Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[helix][ios] Emulate deep signing of iOS app bundles on helix in order to support library mode builds #14164

Merged
merged 3 commits into from
Nov 13, 2023

Conversation

ivanpovazan
Copy link
Member

@ivanpovazan ivanpovazan commented Oct 26, 2023

Description

This PR adds support for properly signing iOS app bundles which include apps with shared libraries on Helix.
This is required so we can execute library mode tests on Helix properly when we target ios devices with Mono and NativeAOT using library mode.

Changes

In order to properly perform deep signing of iOS app bundles, I am adding a manual step which finds all:

  • Macho-O
  • .app
  • .framework

files in the bundle and signs them by respecting the bundle hierarchy (deepest files are signed first). This is achieved by looking up all the files in the bundle with find -d.

This manual signing step is required as the --deep argument on the codesign tool seems to be deprecated.

man codesign
...
     --deep  (DEPRECATED for signing as of macOS 13.0) When signing a bundle, specifies that nested code content such as helpers, frameworks, and plug-ins, should be recursively signed in turn.
             Beware:

Validation

I have validated locally that the change properly signs the app, by signing and running the added tests in: dotnet/runtime#93658

Repro steps

  1. Checkout the PR
gh pr checkout 93658
  1. Build runtime and tests (as on build machine):
./build.sh -s mono+libs+libs.tests -os ios -arch arm64 -c Release /p:ArchiveTests=true /p:DevTeamProvisioning=- /p:RunAOTCompilation=true /p:RunSmokeTestsOnly=False /p:EnableAdditionalTimezoneChecks=true  /p:BuildDarwinFrameworks=true /p:IsManualOrRollingBuild=true /p:BuildTestsOnHelix=true /p:BuildDarwinFrameworks=true /p:UsePortableRuntimePack=true -binaryLog
  1. Build build tasks:
./build.sh -s tasks -c Debug
  1. Extract built test
cd artifacts/helix/tests/ios.AnyCPU.Release
mkdir iOS.Device.LibraryMode.Test
tar -xvf iOS.Device.LibraryMode.Test.zip -C iOS.Device.LibraryMode.Test
cd iOS.Device.LibraryMode.Test/publish
  1. AOT compile the test (as on Helix):
../../../../../../dotnet.sh msbuild ProxyProjectForAOTOnHelix.proj /p:RuntimeSrcDir=/Users/ivan/repos/runtime-naot /p:RuntimeConfig=Release /p:RunAOTCompilation=true /p:UsePortableRuntimePack=true /p:TargetOS=ios /p:TargetArchitecture=arm64 /p:MonoEnableLLVM=true /p:DevTeamProvisioning=- /p:Configuration=Release /bl:test.binlog -p:BundlesResources=false -p:NativeLib=Shared -p:ForceLibraryModeGenerateAppBundle=true ; cd ..
  1. Adjust build-apple-app.sh to invoke sign function with my local settings and changes from this PR
  2. Run the app
../../../../../dotnet.sh xharness apple run --app publish/iOS.Device.LibraryMode.Test.app --output-directory /tmp/helix/testing --target ios-device --timeout 01:00:00 --xcode /Applications/Xcode_14.3.1.app -v --launch-timeout 00:05:00 --signal-app-end --expected-exit-code 42 --

@premun
Copy link
Member

premun commented Oct 26, 2023

@mandel-macaque can you have a look at this one please?

mandel-macaque
mandel-macaque previously approved these changes Nov 1, 2023
Copy link
Member

@mandel-macaque mandel-macaque left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good, but I have added a comment to make your liver much better. Aiming to sign all the Mach-O files will ensure that you do not find more surprises along the way.

@ivanpovazan
Copy link
Member Author

@mandel-macaque @akoeplinger I adapted the signing to match your suggestions.
Could you please give it another look?

@akoeplinger akoeplinger merged commit e3fde0b into dotnet:main Nov 13, 2023
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants