admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

Merge pull request #9102 from fxcoudert/sign

Browse Source 
keg: add codesigning
This commit is contained in:
Claudia Pellegrino 2020-11-14 08:00:01 +01:00 committed by GitHub
commit e945b1c42a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
Library/Homebrew/os/mac/keg.rb
View File

@ -8,6 +8,7 @@ class Keg
@require_relocation = true @require_relocation = true
odebug "Changing dylib ID of #{file}\n from #{file.dylib_id}\n to #{id}" odebug "Changing dylib ID of #{file}\n from #{file.dylib_id}\n to #{id}"
MachO::Tools.change_dylib_id(file, id, strict: false) MachO::Tools.change_dylib_id(file, id, strict: false)
apply_ad_hoc_signature(file)
rescue MachO::MachOError rescue MachO::MachOError
onoe <<~EOS onoe <<~EOS
Failed changing dylib ID of #{file} Failed changing dylib ID of #{file}
@ -23,6 +24,7 @@ class Keg
@require_relocation = true @require_relocation = true
odebug "Changing install name in #{file}\n from #{old}\n to #{new}" odebug "Changing install name in #{file}\n from #{old}\n to #{new}"
MachO::Tools.change_install_name(file, old, new, strict: false) MachO::Tools.change_install_name(file, old, new, strict: false)
apply_ad_hoc_signature(file)
rescue MachO::MachOError rescue MachO::MachOError
onoe <<~EOS onoe <<~EOS
Failed changing install name in #{file} Failed changing install name in #{file}
@ -31,4 +33,37 @@ class Keg
EOS EOS
raise raise
end end
def apply_ad_hoc_signature(file)
return if MacOS.version < :big_sur
return unless Hardware::CPU.arm?
odebug "Codesigning #{file}"
# Use quiet_system to squash notifications about resigning binaries
# which already have valid signatures.
return if quiet_system("codesign", "--sign", "-", "--force",
"--preserve-metadata=entitlements,requirements,flags,runtime",
file)
# If the codesigning fails, it may be a bug in Apple's codesign utility
# A known workaround is to copy the file to another inode, then move it back
# erasing the previous file. Then sign again.
#
# TODO: remove this once the bug in Apple's codesign utility is fixed
Dir::Tmpname.create("workaround") do |tmppath|
FileUtils.cp file, tmppath
FileUtils.mv tmppath, file, force: true
end
# Try signing again
odebug "Codesigning (2nd try) #{file}"
return if quiet_system("codesign", "--sign", "-", "--force",
"--preserve-metadata=entitlements,requirements,flags,runtime",
file)
# If it fails again, error out
onoe <<~EOS
Failed applying an ad-hoc signature to #{file}
EOS
end
end end