Mac OS X support #15

rfjakob · 2016-01-04T09:21:34Z

Go support Mac OS X, as does the FUSE library we use, go-fuse.

gocrypts may actually work out of the box on OSX, but there probably are small issues that have to be sorted out.

At the very least, gocryptfs has to be tested on OSX. As I do not have a Mac to test on, this would be an opportunity for somebody from the Mac community to step up. Please comment here if you are interested.

hasit · 2016-01-06T09:28:47Z

I am interested in helping on this as much as I can. I will try to run it and comment back with what I find.

rfjakob · 2016-01-06T13:21:59Z

Hi @hasit, great to hear that!

netheril96 · 2016-01-06T18:03:07Z

One thing it might have omitted is encryption of extended attributes. OS X makes extensive usage of extended attributes. For example, when you download a file with Google Chrome or Safari, the file will be marked with its original URL. When I tried EncFS before, the encrypted file always had the same extended attributes as the decrypted one, and thereby the plaintext could be easily obtained. I suspect the encryption of extended attribute will never cross the mind of regular Linux folk.

rfjakob · 2016-01-06T18:12:28Z

Extended attributes are not implemented yet in gocryptfs. I don't know how big a problem that is on OSX, but at least we cannot leak data ;)

spaghetti2514 · 2016-01-06T23:25:03Z

Attempting to install on OS X 10.11.2 with go get github.com/rfjakob/gocryptfs, I get the following

# github.com/rfjakob/gocryptfs/cryptfs
.go/src/github.com/rfjakob/gocryptfs/cryptfs/openssl_aead.go:35: undefined: openssl.NewGCMEncryptionCipherCtx
.go/src/github.com/rfjakob/gocryptfs/cryptfs/openssl_aead.go:76: undefined: openssl.NewGCMDecryptionCipherCtx
# github.com/hanwen/go-fuse/fuse/nodefs
.go/src/github.com/hanwen/go-fuse/fuse/nodefs/files_darwin.go:5: imported and not used: "time"
.go/src/github.com/hanwen/go-fuse/fuse/nodefs/syscall.go:11: undefined: syscall.SYS_UTIMENSAT

rfjakob · 2016-01-07T00:28:40Z

@spaghetti2514 : Interesting. Can you run "openssl version" and post the output?

spaghetti2514 · 2016-01-07T00:32:13Z

@rfjakob OpenSSL 1.0.2e 3 Dec 2015

spaghetti2514 · 2016-01-07T00:34:36Z

I should point out that this probably has more to do with
https://github.com/spacemonkeygo/openssl/blob/master/ciphers_gcm.go#L15
than my openssl version

Removing the ",!darwin" part of that line eliminates those two errors for me

rfjakob · 2016-01-07T00:43:09Z

I guess the "!darwin" is because openssl was too old in an earlier OSX
version. But 1.0.2e is very recent, can you file a bug against
spacemonkeygo/openssl?

On Thu, Jan 7, 2016 at 1:34 AM, spaghetti2514 notifications@github.com
wrote:

I should point out that this probably has more to do with
https://github.com/spacemonkeygo/openssl/blob/master/ciphers_gcm.go#L15
than my openssl version

Removing the ",!darwin" part of that line eliminates those two errors for
me

—
Reply to this email directly or view it on GitHub
#15 (comment).

spaghetti2514 · 2016-01-07T00:55:41Z

1.0.2e is very recent because I installed it very recently. It is not the native OS X openssl because the native OS X openssl no longer exists. Apple deprecated the use of openssl a long time ago in favor of their own crypto libs, and finally stopped shipping openssl completely in 10.11. OS X users that still build things against openssl tend to install it from homebrew, an unofficial package manager for OS X.

I am unsure if excluding OS X in the build process should be considered a bug, since the only reason it works for me is that I'm building openssl myself via homebrew.
On the other hand, there is no longer an official openssl shipped with OS X at all, so maybe that should be assumed.
Still want me to open a bug report?

rfjakob · 2016-01-07T01:17:42Z

In that case, it makes no sense at all anymore to exclude gcm from the build. Yes please file a ticket. I will take care of the other two issues as I am afraid I have caused them.

spaghetti2514 · 2016-01-07T01:23:26Z

I have filed a ticket.

What other two issues are you referring to? just the unused time import and SYS_UTIMENSAT problems in go-fuse?

I think we'll run into other problems after that, as commenting some of that out to try to get farther along in the build reveals other build errors, but I can't be certain that they're not being caused by the way I'm stepping around previous errors.
Would you like me to wait until you've properly fixed the SYS_UTIMENSAT issue before checking for other errors?

rfjakob · 2016-01-07T01:26:56Z

Yes, just the two in go-fuse. Commenting them out should be fine. Later
build problems are probably real, what do you get?
On Jan 7, 2016 02:23, "spaghetti2514" notifications@github.com wrote:

I have filed a ticket.

What other two issues are you referring to? just the unused time import
and SYS_UTIMENSAT problems in go-fuse?

I think we'll run into other problems after that, as commenting some of
that out to try to get farther along in the build reveals other build
errors, but I can't be certain that they're not being caused by the way I'm
stepping around previous errors.
Would you like me to wait until you've properly fixed the SYS_UTIMENSAT
issue before checking for other errors?

—
Reply to this email directly or view it on GitHub
#15 (comment).

spaghetti2514 · 2016-01-07T01:30:57Z

After bypassing SYS_UTIMENSAT in syscall.go I get

# github.com/hanwen/go-fuse/fuse/pathfs
.go/src/github.com/hanwen/go-fuse/fuse/pathfs/loopback.go:140: undefined: sysUtimensat
.go/src/github.com/hanwen/go-fuse/fuse/pathfs/loopback.go:140: undefined: _AT_SYMLINK_NOFOLLOW

After commenting out line 140 in loopback.go and changing the return err to return 0, I get

# github.com/rfjakob/gocryptfs/pathfs_frontend
.go/src/github.com/rfjakob/gocryptfs/pathfs_frontend/file.go:213: undefined: syscall.Fallocate

After replacing line 213 in file.go with err = syscall.EINTR, the build succeeds.

rfjakob · 2016-01-07T21:35:14Z

Ok, I hope I have fixed all of this, but I do not have a Mac to test on. @spaghetti2514 , can you

"git pull" in gocryptfs
Replace hanwen/go-fuse with my branch that has the OSX build fix: https://github.com/rfjakob/go-fuse . I will get it upstream once you confirm it fixes the issue (and works).

spaghetti2514 · 2016-01-08T22:50:17Z

@rfjakob

go-fuse/fuse/nodefs/files_darwin.go:74: cannot use int64(t.Nanosecond() / 1000) (type int64) as type int32 in assignment

Edit: bypassing that leads to

go-fuse/fuse/pathfs/loopback_darwin.go:44: syntax error: unexpected name, expecting )

rfjakob · 2016-01-08T23:29:14Z

Thanks, should be fixed, please pull go-fuse.

spaghetti2514 · 2016-01-09T03:16:51Z

# github.com/rfjakob/go-fuse/fuse/pathfs
.go/src/github.com/rfjakob/go-fuse/fuse/pathfs/loopback_darwin.go:33: undefined: time in time.Time
.go/src/github.com/rfjakob/go-fuse/fuse/pathfs/loopback_darwin.go:42: undefined: time in time.Time
.go/src/github.com/rfjakob/go-fuse/fuse/pathfs/loopback_darwin.go:56: undefined: f in f.lock
.go/src/github.com/rfjakob/go-fuse/fuse/pathfs/loopback_darwin.go:58: undefined: f in f.lock

spaghetti2514 · 2016-01-09T03:43:52Z

Other various things

go-fuse/fuse/pathfs/loopback_darwin.go:35: cannot use int64(t.Nanosecond() / 1000) (type int64) as type int32 in assignment

gocryptfs/pathfs_frontend/compat_darwin.go:3: imported and not used: "syscall"

gocryptfs/pathfs_frontend/compat_darwin.go:13: missing return at end of function

rfjakob · 2016-01-09T10:56:44Z

Ok, I need a cross compiler ;)
I will get back to you once I have it building.

rfjakob · 2016-01-09T12:14:53Z

Turns out that for cross compilation to work, I would need the C header files from OSX, because go-fuse uses cgo. And to get those, I'd have to extract them from XCode on a running OSX machine. OMG.

@spaghetti2514 : The things you have reported should be fixed, please pull. If you still have the patience, I think we are done soon.

hasit · 2016-01-09T20:32:13Z

I can confirm the same error. Following is the output I get on my MacBook Pro (Retina, 13-inch, Late 2013) OSX El Capitan version 10.11.2 .

# github.com/hanwen/go-fuse/fuse/nodefs
go/src/github.com/hanwen/go-fuse/fuse/nodefs/files_darwin.go:5: imported and not used: "time"
go/src/github.com/hanwen/go-fuse/fuse/nodefs/syscall.go:11: undefined: syscall.SYS_UTIMENSAT
# github.com/spacemonkeygo/openssl
go/src/github.com/spacemonkeygo/openssl/bio.go:21:10: fatal error: 'openssl/bio.h' file not found
#include <openssl/bio.h>
         ^
1 error generated.

rfjakob · 2016-01-09T20:37:18Z

Hasit, you need to replace go-fuse with my branch, and you need openssl installed. The errors you see are already fixed.

spaghetti2514 · 2016-01-09T22:44:46Z

@rfjakob Build succeeds with latest changes

rfjakob · 2016-01-09T23:07:50Z

Great. Pushed to upstream as hanwen/go-fuse#89 .

./test.bash ?

spaghetti2514 · 2016-01-09T23:30:43Z

ok      github.com/rfjakob/gocryptfs/cryptfs    1.886s
gocryptfs v0.7.1; on-disk format 2
remove /tmp/gocryptfs_main_test//TestExampleFsV04: resource busy
FAIL    github.com/rfjakob/gocryptfs/integration_tests  0.055s

Edit: That was caused by running the script twice when the first one failed to unmount any of the temporary filesystems. After unmounting the filesystems in /tmp and trying again I got

ok      github.com/rfjakob/gocryptfs/cryptfs    1.828s
gocryptfs v0.7.1; on-disk format 2
--- FAIL: TestExampleFSv04 (0.96s)
    example_filesystems_test.go:21: open /tmp/gocryptfs_main_test/TestExampleFsV04/status.txt: no such file or directory
--- FAIL: TestExampleFSv05 (0.14s)
    example_filesystems_test.go:21: open /tmp/gocryptfs_main_test/TestExampleFsV05/status.txt: no such file or directory
--- FAIL: TestExampleFSv06 (0.12s)
    example_filesystems_test.go:21: open /tmp/gocryptfs_main_test/TestExampleFsV06/status.txt: no such file or directory
--- FAIL: TestExampleFSv06PlaintextNames (0.10s)
    example_filesystems_test.go:21: open /tmp/gocryptfs_main_test/TestExampleFsV06PlaintextNames/status.txt: no such file or directory
exec: "fusermount": executable file not found in $PATH
exit status 10
FAIL    github.com/rfjakob/gocryptfs/integration_tests  3.267s

fusermount is linux-specific by the way. Normal umount works fine for fuse filesystems on OS X

spaghetti2514 · 2016-03-30T13:40:11Z

@rfjakob The OS X issue at spacemonkeygo/openssl has not been addressed at all in months.
Would you consider forking it, making the small change yourself, and having gocryptfs depend on your fork instead? Considering how infrequently changes are made to the repo, it shouldn't be much effort at all for you to "maintain" and would allow you to address issues like this much more efficiently.

alexanderharm · 2017-12-16T12:30:48Z

@teras: I created a Homebrew formula which can only be merged if the load_osxfuse issue is solved upstream.

In order for the installation to work you need to tick the option Allow apps downloaded from: App Store and identified developers under the Security & Privacy-tab in System Preferences!

First install OSXFuse from the website (https://osxfuse.github.io/) or via brew:

brew cask install osxfuse

Afterwards you need to reboot your machine.

Install gocryptfs from a local tap for now:

brew install alexanderharm/homebrew-gocryptfs/gocryptfs

I tested this successfully on my machine (macOS Sierra) and it also seems to run fine on @teras' machine running macOS High Sierra.

@rfjakob: maybe this can be added to the docs once it is merged into homebrew-core?

Edit: Updated installation procedure based on the feedback of @teras.

teras · 2017-12-19T14:34:35Z

@alexanderharm I got this message when I use the application:

alexanderharm · 2017-12-19T14:46:00Z

@teras: When did you get this message? I believe this is related to the installation of osxfuse since Benjamin Fleischer is one of the authors: https://osxfuse.github.io/.

If you feel more comfortable you can also download and install osxfuse from this website and then install only gocryptfs via brew.

teras · 2017-12-19T15:15:26Z

Everything went smooth up to the time I typed
gocryptfs cipher plain
(from the demo instructions on the site).

The second time I typed them, no message was displayed, only failing:
fuse.NewServer failed: exit status 1
Maybe you should run: /Library/Filesystems/osxfuse.fs/Contents/Resources/load_osxfuse

Now, I tried what you said. Indeed the installer asked me to open Settings - I did so but there was no option to allow anything.
Since I am using OSX High Sierra, maybe they changed something there?

alexanderharm · 2017-12-19T15:30:56Z

@teras: Normally it should work. Did you brew cask uninstall osxfuse before? Do you have the FUSE preference pane?

alexanderharm · 2017-12-19T15:33:05Z

@teras: Under Security & Privacyyou need to tick the option Allow apps downloaded from: App Store and identified developers. It sounds like you are using App Store only.

teras · 2017-12-19T16:12:23Z

@alexanderharm Indeed this is the case. It seems to work now. Thank you

alexanderharm · 2018-02-02T12:47:40Z

As of today there is a Homebrew formula for gocryptfs.

Install brew and type brew install gocryptfs.

agarbato · 2019-10-27T11:48:30Z

Just updated my macos to Catalina and gocryptfs does not work anymore :-(
gocryptfs installed with brew. Used to work before the update.

➜ ~ gocryptfs src dest
Password:
Decrypting master key
fuse.NewServer failed: exit status 2
Maybe you should run: /Library/Filesystems/osxfuse.fs/Contents/Resources/load_osxfuse

agarbato · 2019-10-27T11:58:32Z

I got it fixed after installing osxfuse.
I guess the update deleted it?
brew cask install osxfuse

ijoseph · 2020-03-03T18:07:28Z

Seconding @agarbato . Stopped working when I updated to Catalina.brew install gocryptfs didn't do anything (even when I forced a reinstall). However, brew cask install osxfuse fixed it.

Jumanjii · 2021-01-28T11:00:39Z

For those that already had fuse installed before, doing brew reinstall osxfuse solved the issue in my case.

cocoonkid · 2021-04-14T19:17:06Z

brew install gocryptfs
Error: gocryptfs has been disabled because it requires FUSE!

But I have macFUSE installed 4.10 @ BigSour.

What could the issue be?

JayBrown · 2021-04-14T19:28:16Z

macFUSE is closed source, and therefore Homebrew is blocking all formulae that depend on it.

alexanderharm · 2021-04-14T21:51:31Z

This could be fixed, see e. g. https://github.com/borgbackup/homebrew-tap/blob/master/Formula/borgbackup-fuse.rb, no?

Unfortunately this requires maintaining your own tap. So if you create a repo named homebrew-gocryptfs I could submit a pr.

cocoonkid · 2021-04-17T14:38:07Z

@JayBrown thank you for the explanation.

rfjakob · 2021-04-18T09:21:10Z

Excuse my ignorance, but doesn't homebrew also include lots of closed-source stuff like Microsoft Office?

cocoonkid · 2021-04-20T21:28:49Z

@rfjakob yes as casks. most recent command e.g. brew install --cask <appname>

rfjakob · 2021-05-03T09:52:41Z

Ok. I see that macfuse is available as a cask: https://formulae.brew.sh/cask/macfuse
So if gocryptfs becomes a cask that would solve the problem?

JayBrown · 2021-05-03T10:12:01Z

Yes, that would probably work. But I assume you would need to pre-build gocryptfs for macOS then… as a Universal 2 binary for arm64 & x86_64.

litori · 2021-05-04T00:43:03Z

Anyway we can get gocryptfs to work with Macfuse 4.1 for the M1? We have no way to use the old osxfuse since Big Sur does not support it.

dsuievalov · 2021-06-08T16:53:44Z

@litori

Install Macfuse
Install go
Download / Clone this repository
Run bash ./build-without-openssl.bash which will produce the gocryptfs binary without openssl libs support (bad performance on M1);
Add ${HOME}/go/bin/gocryptfs to your PATH variable: PATH="${PATH}:${HOME}/go/bin/gocryptfs"

More details in a correspondence - #556

MarcelBochtler · 2021-06-19T20:46:18Z

gocryptfs can now also be installed using MacPorts.
It installs macfuse and macports (by default without openssl) for you.

sudo port install gocryptfs

This should work out of the box for Intel as well as for M1 Macs.

AlexBasile123 · 2021-11-21T06:41:24Z

M1 has an issue w/ pandoc dependency. Please advise.

% sudo port install gocryptfs
Password:
---> Computing dependencies for gocryptfs
Error: Cannot install gocryptfs for the arch 'arm64' because
Error: its dependency pandoc only supports the arch 'x86_64'.
Error: Follow https://guide.macports.org/#project.tickets if you believe there is a bug.
Error: Processing of port gocryptfs failed

rfjakob · 2021-11-21T07:05:19Z

pandoc is only needed to generate the man page, gocryptfs itself does not need it

MarcelBochtler · 2021-11-21T10:51:21Z

M1 has an issue w/ pandoc dependency. Please advise.

Hi @AlexBasile123, unfortunately pandoc does not provide an arm64 release yet (See: jgm/pandoc#6960)
I'll look into the gocryptfs port to remove the dependency for M1 Macs for now.

MarcelBochtler · 2021-11-21T16:58:20Z

Fixed the build for M1 Macs.
See: macports/macports-ports#13069

AlexBasile123 · 2021-11-22T01:32:18Z

pandoc is only needed to generate the man page, gocryptfs itself does not need it

Thanks @rfjakob for quick feedback!

AlexBasile123 · 2021-11-22T01:32:45Z

Thanks @MarcelBochtler for getting the fix out so quickly! The change is working on M1 now

rfjakob added feature request help wanted labels Jan 4, 2016

spaghetti2514 mentioned this issue Jan 7, 2016

GCM ciphers not built on OS X even when installed OpenSSL supports them spacemonkeygo/openssl#48

Closed

cocoonkid mentioned this issue Apr 20, 2021

gocryptfs on macOS BigSur, Apple M1 #556

Open

Mac OS X support #15

Mac OS X support #15

Comments

rfjakob commented Jan 4, 2016

hasit commented Jan 6, 2016

rfjakob commented Jan 6, 2016

netheril96 commented Jan 6, 2016

rfjakob commented Jan 6, 2016 via email

spaghetti2514 commented Jan 6, 2016

rfjakob commented Jan 7, 2016 via email

spaghetti2514 commented Jan 7, 2016

spaghetti2514 commented Jan 7, 2016

rfjakob commented Jan 7, 2016

spaghetti2514 commented Jan 7, 2016

rfjakob commented Jan 7, 2016 via email

spaghetti2514 commented Jan 7, 2016

rfjakob commented Jan 7, 2016

spaghetti2514 commented Jan 7, 2016

rfjakob commented Jan 7, 2016

spaghetti2514 commented Jan 8, 2016

rfjakob commented Jan 8, 2016

spaghetti2514 commented Jan 9, 2016

spaghetti2514 commented Jan 9, 2016

rfjakob commented Jan 9, 2016

rfjakob commented Jan 9, 2016

hasit commented Jan 9, 2016

rfjakob commented Jan 9, 2016 via email

spaghetti2514 commented Jan 9, 2016

rfjakob commented Jan 9, 2016

spaghetti2514 commented Jan 9, 2016

spaghetti2514 commented Mar 30, 2016

alexanderharm commented Dec 16, 2017 • edited Loading

teras commented Dec 19, 2017

alexanderharm commented Dec 19, 2017 • edited Loading

teras commented Dec 19, 2017

alexanderharm commented Dec 19, 2017

alexanderharm commented Dec 19, 2017

teras commented Dec 19, 2017

alexanderharm commented Feb 2, 2018

agarbato commented Oct 27, 2019

agarbato commented Oct 27, 2019

ijoseph commented Mar 3, 2020

Jumanjii commented Jan 28, 2021

cocoonkid commented Apr 14, 2021 • edited Loading

JayBrown commented Apr 14, 2021

alexanderharm commented Apr 14, 2021 • edited Loading

cocoonkid commented Apr 17, 2021

rfjakob commented Apr 18, 2021

cocoonkid commented Apr 20, 2021

rfjakob commented May 3, 2021

JayBrown commented May 3, 2021

litori commented May 4, 2021

dsuievalov commented Jun 8, 2021

MarcelBochtler commented Jun 19, 2021 • edited Loading

AlexBasile123 commented Nov 21, 2021

rfjakob commented Nov 21, 2021

MarcelBochtler commented Nov 21, 2021

MarcelBochtler commented Nov 21, 2021

AlexBasile123 commented Nov 22, 2021

AlexBasile123 commented Nov 22, 2021

alexanderharm commented Dec 16, 2017 •

edited

Loading

alexanderharm commented Dec 19, 2017 •

edited

Loading

cocoonkid commented Apr 14, 2021 •

edited

Loading

alexanderharm commented Apr 14, 2021 •

edited

Loading

MarcelBochtler commented Jun 19, 2021 •

edited

Loading