1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
function( sign_kicad_bundle target signing_id use_secure_timestamp use_hardened_runtime entitlements_file)
# If the signing ID wasn't passed in, use - which means adhoc signing
if ( NOT signing_id )
set( signing_id "-")
endif()
MESSAGE( STATUS "Signing ${target} with ${signing_id}, hardened runtime: ${use_hardened_runtime}, secure timestamp: ${use_secure_timestamp}, entitlements file: ${entitlements_file}" )
# --deep doesn't really work and is officially deprecated as of macos 13
# https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG201
# collect a list of things to sign, in order
set( sign_list "${target}/Contents/Applications/eeschema.app/Contents/MacOS/eeschema"
"${target}/Contents/Applications/eeschema.app"
"${target}/Contents/Applications/gerbview.app/Contents/MacOS/gerbview"
"${target}/Contents/Applications/gerbview.app" "${target}/Contents/Applications/pcbnew.app/Contents/MacOS/pcbnew" "${target}/Contents/Applications/pcbnew.app" "${target}/Contents/Applications/bitmap2component.app/Contents/MacOS/bitmap2component" "${target}/Contents/Applications/bitmap2component.app" "${target}/Contents/Applications/pcb_calculator.app/Contents/MacOS/pcb_calculator" "${target}/Contents/Applications/pcb_calculator.app" "${target}/Contents/Applications/pl_editor.app/Contents/MacOS/pl_editor" "${target}/Contents/Applications/pl_editor.app")
# Python things!
if( EXISTS "${target}/Contents/Frameworks/Python.framework" )
set( sign_list ${sign_list} "${target}/Contents/Frameworks/Python.framework/Versions/Current/share/doc/python3.9/examples/Tools/pynche"
"${target}/Contents/Frameworks/Python.framework/Versions/Current/Resources/Python.app/Contents/MacOS/Python")
file( GLOB python_bins "${target}/Contents/Frameworks/Python.framework/Versions/Current/bin/*" )
# add dylib, .so and .a files from Contents/Frameworks/Python.framework/Versions/Current/lib/ and recursively
file( GLOB_RECURSE python_libs ${sign_list} "${target}/Contents/Frameworks/Python.framework/Versions/Current/lib/*.dylib"
"${target}/Contents/Frameworks/Python.framework/Versions/Current/lib/*.so"
"${target}/Contents/Frameworks/Python.framework/Versions/Current/lib/*.a"
"${target}/Contents/Frameworks/Python.framework/Versions/Current/lib/*.o" )
set( sign_list ${sign_list} ${python_bins} ${python_libs} )
endif( )
set( sign_list ${sign_list} "${target}/Contents/Frameworks/Python.framework/Versions/Current/Resources/Python.app"
"${target}/Contents/Frameworks/Python.framework" )
# add all the dylibs from contents/frameworks
file( GLOB framework_dylibs "${target}/Contents/Frameworks/*.dylib" )
# add all the files in Contents/PlugIns
file( GLOB_RECURSE plugins "${target}/Contents/PlugIns/*" )
file( GLOB_RECURSE translations "${target}/Contents/SharedSupport/internat/*.mo" )
# add all the files in Contents/MacOS/
# But we've gotta sign kicad-cli before signing kicad, at least on x86_64
set( kicad_bins "${target}/Contents/MacOS/dxf2idf"
"${target}/Contents/MacOS/idf2vrml"
"${target}/Contents/MacOS/idfcyl"
"${target}/Contents/MacOS/idfrect"
"${target}/Contents/MacOS/kicad-cli"
"${target}/Contents/MacOS/kicad")
set( sign_list ${sign_list} ${framework_dylibs} ${plugins} ${translations} ${kicad_bins} ) # do i need to quote this differently?
# add kicad.app!
set( sign_list ${sign_list} "${target}" )
# build the command used for signing
set( command codesign --force --sign "${signing_id}" )
if( use_secure_timestamp )
set( command ${command} --timestamp )
endif( )
if( use_hardened_runtime )
if ( signing_id STREQUAL "-" )
message( FATAL_ERROR "Hardened runtime requires a (non-ad-hoc) signing identity." )
endif( )
set( command ${command} --options runtime )
endif( )
if( entitlements_file )
set( command ${command} --entitlements "${entitlements_file}" )
endif( )
foreach( item ${sign_list} )
set( cmd ${command} "${item}" )
# MESSAGE( STATUS "Running ${cmd}")
execute_process( COMMAND ${cmd}
RESULT_VARIABLE codesign_result)
if( NOT codesign_result EQUAL 0 )
message( WARNING "macOS signing failed; ${cmd} returned ${codesign_result}" )
endif( )
endforeach( )
endfunction()
function( verify_signing target )
set( cmd codesign --verify --deep --strict --verbose=3 "${target}" )
execute_process( COMMAND ${cmd} RESULT_VARIABLE verify_result )
if( NOT verify_result EQUAL 0 )
message( FATAL_ERROR "macOS signing verification failed; ran ${cmd}" )
endif( )
endfunction( )
|
