Skip to content

Commit d5372eb

Browse files
deepak1556deepak1556
authored
Reland "fix: use electron-osx-sign instead of manual code signing (microsoft#97582)" (microsoft#98145)
This reverts commit f291767.
1 parent 452dc54 commit d5372eb

13 files changed

Lines changed: 247 additions & 41 deletions

build/azure-pipelines/darwin/entitlements.plist renamed to build/azure-pipelines/darwin/app-entitlements.plist

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
<true/>
77
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
88
<true/>
9-
<key>com.apple.security.cs.disable-library-validation</key>
10-
<true/>
119
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
1210
<true/>
1311
</dict>

‎build/azure-pipelines/darwin/helper-entitlements.plist‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎build/azure-pipelines/darwin/helper-gpu-entitlements.plist‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,5 @@
44
<dict>
55
<key>com.apple.security.cs.allow-jit</key>
66
<true/>
7-
<key>com.apple.security.cs.disable-library-validation</key>
8-
<true/>
97
</dict>
108
</plist>

‎build/azure-pipelines/darwin/product-build-darwin.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -162,21 +162,13 @@ steps:
162162

163163
- script: |
164164
set -e
165-
APP_ROOT=$(agent.builddirectory)/VSCode-darwin
166-
APP_NAME="`ls $APP_ROOT | head -n 1`"
167-
HELPER_APP_NAME="`echo $APP_NAME | sed -e 's/^Visual Studio //;s/\.app$//'`"
168-
APP_FRAMEWORK_PATH="$APP_ROOT/$APP_NAME/Contents/Frameworks"
169165
security create-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
170166
security default-keychain -s $(agent.tempdirectory)/buildagent.keychain
171167
security unlock-keychain -p pwd $(agent.tempdirectory)/buildagent.keychain
172168
echo "$(macos-developer-certificate)" | base64 -D > $(agent.tempdirectory)/cert.p12
173169
security import $(agent.tempdirectory)/cert.p12 -k $(agent.tempdirectory)/buildagent.keychain -P "$(macos-developer-certificate-key)" -T /usr/bin/codesign
174170
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd $(agent.tempdirectory)/buildagent.keychain
175-
codesign -s 99FM488X57 --deep --force --options runtime --entitlements build/azure-pipelines/darwin/entitlements.plist "$APP_ROOT"/*.app
176-
codesign -s 99FM488X57 --force --options runtime --entitlements build/azure-pipelines/darwin/helper-entitlements.plist "$APP_FRAMEWORK_PATH/$HELPER_APP_NAME Helper.app"
177-
codesign -s 99FM488X57 --force --options runtime --entitlements build/azure-pipelines/darwin/helper-gpu-entitlements.plist "$APP_FRAMEWORK_PATH/$HELPER_APP_NAME Helper (GPU).app"
178-
codesign -s 99FM488X57 --force --options runtime --entitlements build/azure-pipelines/darwin/helper-plugin-entitlements.plist "$APP_FRAMEWORK_PATH/$HELPER_APP_NAME Helper (Plugin).app"
179-
codesign -s 99FM488X57 --force --options runtime --entitlements build/azure-pipelines/darwin/helper-renderer-entitlements.plist "$APP_FRAMEWORK_PATH/$HELPER_APP_NAME Helper (Renderer).app"
171+
DEBUG=electron-osx-sign* node build/darwin/sign.js
180172
displayName: Set Hardened Entitlements
181173

182174
- script: |

‎build/darwin/sign.js‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*---------------------------------------------------------------------------------------------
2+
* Copyright (c) Microsoft Corporation. All rights reserved.
3+
* Licensed under the MIT License. See License.txt in the project root for license information.
4+
*--------------------------------------------------------------------------------------------*/
5+
'use strict';
6+
Object.defineProperty(exports, "__esModule", { value: true });
7+
const codesign = require("electron-osx-sign");
8+
const path = require("path");
9+
const util = require("../lib/util");
10+
const product = require("../../product.json");
11+
async function main() {
12+
const buildDir = process.env['AGENT_BUILDDIRECTORY'];
13+
const tempDir = process.env['AGENT_TEMPDIRECTORY'];
14+
if (!buildDir) {
15+
throw new Error('$AGENT_BUILDDIRECTORY not set');
16+
}
17+
if (!tempDir) {
18+
throw new Error('$AGENT_TEMPDIRECTORY not set');
19+
}
20+
const baseDir = path.dirname(__dirname);
21+
const appRoot = path.join(buildDir, 'VSCode-darwin');
22+
const appName = product.nameLong + '.app';
23+
const appFrameworkPath = path.join(appRoot, appName, 'Contents', 'Frameworks');
24+
const helperAppBaseName = product.nameShort;
25+
const gpuHelperAppName = helperAppBaseName + ' Helper (GPU).app';
26+
const pluginHelperAppName = helperAppBaseName + ' Helper (Plugin).app';
27+
const rendererHelperAppName = helperAppBaseName + ' Helper (Renderer).app';
28+
const defaultOpts = {
29+
app: path.join(appRoot, appName),
30+
platform: 'darwin',
31+
entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'app-entitlements.plist'),
32+
'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'app-entitlements.plist'),
33+
hardenedRuntime: true,
34+
'pre-auto-entitlements': false,
35+
'pre-embed-provisioning-profile': false,
36+
keychain: path.join(tempDir, 'buildagent.keychain'),
37+
version: util.getElectronVersion(),
38+
identity: '99FM488X57',
39+
'gatekeeper-assess': false
40+
};
41+
const appOpts = Object.assign(Object.assign({}, defaultOpts), {
42+
// TODO(deepak1556): Incorrectly declared type in electron-osx-sign
43+
ignore: (filePath) => {
44+
return filePath.includes(gpuHelperAppName) ||
45+
filePath.includes(pluginHelperAppName) ||
46+
filePath.includes(rendererHelperAppName);
47+
} });
48+
const gpuHelperOpts = Object.assign(Object.assign({}, defaultOpts), { app: path.join(appFrameworkPath, gpuHelperAppName), entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-gpu-entitlements.plist'), 'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-gpu-entitlements.plist') });
49+
const pluginHelperOpts = Object.assign(Object.assign({}, defaultOpts), { app: path.join(appFrameworkPath, pluginHelperAppName), entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-plugin-entitlements.plist'), 'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-plugin-entitlements.plist') });
50+
const rendererHelperOpts = Object.assign(Object.assign({}, defaultOpts), { app: path.join(appFrameworkPath, rendererHelperAppName), entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-renderer-entitlements.plist'), 'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-renderer-entitlements.plist') });
51+
await codesign.signAsync(gpuHelperOpts);
52+
await codesign.signAsync(pluginHelperOpts);
53+
await codesign.signAsync(rendererHelperOpts);
54+
await codesign.signAsync(appOpts);
55+
}
56+
if (require.main === module) {
57+
main().catch(err => {
58+
console.error(err);
59+
process.exit(1);
60+
});
61+
}

‎build/darwin/sign.ts‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
/*---------------------------------------------------------------------------------------------
2+
* Copyright (c) Microsoft Corporation. All rights reserved.
3+
* Licensed under the MIT License. See License.txt in the project root for license information.
4+
*--------------------------------------------------------------------------------------------*/
5+
6+
'use strict';
7+
8+
import * as codesign from 'electron-osx-sign';
9+
import * as path from 'path';
10+
import * as util from '../lib/util';
11+
import * as product from '../../product.json';
12+
13+
async function main(): Promise<void> {
14+
const buildDir = process.env['AGENT_BUILDDIRECTORY'];
15+
const tempDir = process.env['AGENT_TEMPDIRECTORY'];
16+
17+
if (!buildDir) {
18+
throw new Error('$AGENT_BUILDDIRECTORY not set');
19+
}
20+
21+
if (!tempDir) {
22+
throw new Error('$AGENT_TEMPDIRECTORY not set');
23+
}
24+
25+
const baseDir = path.dirname(__dirname);
26+
const appRoot = path.join(buildDir, 'VSCode-darwin');
27+
const appName = product.nameLong + '.app';
28+
const appFrameworkPath = path.join(appRoot, appName, 'Contents', 'Frameworks');
29+
const helperAppBaseName = product.nameShort;
30+
const gpuHelperAppName = helperAppBaseName + ' Helper (GPU).app';
31+
const pluginHelperAppName = helperAppBaseName + ' Helper (Plugin).app';
32+
const rendererHelperAppName = helperAppBaseName + ' Helper (Renderer).app';
33+
34+
const defaultOpts: codesign.SignOptions = {
35+
app: path.join(appRoot, appName),
36+
platform: 'darwin',
37+
entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'app-entitlements.plist'),
38+
'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'app-entitlements.plist'),
39+
hardenedRuntime: true,
40+
'pre-auto-entitlements': false,
41+
'pre-embed-provisioning-profile': false,
42+
keychain: path.join(tempDir, 'buildagent.keychain'),
43+
version: util.getElectronVersion(),
44+
identity: '99FM488X57',
45+
'gatekeeper-assess': false
46+
};
47+
48+
const appOpts = {
49+
...defaultOpts,
50+
// TODO(deepak1556): Incorrectly declared type in electron-osx-sign
51+
ignore: (filePath: string) => {
52+
return filePath.includes(gpuHelperAppName) ||
53+
filePath.includes(pluginHelperAppName) ||
54+
filePath.includes(rendererHelperAppName);
55+
}
56+
};
57+
58+
const gpuHelperOpts: codesign.SignOptions = {
59+
...defaultOpts,
60+
app: path.join(appFrameworkPath, gpuHelperAppName),
61+
entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-gpu-entitlements.plist'),
62+
'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-gpu-entitlements.plist'),
63+
};
64+
65+
const pluginHelperOpts: codesign.SignOptions = {
66+
...defaultOpts,
67+
app: path.join(appFrameworkPath, pluginHelperAppName),
68+
entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-plugin-entitlements.plist'),
69+
'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-plugin-entitlements.plist'),
70+
};
71+
72+
const rendererHelperOpts: codesign.SignOptions = {
73+
...defaultOpts,
74+
app: path.join(appFrameworkPath, rendererHelperAppName),
75+
entitlements: path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-renderer-entitlements.plist'),
76+
'entitlements-inherit': path.join(baseDir, 'azure-pipelines', 'darwin', 'helper-renderer-entitlements.plist'),
77+
};
78+
79+
await codesign.signAsync(gpuHelperOpts);
80+
await codesign.signAsync(pluginHelperOpts);
81+
await codesign.signAsync(rendererHelperOpts);
82+
await codesign.signAsync(appOpts as any);
83+
}
84+
85+
if (require.main === module) {
86+
main().catch(err => {
87+
console.error(err);
88+
process.exit(1);
89+
});
90+
}

‎build/gulpfile.hygiene.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ const indentationFilter = [
8585
'!src/typings/**/*.d.ts',
8686
'!extensions/**/*.d.ts',
8787
'!**/*.{svg,exe,png,bmp,scpt,bat,cmd,cur,ttf,woff,eot,md,ps1,template,yaml,yml,d.ts.recipe,ico,icns,plist}',
88-
'!build/{lib,download}/**/*.js',
88+
'!build/{lib,download,darwin}/**/*.js',
8989
'!build/**/*.sh',
9090
'!build/azure-pipelines/**/*.js',
9191
'!build/azure-pipelines/**/*.config',

‎build/lib/electron.js‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*--------------------------------------------------------------------------------------------*/
55
'use strict';
66
Object.defineProperty(exports, "__esModule", { value: true });
7-
exports.config = exports.getElectronVersion = void 0;
7+
exports.config = void 0;
88
const fs = require("fs");
99
const path = require("path");
1010
const vfs = require("vinyl-fs");
@@ -16,12 +16,6 @@ const electron = require('gulp-atom-electron');
1616
const root = path.dirname(path.dirname(__dirname));
1717
const product = JSON.parse(fs.readFileSync(path.join(root, 'product.json'), 'utf8'));
1818
const commit = util.getVersion(root);
19-
function getElectronVersion() {
20-
const yarnrc = fs.readFileSync(path.join(root, '.yarnrc'), 'utf8');
21-
const target = /^target "(.*)"$/m.exec(yarnrc)[1];
22-
return target;
23-
}
24-
exports.getElectronVersion = getElectronVersion;
2519
const darwinCreditsTemplate = product.darwinCredits && _.template(fs.readFileSync(path.join(root, product.darwinCredits), 'utf8'));
2620
function darwinBundleDocumentType(extensions, icon) {
2721
return {
@@ -33,7 +27,7 @@ function darwinBundleDocumentType(extensions, icon) {
3327
};
3428
}
3529
exports.config = {
36-
version: getElectronVersion(),
30+
version: util.getElectronVersion(),
3731
productAppName: product.nameLong,
3832
companyName: 'Microsoft Corporation',
3933
copyright: 'Copyright (C) 2019 Microsoft. All rights reserved',
@@ -100,7 +94,7 @@ function getElectron(arch) {
10094
};
10195
}
10296
async function main(arch = process.arch) {
103-
const version = getElectronVersion();
97+
const version = util.getElectronVersion();
10498
const electronPath = path.join(root, '.build', 'electron');
10599
const versionFile = path.join(electronPath, 'version');
106100
const isUpToDate = fs.existsSync(versionFile) && fs.readFileSync(versionFile, 'utf8') === `${version}`;

‎build/lib/electron.ts‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,6 @@ const root = path.dirname(path.dirname(__dirname));
1919
const product = JSON.parse(fs.readFileSync(path.join(root, 'product.json'), 'utf8'));
2020
const commit = util.getVersion(root);
2121

22-
export function getElectronVersion(): string {
23-
const yarnrc = fs.readFileSync(path.join(root, '.yarnrc'), 'utf8');
24-
const target = /^target "(.*)"$/m.exec(yarnrc)![1];
25-
return target;
26-
}
27-
2822
const darwinCreditsTemplate = product.darwinCredits && _.template(fs.readFileSync(path.join(root, product.darwinCredits), 'utf8'));
2923

3024
function darwinBundleDocumentType(extensions: string[], icon: string) {
@@ -38,7 +32,7 @@ function darwinBundleDocumentType(extensions: string[], icon: string) {
3832
}
3933

4034
export const config = {
41-
version: getElectronVersion(),
35+
version: util.getElectronVersion(),
4236
productAppName: product.nameLong,
4337
companyName: 'Microsoft Corporation',
4438
copyright: 'Copyright (C) 2019 Microsoft. All rights reserved',
@@ -108,7 +102,7 @@ function getElectron(arch: string): () => NodeJS.ReadWriteStream {
108102
}
109103

110104
async function main(arch = process.arch): Promise<void> {
111-
const version = getElectronVersion();
105+
const version = util.getElectronVersion();
112106
const electronPath = path.join(root, '.build', 'electron');
113107
const versionFile = path.join(electronPath, 'version');
114108
const isUpToDate = fs.existsSync(versionFile) && fs.readFileSync(versionFile, 'utf8') === `${version}`;

‎build/lib/util.js‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*--------------------------------------------------------------------------------------------*/
55
'use strict';
66
Object.defineProperty(exports, "__esModule", { value: true });
7-
exports.streamToPromise = exports.versionStringToNumber = exports.filter = exports.rebase = exports.getVersion = exports.ensureDir = exports.rreddir = exports.rimraf = exports.stripSourceMappingURL = exports.loadSourcemaps = exports.cleanNodeModules = exports.skipDirectories = exports.toFileUri = exports.setExecutableBit = exports.fixWin32DirectoryPermissions = exports.incremental = void 0;
7+
exports.getElectronVersion = exports.streamToPromise = exports.versionStringToNumber = exports.filter = exports.rebase = exports.getVersion = exports.ensureDir = exports.rreddir = exports.rimraf = exports.stripSourceMappingURL = exports.loadSourcemaps = exports.cleanNodeModules = exports.skipDirectories = exports.toFileUri = exports.setExecutableBit = exports.fixWin32DirectoryPermissions = exports.incremental = void 0;
88
const es = require("event-stream");
99
const debounce = require("debounce");
1010
const _filter = require("gulp-filter");
@@ -14,6 +14,7 @@ const fs = require("fs");
1414
const _rimraf = require("rimraf");
1515
const git = require("./git");
1616
const VinylFile = require("vinyl");
17+
const root = path.dirname(path.dirname(__dirname));
1718
const NoCancellationToken = { isCancellationRequested: () => false };
1819
function incremental(streamProvider, initial, supportsCancellation) {
1920
const input = es.through();
@@ -255,3 +256,9 @@ function streamToPromise(stream) {
255256
});
256257
}
257258
exports.streamToPromise = streamToPromise;
259+
function getElectronVersion() {
260+
const yarnrc = fs.readFileSync(path.join(root, '.yarnrc'), 'utf8');
261+
const target = /^target "(.*)"$/m.exec(yarnrc)[1];
262+
return target;
263+
}
264+
exports.getElectronVersion = getElectronVersion;

0 commit comments

Comments
 (0)