enable correct codesigning on jdk11

build-farm/make-adopt-build-farm.sh

@@ -109,4 +109,4 @@ export BUILD_ARGS="${BUILD_ARGS} --use-jep319-certs"
 echo "$PLATFORM_SCRIPT_DIR/../makejdk-any-platform.sh" --clean-git-repo --jdk-boot-dir "${JDK_BOOT_DIR}" --configure-args "${CONFIGURE_ARGS_FOR_ANY_PLATFORM}" --target-file-name "${FILENAME}" ${TAG_OPTION} ${OPTIONS} ${BUILD_ARGS} ${VARIANT_ARG} "${JAVA_TO_BUILD}"
 
 # shellcheck disable=SC2086
-bash "$PLATFORM_SCRIPT_DIR/../makejdk-any-platform.sh" --clean-git-repo --jdk-boot-dir "${JDK_BOOT_DIR}" --configure-args "${CONFIGURE_ARGS_FOR_ANY_PLATFORM}" --target-file-name "${FILENAME}" ${TAG_OPTION} ${OPTIONS} ${BUILD_ARGS} ${VARIANT_ARG} "${JAVA_TO_BUILD}"
+bash -c "$PLATFORM_SCRIPT_DIR/../makejdk-any-platform.sh --clean-git-repo --jdk-boot-dir ${JDK_BOOT_DIR} --configure-args \"${CONFIGURE_ARGS_FOR_ANY_PLATFORM}\" --target-file-name ${FILENAME} ${TAG_OPTION} ${OPTIONS} ${BUILD_ARGS} ${VARIANT_ARG} ${JAVA_TO_BUILD}"

build-farm/platform-specific-configurations/mac.sh

@@ -28,7 +28,7 @@ function isHotSpot() {
   [ "${VARIANT}" == "${BUILD_VARIANT_CORRETTO}" ]
 }
 
-export MACOSX_DEPLOYMENT_TARGET=10.8
+export MACOSX_DEPLOYMENT_TARGET=10.9
 export BUILD_ARGS="${BUILD_ARGS}"
 
 XCODE_SWITCH_PATH="/";
@@ -46,10 +46,20 @@ else
   if [ "${VARIANT}" == "${BUILD_VARIANT_OPENJ9}" ]; then
     export CONFIGURE_ARGS_FOR_ANY_PLATFORM="${CONFIGURE_ARGS_FOR_ANY_PLATFORM} --with-openssl=fetched --enable-openssl-bundling"
   else
-    export CONFIGURE_ARGS_FOR_ANY_PLATFORM="${CONFIGURE_ARGS_FOR_ANY_PLATFORM} --with-extra-cxxflags=-mmacosx-version-min=10.8"
+    export CONFIGURE_ARGS_FOR_ANY_PLATFORM="${CONFIGURE_ARGS_FOR_ANY_PLATFORM} --with-extra-cxxflags=-mmacosx-version-min=10.9"
   fi
 fi
 
+if [ "${JAVA_TO_BUILD}" == "${JDK11_VERSION}" ]
+then
+  export CONFIGURE_ARGS_FOR_ANY_PLATFORM="${CONFIGURE_ARGS_FOR_ANY_PLATFORM} --with-sysroot=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/"
+  # Login to KeyChain
+  # shellcheck disable=SC2046
+  # shellcheck disable=SC2006
+  security unlock-keychain -p `cat ~/.password`
+  export BUILD_ARGS="${BUILD_ARGS} --codesign-identity 'Developer ID Application: London Jamocha Community CIC'"
+fi
+
 sudo xcode-select --switch "${XCODE_SWITCH_PATH}"
 
 # Any version above 8 (11 for now due to openjdk-build#1409
@@ -81,5 +91,4 @@ if [ "${VARIANT}" == "${BUILD_VARIANT_OPENJ9}" ]; then
     export SDKPATH=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.8.sdk
     export CONFIGURE_ARGS_FOR_ANY_PLATFORM="${CONFIGURE_ARGS_FOR_ANY_PLATFORM} --with-xcode-path=/Applications/Xcode.app --with-openj9-cc=/Applications/Xcode7/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang --with-openj9-cxx=/Applications/Xcode7/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang++ --with-openj9-developer-dir=/Applications/Xcode7/Xcode.app/Contents/Developer"
   fi
-fi
-
+fi

pipelines/build/common/openjdk_build_pipeline.groovy

@@ -140,7 +140,8 @@ class Build {
 
     def sign(VersionInfo versionInfo) {
         // Sign and archive jobs if needed
-        if (buildConfig.TARGET_OS == "windows" || buildConfig.TARGET_OS == "mac") {
+        // TODO: This version info check needs to be updated when the notarization fix gets applied to other versions.
+        if (buildConfig.TARGET_OS == "windows" || (buildConfig.TARGET_OS == "mac" && versionInfo.major != 11)) {
             context.node('master') {
                 context.stage("sign") {
                     def filter = ""
@@ -153,6 +154,7 @@ class Build {
                         certificate = "C:\\Users\\jenkins\\windows.p12"
                         nodeFilter = "${nodeFilter}&&build"
 
+                    // TODO: This version info check needs to be updated when the notarization fix gets applied to other versions.
                     } else if (buildConfig.TARGET_OS == "mac") {
                         filter = "**/OpenJDK*_mac_*.tar.gz"
                         certificate = "\"Developer ID Application: London Jamocha Community CIC\""

pipelines/build/openjdk11_pipeline.groovy

@@ -16,10 +16,7 @@ def buildConfigurations = [
         x64Mac    : [
                 os                  : 'mac',
                 arch                : 'x64',
-                additionalNodeLabels: [
-                        hotspot: 'build-macstadium-macos1010-1',
-                        openj9:  'build-macstadium-macos1010-2'
-                ],
+                additionalNodeLabels : 'macos10.14',
                 test                : [
                         nightly: false,
                         release: ['sanity.openjdk', 'sanity.system', 'extended.system', 'sanity.perf']
@@ -29,7 +26,7 @@ def buildConfigurations = [
         x64MacXL    : [
                 os                   : 'mac',
                 arch                 : 'x64',
-                additionalNodeLabels : 'build-macstadium-macos1010-2',
+                additionalNodeLabels : 'macos10.14',
                 test                : [
                         nightly: false,
                         release: ['sanity.openjdk', 'sanity.system', 'extended.system']

sbin/build.sh

@@ -79,6 +79,12 @@ configuringBootJDKConfigureParameter()
   addConfigureArgIfValueIsNotEmpty "--with-boot-jdk=" "${BUILD_CONFIG[JDK_BOOT_DIR]}"
 }
 
+# Configure the boot JDK
+configuringMacOSCodesignParameter()
+{
+  addConfigureArgIfValueIsNotEmpty "--with-macosx-codesign-identity=" "\"${BUILD_CONFIG[MACOSX_CODESIGN_IDENTITY]}\""
+}
+
 # Get the OpenJDK update version and build version
 getOpenJDKUpdateAndBuildVersion()
 {
@@ -246,22 +252,19 @@ buildingTheRestOfTheConfigParameters()
     addConfigureArg "--enable-ccache" ""
   fi
 
-  addConfigureArg "--with-alsa=" "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[WORKING_DIR]}/installedalsa"
-
   # Point-in-time dependency for openj9 only
   if [[ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_OPENJ9}" ]] ; then
     addConfigureArg "--with-freemarker-jar=" "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[WORKING_DIR]}/freemarker-${FREEMARKER_LIB_VERSION}/freemarker.jar"
   fi
 
-  addConfigureArg "--with-x=" "/usr/include/X11"
-
-
   if [ "${BUILD_CONFIG[OPENJDK_CORE_VERSION]}" == "${JDK8_CORE_VERSION}" ] ; then
     # We don't want any extra debug symbols - ensure it's set to release,
     # other options include fastdebug and slowdebug
     addConfigureArg "--with-debug-level=" "release"
     addConfigureArg "--disable-zip-debug-info" ""
     addConfigureArg "--disable-debug-symbols" ""
+    addConfigureArg "--with-x=" "/usr/include/X11"
+    addConfigureArg "--with-alsa=" "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[WORKING_DIR]}/installedalsa"
   else
     addConfigureArg "--with-debug-level=" "release"
     addConfigureArg "--with-native-debug-symbols=" "none"
@@ -296,6 +299,7 @@ configureCommandParameters()
 {
   configuringVersionStringParameter
   configuringBootJDKConfigureParameter
+  configuringMacOSCodesignParameter
 
   if [[ "$OSTYPE" == "cygwin" ]] || [[ "$OSTYPE" == "msys" ]]; then
     echo "Windows or Windows-like environment detected, skipping configuring environment for custom Boot JDK and other 'configure' settings."

sbin/common/config_init.sh

@@ -59,6 +59,7 @@ JDK_PATH
 JRE_PATH
 TEST_IMAGE_PATH
 JVM_VARIANT
+MACOSX_CODESIGN_IDENTITY
 MAKE_ARGS_FOR_ANY_PLATFORM
 MAKE_COMMAND_NAME
 NUM_PROCESSORS
@@ -187,6 +188,9 @@ function parseConfigurationArguments() {
         "--make-args" )
         BUILD_CONFIG[USER_SUPPLIED_MAKE_ARGS]="$1"; shift;;
 
+        "--codesign-identity" )
+        BUILD_CONFIG[MACOSX_CODESIGN_IDENTITY]="$1"; shift;;
+
         "--clean-docker-build" | "-c" )
         BUILD_CONFIG[CLEAN_DOCKER_BUILD]=true;;
 
@@ -352,6 +356,8 @@ function configDefaults() {
   BUILD_CONFIG[SIGN]="false"
   BUILD_CONFIG[JDK_BOOT_DIR]=""
 
+  BUILD_CONFIG[MACOSX_CODESIGN_IDENTITY]=${BUILD_CONFIG[MACOSX_CODESIGN_IDENTITY]:-""}
+
   BUILD_CONFIG[NUM_PROCESSORS]="1"
   BUILD_CONFIG[TARGET_FILE_NAME]="OpenJDK.tar.gz"