lldb-preview component for OSX does not include debugserver

[vadimcn]

As of 2018-10-05, lldv-preview component for nightly-x86_64-apple-darwin does not include the debugserver binary, which is required for debugging on OSX.

[tromey]

Thanks. In the short term you can work around it by installing xcode; I think the rust lldb will use its debug server automatically. At least it seems to work ok here and AFAIK I didn't do anything special.

I thought perhaps this was handled already but indeed I don't see the debug server in ~/.rustup.

[tromey]

I think we'll need to have a rust organization publisher cert to sign debugserver. I don't know if there is one and there are some other details I don't know yet.

[vadimcn]

I bet @alexcrichton would know who might know about this :)

[alexcrichton]

If this is just a matter of copying over binaries from the build, that's at least easily fixable! For things like signing code, we unfortunately don't have any prior art for that so we'd be starting from scratch to get signing certificates :(

[vadimcn]

This is about signing, unfortunately.

Firstly, we need to obtain the signing cert and key. Surely, Mozilla is already enrolled in the Apple's Enterprise Developer Program, so it should be possible to get a cert through that. I am afraid this is something that only Mozilla employees can do.

Secondly, we need to figure out how to get the binary and the key in the same place at the same time. I don't know whether Mozilla allows private keys to be deployed to build servers, but probably not. In my experience, companies prefer having secure signing servers, to which binaries (or their hashes) are sent for signing.

Setting this up to happen automatically for each build could get pretty complicated... In this case, though, we can use the fact that the rate of change in LLDB's debugserver is very low - the last significant change was over 3 years ago - and its binary interface is very stable, because it has to stay compatible with gdbserver. I think we could get away with signing debugserver once via some manual process, then just keep reusing the same binary for regular builds.

[tromey]

I think we could get away with signing debugserver once via some manual process, then just keep reusing the same binary for regular builds.

Sounds reasonable to me; though we still need to get a rust publisher cert somehow. I'll ask around to see how Moz does this.

[artemmukhin]

I've installed Xcode and tried to run rust-lldb on macOS 10.14.1, but still got error: process launch failed: unable to locate debugserver. Could you please tell me what should I do in this case?

[tromey]

Sorry about the delay on this. I don't know what to do offhand. I will try to dig a little soon, but maybe one thing to try is see if ensuring that debugserver is in $PATH helps.

At the Mozilla all-hands I talked with the person who handles code signing for Firefox. Perhaps we'll be able to sign a debugserver that we build. An alternate plan is to get our own signing keys from Apple and do the signing in the Rust build infrastructure somewhere; I have to do a bit of research to see whether this is possible.