From 50e66375a6f65cf45a7a9a5c7c29a7c84ebc4e39 Mon Sep 17 00:00:00 2001 From: Kenneth Chew <79120643+kthchew@users.noreply.github.com> Date: Wed, 11 Dec 2024 22:04:26 -0500 Subject: [PATCH] Add CMake install step for macOS code signing Signed-off-by: Kenneth Chew <79120643+kthchew@users.noreply.github.com> --- CMakeLists.txt | 2 ++ launcher/CMakeLists.txt | 15 +++++++++ launcher/MacOSCodesign.cmake.in | 8 +++++ program_info/AdhocSignedApp.entitlements | 1 + program_info/App.entitlements | 1 + program_info/CMakeLists.txt | 8 +++++ program_info/macos_signature.sh | 42 ++++++++++++++++++++++++ 7 files changed, 77 insertions(+) create mode 100644 launcher/MacOSCodesign.cmake.in create mode 100755 program_info/macos_signature.sh diff --git a/CMakeLists.txt b/CMakeLists.txt index 929e1b394..5c0d0db51 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -409,6 +409,8 @@ if(UNIX AND APPLE) set(MACOSX_SPARKLE_SHA256 "50612a06038abc931f16011d7903b8326a362c1074dabccb718404ce8e585f0b" CACHE STRING "SHA256 checksum for Sparkle release archive") set(MACOSX_SPARKLE_DIR "${CMAKE_BINARY_DIR}/frameworks/Sparkle") + set(MACOSX_CODESIGN_IDENTITY "-" CACHE STRING "The identity to use for codesigning (the name, not the secret)") + if(NOT MACOSX_SPARKLE_UPDATE_PUBLIC_KEY STREQUAL "" AND NOT MACOSX_SPARKLE_UPDATE_FEED_URL STREQUAL "") set(Launcher_ENABLE_UPDATER YES) endif() diff --git a/launcher/CMakeLists.txt b/launcher/CMakeLists.txt index ff6a9ab2a..733ac3a2a 100644 --- a/launcher/CMakeLists.txt +++ b/launcher/CMakeLists.txt @@ -1561,3 +1561,18 @@ if(WIN32 OR (UNIX AND APPLE)) COMPONENT bundle ) endif() + +if(UNIX AND APPLE) + # Need to fix code signing for the bundle + if(MACOSX_CODESIGN_IDENTITY STREQUAL "-") + set(MACOSX_ENTITLEMENTS "${CMAKE_CURRENT_BINARY_DIR}/../program_info/AdhocSignedApp.entitlements") + else() + set(MACOSX_ENTITLEMENTS "${CMAKE_CURRENT_BINARY_DIR}/../program_info/App.entitlements") + endif() + configure_file( + "${CMAKE_CURRENT_SOURCE_DIR}/MacOSCodesign.cmake.in" + "${CMAKE_CURRENT_BINARY_DIR}/MacOSCodesign.cmake" + @ONLY + ) + install(SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/MacOSCodesign.cmake" COMPONENT Runtime) +endif() diff --git a/launcher/MacOSCodesign.cmake.in b/launcher/MacOSCodesign.cmake.in new file mode 100644 index 000000000..067ccf763 --- /dev/null +++ b/launcher/MacOSCodesign.cmake.in @@ -0,0 +1,8 @@ +execute_process( + COMMAND "@CMAKE_SOURCE_DIR@/program_info/macos_signature.sh" "@MACOSX_CODESIGN_IDENTITY@" "@MACOSX_ENTITLEMENTS@" + WORKING_DIRECTORY "@CMAKE_INSTALL_PREFIX@" + RESULT_VARIABLE CODESIGN_RESULT +) +if(NOT CODESIGN_RESULT EQUAL 0) + message(FATAL_ERROR "Failed to codesign the bundle") +endif() \ No newline at end of file diff --git a/program_info/AdhocSignedApp.entitlements b/program_info/AdhocSignedApp.entitlements index 032308a18..fe11fc206 100644 --- a/program_info/AdhocSignedApp.entitlements +++ b/program_info/AdhocSignedApp.entitlements @@ -2,6 +2,7 @@ + @Launcher_DebugEntitlements@ com.apple.security.cs.disable-library-validation com.apple.security.device.audio-input diff --git a/program_info/App.entitlements b/program_info/App.entitlements index 73bf832c7..49fc0d31a 100644 --- a/program_info/App.entitlements +++ b/program_info/App.entitlements @@ -2,6 +2,7 @@ + @Launcher_DebugEntitlements@ com.apple.security.device.audio-input com.apple.security.device.camera diff --git a/program_info/CMakeLists.txt b/program_info/CMakeLists.txt index db6920e20..3ce250162 100644 --- a/program_info/CMakeLists.txt +++ b/program_info/CMakeLists.txt @@ -38,6 +38,14 @@ set(Launcher_Branding_LogoQRC "program_info/prismlauncher.qrc" PARENT_SCOPE) set(Launcher_Portable_File "program_info/portable.txt" PARENT_SCOPE) +if(CMAKE_BUILD_TYPE STREQUAL "Debug") + set(Launcher_DebugEntitlements "com.apple.security.get-task-allow\n ") +else() + set(Launcher_DebugEntitlements "") +endif() + +configure_file(App.entitlements App.entitlements) +configure_file(AdhocSignedApp.entitlements AdhocSignedApp.entitlements) configure_file(${Launcher_AppID}.desktop.in ${Launcher_AppID}.desktop) configure_file(${Launcher_AppID}.metainfo.xml.in ${Launcher_AppID}.metainfo.xml) configure_file(prismlauncher.rc.in prismlauncher.rc @ONLY) diff --git a/program_info/macos_signature.sh b/program_info/macos_signature.sh new file mode 100755 index 000000000..7660321fa --- /dev/null +++ b/program_info/macos_signature.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env zsh + +# Run this script from the directory containing "PrismLauncher.app" + +CODE_SIGN_IDENTITY="${1:--}" +MAIN_ENTITLEMENTS_FILE="${2:-../program_info/App.entitlements}" + +if [[ "$CODE_SIGN_IDENTITY" == "Developer ID Application"* ]]; then + CODE_SIGN_IDENTITY=("$CODE_SIGN_IDENTITY" --timestamp) +fi + +################ FRAMEWORKS ################ +cd "PrismLauncher.app/Contents/Frameworks" || exit 1 +# See https://sparkle-project.org/documentation/sandboxing/ +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" -o runtime Sparkle.framework/Versions/B/XPCServices/Installer.xpc +# For Sparkle versions >= 2.6 +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" -o runtime --preserve-metadata=entitlements Sparkle.framework/Versions/B/XPCServices/Downloader.xpc +# For Sparkle versions < 2.6 +#codesign -f -s "${CODE_SIGN_IDENTITY[@]}" -o runtime --entitlements Entitlements/Downloader.entitlements Sparkle.framework/Versions/B/XPCServices/Downloader.xpc +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" -o runtime Sparkle.framework/Versions/B/Autoupdate +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" -o runtime Sparkle.framework/Versions/B/Updater.app + +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" ./*.framework +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" ./*.dylib + +################ XPC SERVICES ################ +if cd "../XPCServices"; then + codesign -f -s "${CODE_SIGN_IDENTITY[@]}" -o runtime ./*.xpc +fi + +################ PLUGINS ################ +cd "../MacOS" || exit 1 +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" iconengines/*.dylib +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" imageformats/*.dylib +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" platforms/*.dylib +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" jars/*.jar +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" styles/*.dylib +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" tls/*.dylib + +################ APP ################ +cd "../../.." || exit 1 +codesign -f -s "${CODE_SIGN_IDENTITY[@]}" --entitlements "$MAIN_ENTITLEMENTS_FILE" -o runtime ./PrismLauncher.app \ No newline at end of file