build: osx: Fix incomplete framework packaging for codesigning #4758

pull theuni wants to merge 1 commits into bitcoin:master from theuni:osx-dmg-codesign-rebase changing 1 files +29 −0

theuni commented at 12:43 AM on August 24, 2014: member

Starting with 10.9, Framework versions must be signed individually, rather than as a single bundle version, in order to be properly codesigned. This change ensures that the proper plist files and symlinks are present prior to packaging.

I believe I've tested this on all of my build scenarios, including the future static qt. @gavinandresen Please give this a real-world try (preferably by merging it into -rc1 locally and signing a gitian build there as though it were rc2) before ACKing. It worksforme (tm), but that means very little for Apple's tools.

Also, note that --deep will be needed for codesign until we switch to static libs.

build: osx: Fix incomplete framework packaging for codesigning

Starting with 10.9, Framework versions must be signed individually, rather
than as a single bundle version, in order to be properly codesigned. This
change ensures that the proper plist files and symlinks are present prior to
packaging.

65f3fa8d11

BitcoinPullTester commented at 1:12 AM on August 24, 2014: none

Automatic sanity-testing: PASSED, see http://jenkins.bluematt.me/pull-tester/p4758_65f3fa8d11a9b2e139d4963514fdc1beb04dfb68/ for binaries and test log. This test script verifies pulls every time they are updated. It, however, dies sometimes and fails to test properly. If you are waiting on a test, please check timestamps to verify that the test.log is moving at http://jenkins.bluematt.me/pull-tester/current/ Contact BlueMatt on freenode if something looks broken.
DomT4 commented at 3:36 AM on August 24, 2014: contributor

Perhaps also worth noting that to pass codesigning checks on Yosemite you will need to codesign the releases with a machine running nothing older than 10.9 as well. Any signatures by machines older than 10.9 are being invalidated by 10.10 automatically.
DomT4 commented at 3:43 AM on August 24, 2014: contributor

Relevant sections:

"Signatures created with OS X v10.8.5 or earlier ("v1 signatures") are obsoleted and will no longer be recognized by Gatekeeper. To ensure your apps will run on updated versions of OS X they must be signed using the codesign tool on OS X v10.9 or later ("v2 signatures")."

"App extensions for OS X are always run as 64-bit code. You will need to build your extensions, and any shared frameworks they depend upon, to include 64-bit support"
theuni commented at 4:38 PM on August 24, 2014: member

Yea, that's the ultimate purpose of this change. Signing now works properly on 10.9, so we can keep Gatekeeper happy in the future.
laanwj added the label Build system on Aug 28, 2014
gavinandresen added this to the milestone 0.9.3 on Sep 2, 2014
gavinandresen assigned gavinandresen on Sep 2, 2014
gavinandresen commented at 4:29 PM on September 12, 2014: contributor

tested ACK
gavinandresen referenced this in commit 6a830ec947 on Sep 12, 2014
gavinandresen merged this on Sep 12, 2014
gavinandresen closed this on Sep 12, 2014
gavinandresen commented at 4:30 PM on September 12, 2014: contributor

@wumpus : this should be cherry-picked if there is another 0.9.3 release candidate.
wumpus commented at 5:06 PM on September 12, 2014: none

Wrong @wumpus... not a bitcoin guy.
MarcoFalke locked this on Sep 8, 2021

Contributors

Labels