update: enhance macOS signing process to support Linux platform and improve xattr handling

Author: Ryosuke-Asano

.github/patches/upstream/tools-signing-macos-mach_commands.py.patch

@@ -1,5 +1,5 @@
 diff --git a/tools/signing/macos/mach_commands.py b/tools/signing/macos/mach_commands.py
-index 4227363da7..4872c1d592 100644
+index 4227363da7..c09553ec40 100644
 --- a/tools/signing/macos/mach_commands.py
 +++ b/tools/signing/macos/mach_commands.py
 @@ -10,6 +10,8 @@ import plistlib
@@ -72,7 +72,7 @@ index 4227363da7..4872c1d592 100644
 +        # in re-signing without requiring --force.
 +        cs_reset_cmd = ["find", app, "-exec", "codesign", "--remove-signature", "{}", ";"]
 +        run(command_context, cs_reset_cmd, capture_output=not verbose_arg)
- 
+
      if use_rcodesign_arg is True:
          sign_with_rcodesign(
 @@ -367,7 +378,11 @@ def macos_sign(
@@ -88,7 +88,17 @@ index 4227363da7..4872c1d592 100644
 
 
  def entitlement_repo_path(entitlements_key, entitlement_file):
-@@ -723,3 +738,143 @@ def strip_restricted_entitlements(plist_file):
+@@ -551,7 +566,8 @@ def run(ctx, cmd, **kwargs):
+     cmd_as_str = " ".join(cmd)
+     ctx.log(logging.DEBUG, "macos-sign", {"cmd": cmd_as_str}, "[{cmd}]")
+     try:
+-        subprocess.run(cmd, check=True, **kwargs)
++        check = kwargs.pop('check', True)
++        subprocess.run(cmd, check=check, **kwargs)
+     except subprocess.CalledProcessError as e:
+         ctx.log(
+             logging.ERROR,
+@@ -723,3 +739,143 @@ def strip_restricted_entitlements(plist_file):
          temp_file_obj.close()
 
      return temp_file_path