped file.

The signature is composed of an EmbeddedSignature superblob with an ID and offset of 3 following blobs, followed by a CodeDirectory blob, an empty Requirements blob, and an empty CMS blob. The empty Requirements blob and an empty CMS blob are not strictly required but are added for compatibility with codesign. The CodeDirectory includes the identifier string, hashes of each page of the file and information required to verify the hashes.

The signing process for an unsigned executable extends the __LINKEDIT segment (which is always at the end of the file) to make room for the signature blob, writes the signature blob to that location, and adds a CodeSignature load command that points the the signature. If the executable was already signed, it simply clears the old signature and replaces it, extends or shrinks the existing __LINKEDIT size and updates the existing CodeSignature load command.

[am11]

HostActivation.Tests.SelfContainedAppLaunch.RelativeEmbeddedPath is failing on osx-x64:

System.ComponentModel.Win32Exception : An error occurred trying to start process '/Users/runner/work/1/s/artifacts/tests/host/osx.x64.Release/ha/4ishikta.mrd/HelloWorld/sub/HelloWorld' with working directory '/Users/runner/work/1/s/artifacts/bin/HostActivation.Tests/Release/net9.0'. Exec format error

[agocke]

Could you add a short description of what ad hoc codesigning actually does?

[elinor-fung]

Thank you! This looks good to me.

Some things for your list of existing follow-ups:

• I think the SDK only enables signing when actually running on macOS - with this, I think we can/should update that default.
• Tests in dotnet/sdk for cross-building for osx-<arch> and signing on non-macOS

[jtschuster]

/ba-g WASM timeout, sporadic failure.