Skip to content

Commit 6c252e1

Browse files
sshelomentsevsshelomentsev
committed
JBR-7800 Fix notarization of jbrsdk (sign libs and execs inside jmod files)
1 parent c648556 commit 6c252e1

File tree

3 files changed

+103
-15
lines changed

3 files changed

+103
-15
lines changed

‎jb/project/tools/mac/scripts/notarize.sh‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,34 @@ trap "rm -f \"$PWD/tmp_key\"" INT EXIT RETURN
3030
echo -n "${APPLE_PRIVATE_KEY}" > tmp_key
3131

3232
log "Notarizing $APP_PATH..."
33-
xcrun notarytool submit --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" "$APP_PATH" 2>&1 | tee "notarytool.submit.out"
33+
xcrun notarytool submit --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" "$APP_PATH" 2>&1 --wait| tee "notarytool.submit.out"
3434
REQUEST_ID="$(grep -e " id: " "notarytool.submit.out" | grep -oE '([0-9a-f-]{36})'| head -n1)"
3535

36-
xcrun notarytool wait "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" --timeout 6h ||:
37-
xcrun notarytool log "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" developer_log.json ||:
38-
xcrun notarytool info "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}"
36+
waitOutput=$(xcrun notarytool wait "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" --timeout 6h)
37+
if [ $? -ne 0 ]; then
38+
log "Notarizing failed (wait command)"
39+
echo "$waitOutput"
40+
exit 1
41+
else
42+
echo "$waitOutput"
43+
fi
44+
45+
logOutout=$(xcrun notarytool log "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" developer_log.json)
46+
if [ $? -ne 0 ]; then
47+
log "Notarizing failed (log command)"
48+
echo "$logOutout"
49+
exit 1
50+
else
51+
echo "$logOutout"
52+
fi
53+
54+
infoOUtput=$(xcrun notarytool info "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}")
55+
if [ $? -ne 0 ]; then
56+
log "Notarizing failed (info command)"
57+
echo "$infoOUtput"
58+
exit 1
59+
else
60+
echo "$infoOUtput"
61+
fi
3962

4063
log "Notarizing finished"

‎jb/project/tools/mac/scripts/sign.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,51 @@ for f in \
5555
fi
5656
done
5757

58+
log "Signing jmod files"
59+
JMODS_DIR="$APPLICATION_PATH/Contents/Home/jmods"
60+
if [ -d "$JMODS_DIR" ]; then
61+
for jmod_file in "$JMODS_DIR"/*.jmod; do
62+
log "Processing $jmod_file"
63+
64+
TMP_DIR="$JMODS_DIR/tmp"
65+
rm -rf "$TMP_DIR"
66+
mkdir "$TMP_DIR"
67+
68+
log "Unzipping $jmod_file"
69+
"$BOOT_JDK/bin/jmod" extract --dir "$TMP_DIR" "$jmod_file" >/dev/null
70+
log "Removing $jmod_file"
71+
rm -f "$jmod_file"
72+
73+
log "Signing dylibs in $TMP_DIR"
74+
find "$TMP_DIR" \
75+
-type f \( -name "*.dylib" -o -name "*.so"-o -perm +111 -o -name jarsigner -o -name jdeps -o -name jpackageapplauncher -o -name jspawnhelper -o -name jar -o -name javap -o -name jdeprscan -o -name jfr -o -name rmiregistry -o -name java -o -name jhsdb -o -name jstatd -o -name jstatd -o -name jpackage -o -name keytool -o -name jmod -o -name jlink -o -name jimage -o -name jstack -o -name jcmd -o -name jps -o -name jmap -o -name jstat -o -name jinfo -o -name jshell -o -name jwebserver -o -name javac -o -name serialver -o -name jrunscript -o -name jdb -o -name jconsole -o -name javadoc \) \
76+
-exec "$SIGN_UTILITY" --timestamp \
77+
-v -s "$JB_DEVELOPER_CERT" --options=runtime --force \
78+
--entitlements "$SCRIPT_DIR/entitlements.xml" {} \;
79+
80+
cmd="$BOOT_JDK/bin/jmod create --class-path $TMP_DIR/classes"
81+
82+
# Check each directory and add to the command if it exists
83+
[ -d "$TMP_DIR/bin" ] && cmd="$cmd --cmds $TMP_DIR/bin"
84+
[ -d "$TMP_DIR/conf" ] && cmd="$cmd --config $TMP_DIR/conf"
85+
[ -d "$TMP_DIR/lib" ] && cmd="$cmd --libs $TMP_DIR/lib"
86+
[ -d "$TMP_DIR/include" ] && cmd="$cmd --header-files $TMP_DIR/include"
87+
[ -d "$TMP_DIR/legal" ] && cmd="$cmd --legal-notices $TMP_DIR/legal"
88+
[ -d "$TMP_DIR/man" ] && cmd="$cmd --man-pages $TMP_DIR/man"
89+
90+
# Add the output file
91+
cmd="$cmd $jmod_file"
92+
93+
# Execute the command
94+
eval $cmd
95+
96+
log "Removing $TMP_DIR"
97+
rm -rf "$TMP_DIR"
98+
done
99+
else
100+
echo "Directory '$JMODS_DIR' does not exist. Skipping signing of jmod files."
101+
fi
102+
58103
log "Signing libraries in jars in $APPLICATION_PATH"
59104

60105
# todo: add set -euo pipefail; into the inner sh -c

‎jb/project/tools/mac/scripts/signapp.sh‎

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,6 @@ BUILD_NAME="$(ls "$EXPLODED")"
3838
#sed -i '' s/BNDL/APPL/ $EXPLODED/$BUILD_NAME/Contents/Info.plist
3939
rm -f $EXPLODED/$BUILD_NAME/Contents/CodeResources
4040
rm "$INPUT_FILE"
41-
if test -d $EXPLODED/$BUILD_NAME/Contents/Home/jmods; then
42-
mv $EXPLODED/$BUILD_NAME/Contents/Home/jmods $BACKUP_JMODS
43-
fi
4441

4542
log "$INPUT_FILE extracted and removed"
4643

@@ -108,21 +105,44 @@ set -e
108105
if [ "$NOTARIZE" = "yes" ]; then
109106
log "Notarizing..."
110107
"$SCRIPT_DIR/notarize.sh" "$PKG_NAME"
108+
111109
log "Stapling..."
112-
xcrun stapler staple "$APPLICATION_PATH" ||:
113-
xcrun stapler staple "$PKG_NAME" ||:
110+
appStaplerOutput=$(xcrun stapler staple "$APPLICATION_PATH")
111+
if [ $? -ne 0 ]; then
112+
log "Stapling application failed"
113+
echo "$appStaplerOutput"
114+
exit 1
115+
else
116+
echo "$appStaplerOutput"
117+
fi
118+
119+
log "Stapling package..."
120+
pkgStaplerOutput=$(xcrun stapler staple "$PKG_NAME")
121+
if [ $? -ne 0 ]; then
122+
log "Stapling package failed"
123+
echo "$pkgStaplerOutput"
124+
exit 1
125+
else
126+
echo "$pkgStaplerOutput"
127+
fi
128+
129+
# Verify stapling
130+
log "Verifying stapling..."
131+
if ! stapler validate "$APPLICATION_PATH"; then
132+
log "Stapling verification failed for application"
133+
exit 1
134+
fi
135+
if ! stapler validate "$PKG_NAME"; then
136+
log "Stapling verification failed for package"
137+
exit 1
138+
fi
114139
else
115140
log "Notarization disabled"
116141
log "Stapling disabled"
117142
fi
118143

119144
log "Zipping $BUILD_NAME to $INPUT_FILE ..."
120145
(
121-
#cd "$EXPLODED"
122-
#ditto -c -k --sequesterRsrc --keepParent "$BUILD_NAME" "../$INPUT_FILE"
123-
if test -d $BACKUP_JMODS/jmods; then
124-
mv $BACKUP_JMODS/jmods $APPLICATION_PATH/Contents/Home
125-
fi
126146
if [[ "$APPLICATION_PATH" != "$EXPLODED/$BUILD_NAME" ]]; then
127147
mv $APPLICATION_PATH $EXPLODED/$BUILD_NAME
128148
else
@@ -133,4 +153,4 @@ log "Zipping $BUILD_NAME to $INPUT_FILE ..."
133153
log "Finished zipping"
134154
)
135155
rm -rf "$EXPLODED"
136-
log "Done"
156+
log "Done"

0 commit comments

Comments
 (0)