Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move codesign_patched_binary to extend/os/mac/keg.rb #13114

Merged
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
37 changes: 37 additions & 0 deletions Library/Homebrew/extend/os/mac/keg.rb
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,41 @@ class Keg
def binary_executable_or_library_files
mach_o_files
end

def codesign_patched_binary(file)
return if MacOS.version < :big_sur
return unless Hardware::CPU.arm?

odebug "Codesigning #{file}"
# Use quiet_system to squash notifications about resigning binaries
# which already have valid signatures.
return if quiet_system("codesign", "--sign", "-", "--force",
"--preserve-metadata=entitlements,requirements,flags,runtime",
file)

# If the codesigning fails, it may be a bug in Apple's codesign utility
# A known workaround is to copy the file to another inode, then move it back
# erasing the previous file. Then sign again.
#
# TODO: remove this once the bug in Apple's codesign utility is fixed
Dir::Tmpname.create("workaround") do |tmppath|
FileUtils.cp file, tmppath
FileUtils.mv tmppath, file, force: true
end

# Try signing again
odebug "Codesigning (2nd try) #{file}"
result = system_command("codesign", args: [
"--sign", "-", "--force",
"--preserve-metadata=entitlements,requirements,flags,runtime",
file
], print_stderr: false)
return if result.success?

# If it fails again, error out
onoe <<~EOS
Failed applying an ad-hoc signature to #{file}:
#{result.stderr}
EOS
end
end
2 changes: 2 additions & 0 deletions Library/Homebrew/keg.rb
Original file line number Diff line number Diff line change
Expand Up @@ -529,6 +529,8 @@ def binary_executable_or_library_files
elf_files
end

def codesign_patched_binary(file); end

private

def resolve_any_conflicts(dst, dry_run: false, verbose: false, overwrite: false)
Expand Down
37 changes: 0 additions & 37 deletions Library/Homebrew/os/mac/keg.rb
Original file line number Diff line number Diff line change
Expand Up @@ -60,41 +60,4 @@ def delete_rpath(rpath, file)
EOS
raise
end

def codesign_patched_binary(file)
return if MacOS.version < :big_sur
return unless Hardware::CPU.arm?

odebug "Codesigning #{file}"
# Use quiet_system to squash notifications about resigning binaries
# which already have valid signatures.
return if quiet_system("codesign", "--sign", "-", "--force",
"--preserve-metadata=entitlements,requirements,flags,runtime",
file)

# If the codesigning fails, it may be a bug in Apple's codesign utility
# A known workaround is to copy the file to another inode, then move it back
# erasing the previous file. Then sign again.
#
# TODO: remove this once the bug in Apple's codesign utility is fixed
Dir::Tmpname.create("workaround") do |tmppath|
FileUtils.cp file, tmppath
FileUtils.mv tmppath, file, force: true
end

# Try signing again
odebug "Codesigning (2nd try) #{file}"
result = system_command("codesign", args: [
"--sign", "-", "--force",
"--preserve-metadata=entitlements,requirements,flags,runtime",
file
], print_stderr: false)
return if result.success?

# If it fails again, error out
onoe <<~EOS
Failed applying an ad-hoc signature to #{file}:
#{result.stderr}
EOS
end
end