strip does ad-hoc code signatures on darwin

Dockerfile.mri.erb

@@ -209,9 +209,9 @@ RUN sed -i -- "s:/root/.rake-compiler:/usr/local/rake-compiler:g" /usr/local/rak
 
 <% if platform=~/mingw/ %>
 # Install wrappers for strip commands as a workaround for "Protocol error" in boot2docker.
-COPY build/strip_wrapper /root/
+COPY build/strip_wrapper_vbox /root/
 RUN mv /usr/bin/<%= target %>-strip /usr/bin/<%= target %>-strip.bin && \
-    ln /root/strip_wrapper /usr/bin/<%= target %>-strip
+    ln /root/strip_wrapper_vbox /usr/bin/<%= target %>-strip
 
 # Use posix pthread for mingw so that C++ standard library for thread could be
 # available such as std::thread, std::mutex, so on.
@@ -220,6 +220,13 @@ RUN printf "1\n" | update-alternatives --config <%= target %>-gcc && \
     printf "1\n" | update-alternatives --config <%= target %>-g++
 <% end %>
 
+<% if platform =~ /darwin/ %>
+# Install wrapper around strip to re-sign binaries (ad-hoc signature)
+COPY build/strip_wrapper_codesign /root/
+RUN mv /opt/osxcross/target/bin/<%= target %>-strip /opt/osxcross/target/bin/<%= target %>-strip.bin && \
+    ln /root/strip_wrapper_codesign /opt/osxcross/target/bin/<%= target %>-strip
+<% end %>
+
 <% if manylinux %>
 # Enable modern compiler toolset of manylinux image
 RUN echo "export PATH=\$DEVTOOLSET_ROOTPATH/usr/bin:\$PATH" >> /etc/rubybashrc

build/mk_osxcross.sh

@@ -36,3 +36,8 @@ find /opt/osxcross/target/bin/ -name '*-apple-darwin[0-9]*' | sort | while read
 # There's no objdump in osxcross but we can use llvm's
 ln -s /usr/lib/llvm-10/bin/llvm-objdump /opt/osxcross/target/bin/x86_64-apple-darwin-objdump
 ln -s /usr/lib/llvm-10/bin/llvm-objdump /opt/osxcross/target/bin/aarch64-apple-darwin-objdump
+
+# install /usr/bin/codesign and make a symlink for codesign_allocate (the architecture doesn't matter)
+git clone -q --depth=1 https://github.com/flavorjones/sigtool --branch flavorjones-fix-link-line-library-order
+make -C sigtool install
+ln -s /opt/osxcross/target/bin/x86_64-apple-darwin[0-9]*-codesign_allocate /usr/bin/codesign_allocate

build/strip_wrapper_codesign

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+
+# Stripping a signed Mach-O binary will invalidate the signature. To mimic what strip does on native
+# Darwin, we install this wrapper to re-sign the binary after stripping it.
+
+files = ARGV.reject { |f| f=~/^-/ }
+
+strip = "#{File.basename($0)}.bin"
+strip_options = ARGV.select{|f| f=~/^-/ }
+strip_arguments = [strip] + strip_options + files
+
+codesign = "codesign" # installed into /usr/bin by mk_osxcross.sh
+codesign_options = ["-f", "-s-"]
+codesign_arguments = [codesign] + codesign_options + files
+
+system(*strip_arguments, exception: true)
+system(*codesign_arguments, exception: true)

test/rcd_test/ext/mri/extconf.rb

@@ -92,4 +92,18 @@
   end
 
   create_makefile("rcd_test/rcd_test_ext")
+
+  # exercise the strip command - this approach borrowed from grpc
+  strip_tool = RbConfig::CONFIG['STRIP']
+  strip_tool += ' -x' if RUBY_PLATFORM =~ /darwin/
+  File.open('Makefile.new', 'w') do |o|
+    o.puts 'hijack: all strip'
+    o.puts
+    o.write(File.read('Makefile'))
+    o.puts
+    o.puts 'strip: $(DLLIB)'
+    o.puts "\t$(ECHO) Stripping $(DLLIB)"
+    o.puts "\t$(Q) #{strip_tool} $(DLLIB)"
+  end
+  File.rename('Makefile.new', 'Makefile')
 end