The OS X client ISO does not contain a tlclient.conf.
It doesn't contain a ssh_known_hosts file either - there's not even a etc/ directory somewhere in the bundle.
tlclient have __APPLE__ specific implementation that sets tlclient_prefix to application_bundle_path/Contents which means that we just need to ship a config file under as application_bundle/Contents/etc/tlclient.conf.
How is signing of the bundle affecting this. If the configuration file is signed a administrator can't modified the config for a custom application bundle. Can the file be excluded from signing ?
(In reply to comment #4) > How is signing of the bundle affecting this. If the configuration file is > signed a administrator can't modified the config for a custom application > bundle. Can the file be excluded from signing ? If I remember correctly, you cannot exclude files from signing. So if you customize the app, the signature will be invalid. I'd say that this is expected. Customers could potentially re-sign with their own certificate if they want. However, in this case, it might be necessary to remove the old signature. Here's some information about that: http://stackoverflow.com/questions/7500381/bug-in-codesign-remove-signature-feature
(In reply to comment #4) > How is signing of the bundle affecting this. If the configuration file is > signed a administrator can't modified the config for a custom application > bundle. Can the file be excluded from signing ? To make the exception permanent for just the download ThinLinc bundle application, which disables sign verification, one would right click and choose open on context menu and select open anyways. This way the quarantine attribute on the bundle is changed from 0002:XX:UUID to 0042:XX:UUID which means the exception lives with the bundle.
Redo and cleanup special cases MacOSX to fix BINDIR / SYSCONFIR and PREFIX for a cleaner consistent Makefile.
Check if we should document this changes in TAG.
(In reply to comment #13) > Check if we should document this changes in TAG. There is no information in tag about Mac OS X client configurations and we do have bug 4852 to add this.
✓ tlclient reads tlclient.conf from app bundle ✓ documentation is now fine
Bug is reopened due to the whole point of doing this work is to support preconfiguration of the ThinLinc client. As noted one can't change the bundled config file without breaking the signature and there is no supported way of removing a signature. The correct way is to install configuration files in the "Application Support", see bug 5659 for more information, folder which introduces a problem were we don't uses a package installer which can create this file. "If you used custom resource rules because your installation process relies on changing the bundle, your app will be rejected by Gatekeeper on first launch. These modifications are not permitted. Using an installation package instead of a drag-install will get you through Gatekeeper." refs: https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG401
(In reply to comment #20) > Bug is reopened due to the whole point of doing this work is to support > preconfiguration of the ThinLinc client. As noted one can't change the bundled > config file without breaking the signature and there is no supported way of > removing a signature. > If we implements bug 5659 for supporting preconfigured thinlinc client we have only one problem: We can't distribute the configuration file with the application bundle. However, and administrator could: - Distribute ThinLinc application bundle with a configfile and instruction where this config file should be stored. - Build a package installer using pkgbuild with the ThinLinc application bundle and preconfigured file.
Building a package file actually seems doable from the build system. pkg files are just xar archives with a special structure. The only magical thing in them is a binary file that store file metadata for the things that are to be installed. But there is an open source project to generate these files: http://hogliux.github.io/bomutils/index.html They even have a complete tutorial on how to make a pkg file here: http://hogliux.github.io/bomutils/tutorial.html
Also see this page for signing packages: http://users.wfu.edu/cottrell/productsign/productsign_linux.html
