Skip to content

Commit e5b54e7

Browse files
committed
fix fix-machos when signing fails
this is a somewhat common error-state, where the resigning fails, so we strip and resign ourselves. this should be able to be self-healing in fix-machos to prevent packagers from having to deal with this occassional darwin-specific problem.
1 parent d0287e8 commit e5b54e7

File tree

1 file changed

+25
-1
lines changed

1 file changed

+25
-1
lines changed

lib/bin/fix-machos.rb

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ def codesign!(filename)
7272

7373
signing_id = ENV['APPLE_IDENTITY'] || "-"
7474

75+
# capture entitlements before we touch anything
76+
entitlements_xml, _, _ = Open3.capture3("codesign", "-d", "--entitlements", ":-", filename)
77+
has_entitlements = !entitlements_xml.strip.empty?
78+
7579
_, stderr_str, status = Open3.capture3("codesign", "--sign", signing_id, "--force",
7680
"--preserve-metadata=entitlements,requirements,flags,runtime",
7781
filename)
@@ -81,7 +85,27 @@ def codesign!(filename)
8185
# https://github.com/denoland/deno/issues/575
8286
# codesign "fails" after correctly signing these binaries with the below error,
8387
# but the binaries still work.
84-
raise MachO::CodeSigningError, "#{filename}: signing failed!" unless
88+
return if status.success? or stderr_str.include?("main executable failed strict validation")
89+
90+
# some binaries end up in a state where --preserve-metadata fails
91+
# strip the signature entirely and re-sign from scratch
92+
puts "fix-macho: re-signing #{filename} (preserve-metadata failed)"
93+
Open3.capture3("codesign", "--remove-signature", filename)
94+
95+
if has_entitlements
96+
# write entitlements to a tmpfile and re-sign with them
97+
require 'tempfile'
98+
tmp = Tempfile.new(['entitlements', '.xml'])
99+
tmp.write(entitlements_xml)
100+
tmp.close
101+
_, stderr_str, status = Open3.capture3("codesign", "--sign", signing_id, "--force",
102+
"--entitlements", tmp.path, filename)
103+
tmp.unlink
104+
else
105+
_, stderr_str, status = Open3.capture3("codesign", "--sign", signing_id, "--force", filename)
106+
end
107+
108+
raise MachO::CodeSigningError, "#{filename}: signing failed! #{stderr_str}" unless
85109
status.success? or
86110
stderr_str.include?("main executable failed strict validation")
87111
end

0 commit comments

Comments
 (0)