Build with MAC_CODESIGN_ID=OFF fails on ARM / Big Sur

[fxcoudert]

Homebrew maintainer here, trying to make fish 3.1.2 work on ARM Big Sur. Our current build fails with:

dyld: Library not loaded: /usr/local/opt/gettext/lib/libintl.8.dylib
  Referenced from: /usr/local/Cellar/fish/3.1.2/bin/fish
  Reason: no suitable image found.  Did find:
	/usr/local/opt/gettext/lib/libintl.8.dylib: code signature in (/usr/local/opt/gettext/lib/libintl.8.dylib) not valid for use in process using Library Validation: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)

I understood from #6952 that we needed to build with -DMAC_CODESIGN_ID=OFF but that makes the build fail with:

[ 88%] Linking CXX executable fish_key_reader
/usr/local/Cellar/cmake/3.18.4/bin/cmake -E cmake_link_script CMakeFiles/fish_key_reader.dir/link.txt --verbose=1
/usr/local/Homebrew/Library/Homebrew/shims/mac/super/clang++  -Wall -Wextra -Wno-implicit-fallthrough -Wno-comment -Wno-address -Wno-strict-aliasing -Wno-redundant-move  -isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.0.sdk -mmacosx-version-min=10.9 -Wl,-search_paths_first -Wl,-headerpad_max_install_names CMakeFiles/fish_key_reader.dir/src/fish_key_reader.cpp.o CMakeFiles/fish_key_reader.dir/src/print_help.cpp.o -o fish_key_reader  libfishlib.a /Applications/Xcode-beta.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.0.sdk/usr/lib/libcurses.tbd libpcre2-32.a /usr/local/lib/libintl.dylib 
codesign --force --deep --options runtime --sign OFF /tmp/fish-20201108-71162-1db6hn7/fish-3.1.2/fish_key_reader
error: The specified item could not be found in the keychain.
make[3]: *** [fish_key_reader] Error 1
make[3]: *** Deleting file `fish_key_reader'
make[2]: *** [CMakeFiles/fish_key_reader.dir/all] Error 2
make[1]: *** [all] Error 2
make: *** [all] Error 2

Could you provide some guidance on how to fix this?

[faho]

Disabling codesigining requires 3a47db7, which isn't in 3.1.2.

You'll have to backport it or wait for 3.2.0.

[fxcoudert]

When is the 3.2.0 release planned?

[faho]

"When it's done". Given the current situation we can't make any guarantees of any kind.

[fxcoudert]

May I suggest a backport to the 3.1 branch if it's still active? Codesigning by default, without user input, is quite invasive

[ridiculousfish]

@fxcoudert Codesigning is required for Apple Silicon, is it not? What's the plan for Homebrew - will it ad-hoc code sign everything? If so, it could just replace the signature here.

[fxcoudert]

The compiler, linker, and other developer tools add an ad hoc signature to everything they produce. Homebrew will, in addition, resign the binaries it modifies itself (for example for relocation of our binary builds).