gdal signing issue on M1

[rundel]

I've recently run into a strange issue where just linking to gdal causes the resulting binary to killed immediately when run. The basic reprex I've been able to create as follows:

gdal_test.cpp:

#include <iostream>

int main(int argc, char *argv[]) {
    std::cout << "Hello world!\n";
    return(0);
}

which is compiled with

clang++ -std=gnu++11 \
    -L/opt/homebrew/Cellar/gdal/3.4.2_1/lib -lgdal \
    -o gdal_test test.cpp

and then run and produces the following output

./gdal_test
[1]    3795 killed     ./gdal_test

If the -lgdal flag is removed then the binary can be run successfully - trying with other related libraries (e.g. -lgeos, -lproj, etc.) all work as expected.

In looking at log entries in console there is a crash log and an ips file is created, the contents of which are available here.

The most relevant aspect appears to be EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid)) which from some googling appears to be related to dylib signing cache.

I'm not super familiar with the code signing process but it does appear that the dylib is signed (adhoc):

codesign -dv /opt/homebrew/Cellar/gdal/3.4.2_1/lib/libgdal.30.dylib
Executable=/opt/homebrew/Cellar/gdal/3.4.2_1/lib/libgdal.30.dylib
Identifier=libgdal.30
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=136771 flags=0x2(adhoc) hashes=4269+2 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=0 size=12

So I am at a loss as what to do next - I've reinstalled and rebuild the formula as well as all formula dependencies.

[carlocab]

What is the output of brew config and brew doctor?

[rundel]

~/tmp/gdal_test » brew config                                                                                                                                      rundel@magsafe
HOMEBREW_VERSION: 3.4.4-32-gdb723f5
ORIGIN: https://github.com/Homebrew/brew
HEAD: db723f5dd7a1488586f866310da540d04a53a290
Last commit: 4 hours ago
Core tap ORIGIN: https://github.com/Homebrew/homebrew-core
Core tap HEAD: 7399aa237d5dc7a36d61b06f7d26edb296708d93
Core tap last commit: 69 minutes ago
Core tap branch: master
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_CORE_GIT_REMOTE: https://github.com/Homebrew/homebrew-core
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.D4xn9gy2IZ/org.xquartz:0
HOMEBREW_EDITOR: code
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 2.6.8 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 13.1.6 build 1316
Git: 2.35.1 => /opt/homebrew/bin/git
Curl: 7.79.1 => /usr/bin/curl
macOS: 12.3-arm64
CLT: 13.3.0.0.1.1645755326
Xcode: 13.3
Rosetta 2: false
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
~/tmp/gdal_test » brew doctor                                                                                                                                      rundel@magsafe
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  szip

Warning: Unbrewed dylibs were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae, and may need to be deleted.

Unexpected dylibs:
  /usr/local/lib/libwkhtmltox.0.12.6.dylib

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae, and may need to be deleted.

Unexpected header files:
  /usr/local/include/wkhtmltox/image.h
  /usr/local/include/wkhtmltox/pdf.h

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  numpy
  sip
  protobuf

[rundel]

I was just able to find the issue - apparently the signing issue was with nss, specifically libnss3.dylib. Forcing nss to reinstall solved the issue.

I was able to identify the specific issue by looking at the console again, specifically one of the early kernel log messages included the following details:

CODE SIGNING: process 13161[gdal_test]: rejecting invalid page at address 0x105ad0000 from offset 0x0 in file "/opt/homebrew/Cellar/nss/3.76/lib/libnss3.dylib" (cs_mtime:1646417781.364681626 == mtime:1646417781.364681626) (signed:1 validated:1 tainted:1 nx:0 wpmapped:0 dirty:0 depth:0)

[Bo98]

A week ago, we had a very brief (1 hour) interval where there was a bug with codesigning for those with developer mode enabled. It's possible you were unlucky and got hit by that.

brew reinstall is indeed the solution for those cases.