-
Notifications
You must be signed in to change notification settings - Fork 517
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[msbuild] Always codesign the framework directory, not what's inside #10309
Conversation
**Example #1.** Signing a framework binary is the **same** thing as signing the framework directory. ``` $ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame: replacing existing signature bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework/lame: signed bundle with Mach-O thin (arm64) [io.sourceforge.lame] $ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework: replacing existing signature bin/iPhone/Release/xcf_ios.app//Frameworks/lame.framework: signed bundle with Mach-O thin (arm64) [io.sourceforge.lame] ``` Nice right ? Pretty much until... **Example #2.** Signing a framework binary is **NOT** the **same** thing as signing the framework directory. ``` $ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac: replacing existing signature bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework/flac: signed Mach-O thin (arm64) [flac-55554944583d2f02282c33d8bfed082daa857e30] $ codesign -v --force --timestamp=none --sign - bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework: replacing existing signature bin/iPhone/Release/xcf_ios.app//Frameworks/flac.framework: signed bundle with Mach-O thin (arm64) [org.xiph.flac] ``` In this case signing the binary `flac` does not produce the `_CodeSignature` directory and fails our msbuild Codesign task The fix is to detect if we're signing a framework like `A.framework/A` and change this to sign `A.framework` as this will always work.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because it all makes sense and it is so straightforward 😂
❌ Device tests failed on Build ❌Device tests failed on Build. Test results2 tests failed, 39 tests passed.Failed tests
Pipeline on Agent XAMBOT-1094' |
Build failure |
Example #1. Signing a framework binary is the same thing as
signing the framework directory.
Nice right ? Pretty much until...
Example #2. Signing a framework binary is NOT the same thing
as signing the framework directory.
In this case signing the binary
flac
does not produce the_CodeSignature
directory and fails our msbuild Codesign taskThe fix is to detect if we're signing a framework like
A.framework/A
and change this to sign
A.framework
as this will always work.