summaryrefslogtreecommitdiff
path: root/solenv/bin/macosx-codesign-app-bundle
AgeCommit message (Collapse)AuthorFilesLines
2024-02-16Related: tdf#159529 fix increasing failures when setting entitlementsPatrick Luby1-1/+13
Starting in one of the Xcode versions 15.2 or earlier, setting the entitlements without a certificate started failing on Mac Silicon. The hacky solution is to make a copy of the application's executable, set the entitlements on that binary only, and then move the copied binary back. Change-Id: I25c32cbe6f9aa87e2d6c2c554a8a9cf48d79e75d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163468 Tested-by: Jenkins Reviewed-by: Patrick Luby <guibomacdev@gmail.com>
2023-11-02tdf#158038 fix opening pdf files in appstore ver (sandbox issue w/ helper tool)Christian Lohmaier1-1/+5
https://developer.apple.com/documentation/xcode/embedding-a-helper-tool-in-a-sandboxed-app "Adding other entitlements to the tool can cause problems. If the tool immediately crashes with a code signing error when your app runs the tool, check that the tool is signed with just these two entitlements: com.apple.security.app-sandbox and com.apple.security.inherit." This is indeed what happened.. Change-Id: Id03948c03b7d453aae4ca58719f582576e30a16f Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158790 Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com> Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2023-06-19Fix nightly build failures on Mac IntelPatrick Luby1-2/+3
When adding entitlements in a debug, non-codesigned build, the codesign command fails on some Mac Intel machines. Since this command is only executed in non-release builds, ignore any failures. Change-Id: I4d89e03bbbc00725b2902446f2abbb99f273eab7 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153269 Tested-by: Jenkins Reviewed-by: Patrick Luby <plubius@neooffice.org>
2023-06-07Set entitlements in non-release in $(INSTROOTBASE) and .dmg packagePatrick Luby1-2/+14
Also, when building a .dmg for macOS, skip codesigning for non-release builds, both with and without the macOS sandbox, if there is no identity set but set entitlements to allow Xcode's Instruments application to connect to the application. Lastly, add entitlements when building soffice in $(INSTROOTBASE) if this is a non-release build. Change-Id: I764bf5bd5d44e878669c4287906e6efd6aac593f Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152655 Tested-by: Jenkins Reviewed-by: Patrick Luby <plubius@neooffice.org>
2023-03-14Improve scripts that codesign and create a .dmg from a Universal bundlePatrick Luby1-5/+5
This change adds the following: - The solenv/bin/macosx-codesign-app-bundle script now uses "--timestamp" wherever "--options runtime" is used in order to pass Apple's notarization process. - A second, required argument has been added to the bin/create-dmg-from-merged-app-bundle script that specifies one of the following types: "release", "dev", or "collabora". Only the .DS_Store is different for each as no product set a volume icon currently. - Upon success, the bin/create-dmg-from-merged-app-bundle script will print a warning that the .dmg is not notarized as well as the commands to use to manually notarize the .dmg. Change-Id: I7c3f2d60dbb16b25bd6088b7e0af8c82284702d9 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/148490 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Patrick Luby <plubius@neooffice.org> Reviewed-by: Andras Timar <andras.timar@collabora.com> (cherry picked from commit 86e612db56be2d1934275de021b3213875e9301d) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/148508 Tested-by: Jenkins
2022-10-24Fix typoAndrea Gelmini1-1/+1
Change-Id: Id974647a7e08298aa6ebd19dcc674fd4f4066b52 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141720 Tested-by: Jenkins Reviewed-by: Julien Nabet <serval2412@yahoo.fr>
2022-10-23macOS sandbox: only use com.apple.application-identifier for main packageChristian Lohmaier1-7/+9
when multiple files are signed with that entitlement, the build will just be listed with "Not Available for Testing" via Testflight Change-Id: I92957f24513ab419ddbc4289b53175932111c198 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141497 Tested-by: Jenkins Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2022-07-15macOS sandbox: disable donation info bar & help entriesChristian Lohmaier1-0/+3
even when you are a verified non-profit, you still cannot just point to a donation site/you still would have to offer apple-pay... the helpmenu one is ugly since it changes the endresult compared to what is assembled in instdir, but is the least intrusive way for now... Change-Id: Id348d69371048bdd04d2961cad564fc73f11fd45 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137050 Tested-by: Jenkins Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2021-08-20Make some scripts more portableIlmari Lauhakangas1-1/+1
Change-Id: Ia89059eea51ca396a7c74143625ac9a6706de198 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120773 Tested-by: Jenkins Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
2021-01-20Simplify error handlingTor Lillqvist1-42/+9
There were a couple of weird things in this script. Firstly, the script redirected stdout and stderr from each invocation of codesign separately into a log file. (Several differently named log files.) But those log files were never displayed. Secondly, the script did "set -e" at the start. Thus, if a codesign invocation returned non-zero (error) exit status, any code to check the exit status and possibly display the log file would not be executed anyway. Simplify thusly: Don't pass --verbose to codesign. Then if nothing goes wrong, it is silent. That is The Unix Philosophy, right? Don't redirect codesign stdout and stderr to a log file (that would be removed if codesign didn't fail). Just let any error message of warning from codesign go to the script's stderr or stdout. If codesign fails, just exit. Error messages will have been written to stderr already. No log files to display or remove. Don't use set -e. Instead if a codesign invocation fails, just exit. The intent is that in the normal case, this script will be totally silent. Change-Id: Ic6081c418e4c564be768e30bf52b8196ee59f061 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109696 Tested-by: Tor Lillqvist <tml@collabora.com> Reviewed-by: Tor Lillqvist <tml@collabora.com>
2020-11-23Check first if there is such a "bin" directory before attempting to use itTor Lillqvist1-4/+6
In the test-install target in Makefile.in we remove the "bin" folder of the LibreOfficePython framework. Change-Id: Idf3d440c4f9465f21b5dcae60d4fc5ac21965dd8 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106284 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Tor Lillqvist <tml@collabora.com> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106398 Tested-by: Jenkins
2020-05-25Correct commentsTor Lillqvist1-5/+2
The --enable-canonical-installation-tree-structure option is gone. We always use a "canonical" app bundle structure (with MacOS, Frameworks, Library, and Resources) on macOS since 6492c8576e0393f7ee548cd938e84c80e8d37127 in 2014. Change-Id: I6cbd3c5141aba643bc05bfa7d4de1e7d73a14112 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/94761 Tested-by: Jenkins Reviewed-by: Tor Lillqvist <tml@collabora.com>
2020-05-07fix macOS codesigning when using a separate builddirChristian Lohmaier1-1/+1
88453fd13a653963b394b8f865ff104b5545f137 changed the hardened_runtime.xcent to a generated file Change-Id: I54b927d1990835bb902f62e03d51b0e70735269c
2019-05-31macOS: enable hardened runtime when signinglibreoffice-6-3-branch-pointChristian Lohmaier1-5/+9
hardened runtime is prerequisite for notarizing apps, which in turn is required for new developer IDs with 10.14.5 already and will be required for all software to run in future versions of macOS https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution Change-Id: Ifdf73fb5901be5dd0b62e1a51dee6e57c9816e5f Reviewed-on: https://gerrit.libreoffice.org/73246 Tested-by: Jenkins Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2018-11-29Rename Mac OS X to official name macOS in comments and documentationBartosz Kosiorek1-1/+1
Change-Id: I651b7f202fa52ff5f5357a11aa72c43eb7dc7f95 Reviewed-on: https://gerrit.libreoffice.org/64102 Tested-by: Jenkins Reviewed-by: Bartosz Kosiorek <gang65@poczta.onet.pl>
2017-03-22codesigning script for macosx compained about double signingNorbert Thiebaud1-10/+37
Release build of 5.3.2.1 failed in codesign apparently LibreOfficePython.framework was being signed more than once, which cause codesign to fail and due to a recent patch to harden the codesign wrapper, the build itself to fail This does not address why some part are signed multiple time but merely tell codesign to ignore the issue and just sign This also fix a bash un-initialize variable warning and capture output of codesign in case of error to be able to diagnose things. Change-Id: Ibd6752702feb2bdf5163ac30ed7a3fd9c86f961c Reviewed-on: https://gerrit.libreoffice.org/35407 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Norbert Thiebaud <nthiebaud@gmail.com>
2017-03-06masOS codesign: Use of unset variable is an errorAndras Timar1-0/+1
Change-Id: I270b7ab66d502e767a62e7e98ec3cefe7b9646d5
2017-02-22Improve error handling and fix some problemsTor Lillqvist1-9/+22
Use the -e and -o pipefail bash option to make the script fail more reliably if some command inside a pipeline fails. Use the -u option to catch mistyped variable names. Move the signing of executables in the bundle's Contents/MacOS after signing nested bundles. Change-Id: I21d441bcb2dbfc19b0cb5718b76402b1686d2239
2017-01-14cosmetics: no need for that echo when using codesign with --verboseChristian Lohmaier1-1/+0
Change-Id: I7e51445e890bd1ed5bcafb9cc713c6f5fad24631
2017-01-14workaround for codesigning on Mac baseline - do jnilibs firstChristian Lohmaier1-1/+10
as otherwise signing fails (LibreOffice.app: code object is not signed at all In subcomponent: path/to/foo.jnilib) Change-Id: I3e4691f2ada408d9e76d200a3291b044753ec85c
2017-01-12Update comment to match realityTor Lillqvist1-3/+3
Change-Id: I0b4ee6377aac984b7acf7085ac43cad3d088612d
2017-01-12Always exit with error if codesign failsTor Lillqvist1-5/+5
That sanity check was added in 615fae2f67028f3c5c51c70c77dbaa9b9f3856d6 but we lost it at some stage. The codesigning script has a very confusing history, in part caused by its use for two purposes, when building for the Mac App Store and when building for a TDF style distribution on a dmg disk image. Those who work with the former and those who work with the latter haven't necessarily checked that it doesn't break for the other case. Sorry. Change-Id: I79011302f60b1f6551328c8b80e00f5d3698504c
2017-01-12CodesignRules.plist was removed in 615fae2f67028f3c5c51c70c77dbaa9b9f3856d6Tor Lillqvist1-5/+2
Change-Id: Ibde5189ecf09ec8dfaf3223683c5480974084865
2016-08-04Update to match what has been used for the products in the Mac App StoreTor Lillqvist1-58/+63
Hopefully will not break building for a dmg-stye distribution. Change-Id: Ibf32bb8e43fe4745461eb78e9e7e60d37163934f
2016-08-04Introduce --with-product-name superseding --with-macosx-app-nameTor Lillqvist1-1/+1
The new option thoroughly replaces the product name mentioned in the AC_INIT() call. Work in progress. Also take care of spaces in the product name in a more systematic fashion. This should affect mainly OS X where the final app bundle that is installed should use the product name as such, including spaces, if any. However, our build system does not cope that well with having an app bundle with spaces in it in instdir. So in instdir, and also in test-install, spaces are stripped away from the product name when used as part of the app bundle name. Change-Id: Ic16b5039f23c96a4f39387a1869faeb25e05aafb
2016-04-22gengal is not s script anymore so it is already signed on macNorbert Thiebaud1-1/+1
69858a99c9b566303551a1bff91172917c5d624f removed the script layer around a gengal.bin so there is no gengal 'script' anymore and gengal is a binary that was signed at link already. remove the exception that force a sign of gengal as a 'script' which caused an error due to re-signing. Change-Id: Ie22efceb8e5ab20018be784968487917c6f0a95e Reviewed-on: https://gerrit.libreoffice.org/24306 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Norbert Thiebaud <nthiebaud@gmail.com>
2016-03-04harden OS X code signing script (handle spaces in bundle name)Andras Timar1-9/+10
Change-Id: Icf9bdcd0bcd988d32477cf9ab7f8d917ff6a2275
2015-05-18OS X codesign fix (e.g. --disable-python case)Andras Timar1-3/+6
Change-Id: Icf6b2b9722481492a2d8d70af9dbb34b04a40df7 Reviewed-on: https://gerrit.libreoffice.org/15779 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Andras Timar <andras.timar@collabora.com>
2015-02-10Attempt at fixing Mac OS X code signingStephan Bergmann1-14/+21
...so that LibreOffice.app dmgs built with --enable-macosx-code-signing with an appstore-enabled identity will hopefully no longer be rejected on Mac OS X >= 10.9.5 as "'soffice' can't be opened because the identity of the developer cannot be confirmed." (Which I cannot verify for lack of an appstore-enabled certificate, though.) First of all, do not ignore errors from calls to codesign utitlity. Really. That reveals that soffice cannot be signed as soon as it is linked, as it requires all the other stuff in the app to be already signed. So just don't sign it after linking, it will be signed last step in macosx-codesign-app-bundle anyway. Second, --resource-rules exemptions are no longer allowed per <https://developer.apple.com/library/mac/technotes/tn2206/_index.html> "OS X Code Signing In Depth." Third, the handful of remaining shell scripts in MacOS/ need to be signed too. (Signing them adds extended attributes to the files.) Unfortunately, as discussed at <http://porkrind.org/missives/mac-os-x-codesigning-woes/> "Mac OS X codesigning woes," "hdiutil makehybrid" drops extended attributes from the generated dmg (so the dmg's LibreOffice.app would no longer be considered properly signed, as the shell scripts would no longer be signed). So switch from "hdiutil makehybrid" to "hdiutil create." Change-Id: I4b587f87d504666f7a1d0e3a24a8be76f22014c5
2014-09-10Bin incorrect commentTor Lillqvist1-4/+0
2014-08-15The --resource-rules option in being deprecatedTor Lillqvist1-3/+6
The documentation is a bit unclear yet, but I think it is safe to assume that Apple strongly wants sandboxed apps to have what we call ENABLE_MACOSX_MACLIKE_APP_STRUCTURE and to be signed without any special resource rules. Change-Id: I1409ccb6a3f9086d01af6ff318fe28536c1cebef
2014-06-09A few improvements to macosx-codesign-app-bundleTor Lillqvist1-2/+5
Try harder to handle app bundles with space in name. (Not sure if this version yet does that 100%.) Include the directory names in the "ids" to make them unique. There are lots of files with the same name (in different directories, of course), especially in an app bundle that includes help in multiple languages. Change-Id: I424c539f6389ac6f7c9cef96aeb873ddac459f78
2014-06-09Use essentially the same OS X code signing script as in libreoffice-4-2Tor Lillqvist1-3/+21
Change-Id: Ica7dcc823cc7027a00b15d2dcf5b73b0ef322189
2014-06-08Use MACOSX_APP_NAME (with dashes instead of spaces) instead of build-time nameTor Lillqvist1-1/+2
Change-Id: I01bf646635668429c68f53bd6ab543b7a8b0be2d
2014-04-04give an identifier to the app_bundle itselfNorbert Thiebaud1-2/+2
Language Pack did not seem to pick a decent default value for that Change-Id: I567f24882e16533e10d8ba91b777ad91dc507b87 Reviewed-on: https://gerrit.libreoffice.org/7485 Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com> Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2013-11-05codesign: fix script to support spaces in the CODESIGN_IDENTITYNorbert Thiebaud1-6/+6
Change-Id: Ib30717518ff1d1291ba3a1fc7ba045e1fa29ad88 Reviewed-on: https://gerrit.libreoffice.org/6594 Reviewed-by: Norbert Thiebaud <nthiebaud@gmail.com> Tested-by: Norbert Thiebaud <nthiebaud@gmail.com>
2013-08-30ENABLE_MACOSX_SANDBOX Harmonize ENABLE_* variable to TRUE/<nothing>Norbert Thiebaud1-1/+1
Change-Id: Ice05796a9887c4ff311b78fcddd9820e0f06e7f1 Reviewed-on: https://gerrit.libreoffice.org/5708 Reviewed-by: Norbert Thiebaud <nthiebaud@gmail.com> Tested-by: Norbert Thiebaud <nthiebaud@gmail.com>
2013-08-27Factor out the app bundle code signing into a scriptTor Lillqvist1-0/+77
Call that script for make dev-install and when creating the .dmg. Change-Id: Ic468cafe04b2755f371d449fef0b84e2fdc7e197
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-26 01:14:34 +0000