Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[msbuild] Always codesign the framework directory, not what's inside #10309

Merged
merged 2 commits into from
Jan 11, 2021

Conversation

spouliot
Copy link
Contributor

Example #1. Signing a framework binary is the same thing as
signing the framework directory.

$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame: signed bundle with Mach-O thin (arm64) [io.sourceforge.lame]

$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework: signed bundle with Mach-O thin (arm64) [io.sourceforge.lame]

Nice right ? Pretty much until...

Example #2. Signing a framework binary is NOT the same thing
as signing the framework directory.

$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac: signed Mach-O thin (arm64) [flac-55554944583d2f02282c33d8bfed082daa857e30]

$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework: signed bundle with Mach-O thin (arm64) [org.xiph.flac]

In this case signing the binary flac does not produce the
_CodeSignature directory and fails our msbuild Codesign task

The fix is to detect if we're signing a framework like A.framework/A
and change this to sign A.framework as this will always work.

**Example #1.** Signing a framework binary is the **same** thing as
signing the framework directory.

```
$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame: signed bundle with Mach-O thin (arm64) [io.sourceforge.lame]

$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework: signed bundle with Mach-O thin (arm64) [io.sourceforge.lame]
```

Nice right ? Pretty much until...

**Example #2.** Signing a framework binary is **NOT** the **same** thing
as signing the framework directory.

```
$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac: signed Mach-O thin (arm64) [flac-55554944583d2f02282c33d8bfed082daa857e30]

$ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework: replacing existing signature
bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework: signed bundle with Mach-O thin (arm64) [org.xiph.flac]
```

In this case signing the binary `flac` does not produce the
`_CodeSignature` directory and fails our msbuild Codesign task

The fix is to detect if we're signing a framework like `A.framework/A`
and change this to sign `A.framework` as this will always work.
@spouliot spouliot added the bug If an issue is a bug or a pull request a bug fix label Dec 16, 2020
Copy link
Member

@dalexsoto dalexsoto left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because it all makes sense and it is so straightforward 😂

@vs-mobiletools-engineering-service2
Copy link
Collaborator

❌ Device tests failed on Build ❌

Device tests failed on Build.

Test results

2 tests failed, 39 tests passed.

Failed tests

  • [xUnit] Mono Mac OS X BCL tests group 4/Mac Modern/Debug: Failed (No test log file was produced)
  • MTouch tests/NUnit: Failed (Execution failed with exit code 7)

Pipeline on Agent XAMBOT-1094'

@monojenkins
Copy link
Collaborator

Build failure
Provisioning succeeded
Build succeeded
API Diff (from stable)
🔥 Failed to compare API and create generator diff 🔥
    ** Error: Working directory isn't clean:
    HEAD detached at 9b7fd9f
    Untracked files:
    (use "git add ..." to include in what will be committed)
    tools/dotnet-linker/packages/
    
    nothing added to commit but untracked files present (use "git add" to track)
    Search for Comparing API & creating generator diff in the log to view the complete log.
Test run succeeded

@spouliot spouliot merged commit 0709c88 into xamarin:main Jan 11, 2021
@spouliot spouliot deleted the codesign-framework branch January 11, 2021 21:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug If an issue is a bug or a pull request a bug fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants