MantisBT - CMake

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0015507

CMake

public

2015-04-08 18:28

2016-06-10 14:21

Reporter

Eric Wing

Assigned To

Brad King

Priority

normal

Severity

minor

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS X

OS Version

10.10

Product Version

CMake 3.0

Target Version

CMake 3.6

Fixed in Version

CMake 3.6

Summary

0015507: CMake.App bundle is malformed which prevents code signing it

Description

CMake should be code signable so somebody can potentially sign it for Mac deployment. When it is not code signed, Apple's GateKeeper will block it by default. (I'm actually distributing it internally, and wanted to code sign it with my own key just to avoid headaches.)

CMake.app's internals have a few flaws which prevent code signing. The majority are not in CMake itself, but in the embedded Qt frameworks.

Steps To Reproduce

This will fail with errors.
codesign --force --verbose --sign "Developer ID" --deep CMake.app

Additional Information

I tested with CMake 3.0, but not the latest, but I suspect the issue still exists in the latest.

The flaws are as follows:
- QtCore and QtGui must have an Info.plist in Versions/4/Resources directory
- There should be a Current symlink to the 4 directory
- QtGui puts the Resources directory in the wrong place
- In my copy of CMake, there are two executables in Contents/MacOS instead of just one, which confuses the code signing. The second is an executable with a version number in the name. That shouldn't exist. (But you can manually code sign both to make the overall code sign work.)

Below is my script that basically works around the problems. Ideally, the underlying flaws would be fixed instead of worked around.

#!/bin/zsh

# gets the script path
# script_path=${0:a}
# gets the directory in which the script resides
SCRIPT_DIR=${0:a:h}

CODE_SIGN_IDENTITY="Developer ID"

if [ -z $1 ]; then
    echo "Usage: codesign_cmake /path/CMake.app"
    exit 1
fi

CMAKE_DIR=$1

# Hack to fix mangled frameworks:
mkdir "$CMAKE_DIR"/Contents/Frameworks/QtCore.framework/Versions/4/Resources
mkdir "$CMAKE_DIR"/Contents/Frameworks/QtGui.framework/Versions/4/Resources
cp "$SCRIPT_DIR/QtCore.Info.plist" "$CMAKE_DIR"/Contents/Frameworks/QtCore.framework/Versions/4/Resources/Info.plist
cp "$SCRIPT_DIR/QtGui.Info.plist" "$CMAKE_DIR"/Contents/Frameworks/QtGui.framework/Versions/4/Resources/Info.plist
(cd "$CMAKE_DIR"/Contents/Frameworks/QtCore.framework/Versions
    ln -s 4 Current
)
(cd "$CMAKE_DIR"/Contents/Frameworks/QtGui.framework/Versions
    ln -s 4 Current
)
(cd "$CMAKE_DIR"/Contents/Frameworks/QtGui.framework
    mv Resources/* Versions/4/Resources/
    rmdir Resources
    ln -s Versions/Current/Resources Resources
)

codesign --force --verbose --sign "$CODE_SIGN_IDENTITY" "$CMAKE_DIR"/Contents/Frameworks/QtCore.framework/Versions/4/QtCore
codesign --force --verbose --sign "$CODE_SIGN_IDENTITY" "$CMAKE_DIR"/Contents/Frameworks/QtGui.framework/Versions/4/QtGui
find "$CMAKE_DIR"/Contents/bin -type f -exec codesign --force --verbose --sign "$CODE_SIGN_IDENTITY" {} \;
find "$CMAKE_DIR"/Contents/MacOS -type f -exec codesign --force --verbose --sign "$CODE_SIGN_IDENTITY" {} \;

codesign --force --verbose --sign "$CODE_SIGN_IDENTITY" "$CMAKE_DIR"