macOS: Fixed a debugging issue

System security has been ramped up on M1 Macs, and since we are manually composing the .app bundle and then signing it, we also must ensure that the "get-task-allow" entitlement is present for non-distribution builds. Without this entitlement, a debugger is not permitted to attached to the process.
skyjake · Jul 29, 2021 · b061d59 · b061d59
1 parent 9a82cee
commit b061d59
Show file tree

Hide file tree

Showing 4 changed files with 33 additions and 7 deletions.
diff --git a/doomsday/apps/client/CMakeLists.txt b/doomsday/apps/client/CMakeLists.txt
@@ -312,8 +312,9 @@ endif ()
 
 if (APPLE AND NOT IOS)
     set_target_properties (client PROPERTIES
-        MACOSX_BUNDLE_BUNDLE_NAME net.dengine.doomsday
-        MACOSX_BUNDLE_INFO_PLIST  MacOSXBundleInfo.plist.in
+        XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER  net.dengine.doomsday 
+        MACOSX_BUNDLE_BUNDLE_NAME                  net.dengine.doomsday
+        MACOSX_BUNDLE_INFO_PLIST                   MacOSXBundleInfo.plist.in
     )
     # Install binaries built by targets in the project.
     deng_install_bundle_deps (client

diff --git a/doomsday/build/macx/get-task-allow.plist b/doomsday/build/macx/get-task-allow.plist
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+<key>com.apple.security.get-task-allow</key>
+<true/>
+</dict>
+</plist>
diff --git a/doomsday/cmake/Macros.cmake b/doomsday/cmake/Macros.cmake
@@ -484,6 +484,10 @@ endfunction ()
 
 macro (deng_codesign target)
     if (APPLE AND DE_CODESIGN_APP_CERT)
+        if (NOT DE_ENABLE_DEPLOYMENT)
+            # Enable attaching a debugger.
+            set (DE_CODESIGN_ENTITLEMENTS "--entitlements ${DE_SOURCE_DIR}/build/macx/get-task-allow.plist")
+        endif ()
         get_property (_outName TARGET ${target} PROPERTY OUTPUT_NAME)
         install (CODE "
             file (GLOB fw
@@ -509,22 +513,29 @@ macro (deng_codesign target)
                 endif ()
                 if (NOT _skip)
                 message (STATUS \"Signing \${fn}...\")
-                execute_process (COMMAND ${CODESIGN_COMMAND} --verbose
-                            --deep
+                execute_process (COMMAND ${CODESIGN_COMMAND}
+                        --deep
+                        --verbose
                         --options runtime
                         --timestamp
-                        --force -s \"${DE_CODESIGN_APP_CERT}\"
+                        --force
+                        -s \"${DE_CODESIGN_APP_CERT}\"
                         ${DE_FW_CODESIGN_EXTRA_FLAGS}
+                        ${DE_CODESIGN_ENTITLEMENTS}
                         \"\${fn}\"
                 )
                 endif ()
             endforeach (fn)
             message (STATUS \"Signing \${CMAKE_INSTALL_PREFIX}/${_outName}.app using '${DE_CODESIGN_APP_CERT}'...\")
-            execute_process (COMMAND ${CODESIGN_COMMAND} --verbose
+            execute_process (COMMAND ${CODESIGN_COMMAND} 
+                --verbose
                 --options runtime
                 --timestamp
-                --force -s \"${DE_CODESIGN_APP_CERT}\"
+                --force
+                -s \"${DE_CODESIGN_APP_CERT}\"
                 ${DE_CODESIGN_EXTRA_FLAGS}
+                ${DE_CODESIGN_ENTITLEMENTS}
+                \"\${CMAKE_INSTALL_PREFIX}/${_outName}.app\"
             )
             if (NOT \"${DE_NOTARIZATION_APPLE_ID}\" STREQUAL \"\")
                 message (STATUS \"Notarizing \${CMAKE_INSTALL_PREFIX}/${_outName}.app...\")
@@ -546,6 +557,9 @@ macro (deng_xcode_attribs target)
         XCODE_ATTRIBUTE_GCC_SYMBOLS_PRIVATE_EXTERN NO
         XCODE_ATTRIBUTE_GCC_INLINES_ARE_PRIVATE_EXTERN NO
     )
+    if (NOT DE_CODESIGN_APP_CERT)
+        set_property (TARGET ${target} PROPERTY XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "-")
+    endif ()
 endmacro (deng_xcode_attribs)
 
 macro (macx_set_bundle_name name)
@@ -772,6 +786,8 @@ function (deng_install_tool target)
                     \"\${CMAKE_INSTALL_PREFIX}/${dest}/${name}\"
                 )
             ")
+        else ()
+            set_property (TARGET ${target} PROPERTY XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "-")
         endif ()
     else ()
         sublist (comp 1 -1 ${ARGV})

diff --git a/doomsday/tools/shell/CMakeLists.txt b/doomsday/tools/shell/CMakeLists.txt
@@ -38,6 +38,7 @@ if (APPLE OR WIN32)
     set (MACOSX_BUNDLE_BUNDLE_EXECUTABLE "Doomsday Shell")
     set_target_properties (shell PROPERTIES
         OUTPUT_NAME "Doomsday Shell"
+        XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER net.dengine.shell
         MACOSX_BUNDLE_INFO_PLIST ${CMAKE_CURRENT_LIST_DIR}/res/macx/Info.plist
     )
 else ()