How OCLP-Mod's Build System Ensures Integrity and Signing of Patched Kexts and Frameworks

OCLP-Mod protects patched kernel extensions and frameworks through a defense-in-depth strategy combining OpenCore Vault EFI signing, Auxiliary Kernel Collection authentication, and macOS code-sign verification.

OCLP-Mod (OpenCore Legacy Patcher Mod) is an open-source fork designed to extend macOS compatibility to legacy Apple hardware. When patching system kexts and frameworks for unsupported Macs, ensuring cryptographic integrity is critical to prevent boot failures and security vulnerabilities. The OCLP-Mod build system implements multiple layers of verification to guarantee that every modified component is either properly signed or explicitly flagged for user approval.

OpenCore Vault Signing (EFI-Level Protection)

The first layer of protection occurs at the firmware level through OpenCore Vault, which cryptographically signs all EFI binaries, drivers, and configuration files.

Enabling Vault via CLI Arguments

The build system checks for the --vault flag in oclp_mod/support/arguments.py. When present, this sets Constants.vault = True, triggering the signing workflow throughout the build process.

# Enable vault via CLI argument

parser.add_argument("--vault", action="store_true", help="Enable OpenCore Vaulting")
args = parser.parse_args()
if args.vault:
    constants.vault = True

The Signing Process

During EFI assembly, oclp_mod/efi_builder/support.py invokes BuildSupport.sign_files(), which executes the bundled payloads/Tools/CreateVault/sign.command script. This script signs the entire EFI/OC/ folder (referenced as Constants.oc_folder) using the developer certificate imported during CI workflow execution.

# Later, in the EFI build sequence

builder = BuildSupport(model, constants, config)
builder.sign_files()          # Calls the CreateVault script

builder.validate_pathing()    # Ensures all files are present

The CI workflow in .github/workflows/BuildProduct.yml ensures certificates are available via the dhinakg/import-codesign-certs@master action before any signing occurs.

Auxiliary Kernel Collection Authentication

For macOS Ventura and later, patched kexts must integrate with the Auxiliary Kernel Collection (AuxKC) to bypass root volume restrictions while maintaining security boundaries.

Injecting OSBundleRequired Entries

The KernelCacheSupport.add_auxkc_support() method in oclp_mod/sys_patch/kernelcache/kernel_collection/support.py automatically injects OSBundleRequired = "Auxiliary" into a kext's Info.plist when targeting AuxKC-compatible systems. This allows the kext to load from /Library/Extensions without requiring a signed root volume.

kc_support = KernelCacheSupport(mount_point, detected_os, skip_root_kmutil_requirement=True)

# When copying a kext into the EFI

dest = kc_support.add_auxkc_support(
    install_file="AppleIntelSNBGraphicsFB.kext",
    source_folder_path="/tmp/kexts",
    install_patch_directory="/System/Library/Extensions",
    destination_folder_path="/EFI/OC/Kexts"
)

# `dest` now points to /Library/Extensions for AuxKC handling

CDHash Verification

Before installation, KernelCacheSupport.check_kexts_needs_authentication() reads the system's AuxKC instructions plist (/private/var/db/KernelExtensionManagement/AuxKC/.../com.apple.kcgen.instructions.plist) and validates the kext's CDHash against trusted entries. If the hash mismatch indicates an unsigned or modified kext, the system logs that user authentication will be required in System Preferences, preventing silent installation of untrusted code.

macOS Code-Sign Verification

The build system validates Apple-signed binaries used during the installation process to prevent supply-chain attacks.

Installer Binary Validation

In oclp_mod/support/macos_installer_handler.py, the system verifies that the createinstallmedia binary carries a valid Apple signature before execution:

createinstallmedia_path = "/Applications/Install macOS Ventura.app/Contents/Resources/createinstallmedia"
result = subprocess.run(
    ["/usr/bin/codesign", "-v", "-R=anchor apple", createinstallmedia_path]
)
if result.returncode != 0:
    raise RuntimeError("createinstallmedia binary is not Apple-signed")

CI Certificate Management

The .github/workflows/BuildProduct.yml workflow imports signing certificates at the start of every build job using the dhinakg/import-codesign-certs@master GitHub Action. This ensures that both local developer builds and CI-generated releases use identical certificates for EFI Vault signing, maintaining consistency across distribution channels.

Post-Build Validation and Cleanup

After assembly, BuildSupport.validate_pathing() in oclp_mod/efi_builder/support.py scans the generated EFI/OC folder and config.plist to confirm that every referenced ACPI table, kext, driver, and tool exists on disk. This prevents mismatched or missing files that could cause boot failures.

Finally, BuildSupport.cleanup() removes stale ZIP archives and residual build artifacts, ensuring that only the final, signed artifacts remain in the output directory.

Summary

OCLP-Mod's build system implements a comprehensive, multi-layered approach to ensure the integrity and signing of patched kexts and frameworks:

• OpenCore Vault signing cryptographically protects all EFI binaries and drivers at the firmware level.
• AuxKC authentication ensures patched kernel extensions properly integrate with macOS Ventura+ security models while validating CDHashes against trusted entries.
• Code-sign verification confirms that all macOS installer binaries carry valid Apple signatures before execution.
• Post-build validation guarantees that every referenced component exists and is correctly signed before distribution.

Frequently Asked Questions

What happens if the CDHash check fails during the AuxKC verification process?

If KernelCacheSupport.check_kexts_needs_authentication() detects a CDHash mismatch or missing trusted entry, the build system logs a warning that the kext will require user authentication in System Preferences before loading. The installation does not fail silently; instead, it flags the component as requiring explicit user approval, maintaining security transparency.

Can I build OCLP-Mod without enabling OpenCore Vault signing?

Yes, vault signing is optional and controlled by the --vault CLI flag parsed in oclp_mod/support/arguments.py. If omitted, Constants.vault remains False and BuildSupport.sign_files() skips the signing process. However, disabling vault signing removes the cryptographic guarantee that EFI files haven't been tampered with between build and boot.

How does the build system prevent the use of compromised macOS installer binaries?

Before executing any installer creation commands, oclp_mod/support/macos_installer_handler.py runs /usr/bin/codesign -v -R=anchor apple against the createinstallmedia binary. This verifies that the binary is signed by Apple and hasn't been modified. If verification fails, the build raises a RuntimeError and halts immediately, preventing potential supply-chain attacks.

Where are the signing certificates configured for CI builds?

The GitHub Actions workflow in .github/workflows/BuildProduct.yml imports signing certificates using the dhinakg/import-codesign-certs@master action at the beginning of the build job. This ensures that the same certificates used for local development are available in the CI environment, allowing BuildSupport.sign_files() to properly sign the OpenCore Vault regardless of where the build executes.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}