Skip to content

Harden macOS signing and sign modules #762

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
metsma wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Harden macOS signing and sign modules #762

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,20 @@ find_package(SWIG)
if(SWIG_FOUND)
find_package(Java COMPONENTS Development)
find_package(JNI)
if(APPLE AND NOT Python3_ROOT_DIR)
foreach(_py3_candidate
/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/Current
/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/Current
)
if(EXISTS ${_py3_candidate}/Headers/Python.h)
set(Python3_ROOT_DIR ${_py3_candidate})
set(Python3_FIND_FRAMEWORK FIRST)
set(Python3_FIND_STRATEGY LOCATION)
break()
endif()
endforeach()
unset(_py3_candidate)
endif()
find_package(Python3 COMPONENTS Development)
if((WIN32 OR APPLE) AND CMAKE_VERSION VERSION_GREATER_EQUAL "3.24")
find_package(Python3 COMPONENTS Development.SABIModule)
Expand Down
8 changes: 8 additions & 0 deletions etc/digidoc-tool.entitlements
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
</dict>
</plist>
29 changes: 25 additions & 4 deletions src/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,11 @@ if(SWIG_FOUND)
include(${SWIG_USE_FILE})
include_directories(${CMAKE_CURRENT_SOURCE_DIR})
set_property(SOURCE ../libdigidocpp.i PROPERTY CPLUSPLUS ON)
if(APPLE)
set(SWIG_MODULE_BUILD_WITH_INSTALL_RPATH TRUE)
else()
set(SWIG_MODULE_BUILD_WITH_INSTALL_RPATH FALSE)
endif()
if(JAVA_INCLUDE_PATH)
set(CMAKE_SWIG_FLAGS -package ee.ria.libdigidocpp)
set(CMAKE_SWIG_OUTDIR ${CMAKE_CURRENT_BINARY_DIR}/java)
Expand All @@ -191,6 +196,7 @@ if(SWIG_FOUND)
target_link_libraries(digidoc_java digidocpp digidocpp_util)
set_target_properties(digidoc_java PROPERTIES
INSTALL_RPATH $<$<PLATFORM_ID:Darwin>:/Library/Frameworks>
BUILD_WITH_INSTALL_RPATH ${SWIG_MODULE_BUILD_WITH_INSTALL_RPATH}
SWIG_COMPILE_DEFINITIONS $<$<PLATFORM_ID:Windows>:SWIGWIN>
)
install(TARGETS digidoc_java DESTINATION $<IF:$<PLATFORM_ID:Darwin>,/Library/Java/Extensions,${CMAKE_INSTALL_LIBDIR}>)
Expand Down Expand Up @@ -240,6 +246,7 @@ if(SWIG_FOUND)
endif()
set_target_properties(digidoc_python PROPERTIES
INSTALL_RPATH $<$<PLATFORM_ID:Darwin>:/Library/Frameworks>
BUILD_WITH_INSTALL_RPATH ${SWIG_MODULE_BUILD_WITH_INSTALL_RPATH}
SWIG_COMPILE_DEFINITIONS $<$<PLATFORM_ID:Windows>:SWIGWIN>
)
install(TARGETS digidoc_python DESTINATION ${Python3_SITELIB})
Expand All @@ -253,6 +260,7 @@ if(SWIG_FOUND)
set_target_properties(digidoc_csharp PROPERTIES
SWIG_COMPILE_DEFINITIONS $<$<PLATFORM_ID:Windows>:SWIGWIN>
INSTALL_RPATH $<$<PLATFORM_ID:Darwin>:/Library/Frameworks>
BUILD_WITH_INSTALL_RPATH ${SWIG_MODULE_BUILD_WITH_INSTALL_RPATH}
PREFIX "${CMAKE_SHARED_LIBRARY_PREFIX}"
)
install(TARGETS digidoc_csharp DESTINATION ${CMAKE_INSTALL_LIBDIR})
Expand Down Expand Up @@ -334,7 +342,7 @@ if( FRAMEWORK )
file(GET_RUNTIME_DEPENDENCIES LIBRARIES \$ENV{LIBRARY} RESOLVED_DEPENDENCIES_VAR OUT)
file(COPY \${OUT} DESTINATION \$ENV{BUNDLE_DIR})
")
add_custom_target( embedlibs DEPENDS digidocpp $<TARGET_NAME_IF_EXISTS:digidoc-tool>
add_custom_target(embedlibs DEPENDS digidocpp
COMMAND mkdir -p $<TARGET_FILE_DIR:digidocpp>/Libraries
COMMAND ln -s -f Versions/Current/Libraries $<TARGET_BUNDLE_DIR:digidocpp>
COMMAND ${CMAKE_COMMAND} -E env
Expand Down Expand Up @@ -379,12 +387,25 @@ if( FRAMEWORK )
COMMAND /usr/libexec/PlistBuddy -c "Add :MinimumOSVersion string ${CMAKE_OSX_DEPLOYMENT_TARGET}" $<TARGET_FILE_DIR:digidocpp>/Info.plist)
endif()
if(SIGNCERT)
if(TARGET digidoc-tool)
add_custom_command(TARGET embedlibs POST_BUILD
COMMAND codesign -f -s "Developer ID Application: ${SIGNCERT}" --options runtime --timestamp
--entitlements ${PROJECT_SOURCE_DIR}/etc/digidoc-tool.entitlements
$<TARGET_FILE_DIR:digidocpp>/Resources/digidoc-tool
)
endif()
add_custom_command(TARGET embedlibs POST_BUILD
COMMAND codesign -f -s "Developer ID Application: ${SIGNCERT}"
COMMAND codesign -f -s "Developer ID Application: ${SIGNCERT}" --options runtime --timestamp
$<TARGET_FILE_DIR:digidocpp>/Libraries/*
$<$<TARGET_EXISTS:digidoc-tool>:$<TARGET_FILE_DIR:digidocpp>/Resources/digidoc-tool>
$<$<TARGET_EXISTS:digidoc_java>:$<TARGET_FILE:digidoc_java>>
$<$<TARGET_EXISTS:digidoc_python>:$<TARGET_FILE:digidoc_python>>
$<$<TARGET_EXISTS:digidoc_csharp>:$<TARGET_FILE:digidoc_csharp>>
$<TARGET_BUNDLE_DIR:digidocpp>
COMMAND touch $<TARGET_FILE:digidocpp> $<$<TARGET_EXISTS:digidoc-tool>:$<TARGET_FILE:digidoc-tool>>
COMMAND touch $<TARGET_FILE:digidocpp>
$<$<TARGET_EXISTS:digidoc-tool>:$<TARGET_FILE:digidoc-tool>>
$<$<TARGET_EXISTS:digidoc_java>:$<TARGET_FILE:digidoc_java>>
$<$<TARGET_EXISTS:digidoc_python>:$<TARGET_FILE:digidoc_python>>
$<$<TARGET_EXISTS:digidoc_csharp>:$<TARGET_FILE:digidoc_csharp>>
)
endif()
add_custom_target(pkgbuild DEPENDS digidocpp $<TARGET_NAME_IF_EXISTS:digidoc-tool>
Expand Down
Loading