Changeset 83036 in vbox

Timestamp:

Feb 10, 2020 3:57:32 PM (5 years ago)

Author:

vboxsync

Message:

/Config.kmk: Darwin code signing fix for the CCS case (handling the entitlements option), using hardened runtime for Mach-O binaries (should be ignored for kexts). Plus a little cleanup in the darwin installer packaging, avoiding local signing of pkg files which should be handled by CCS. bugref:9466

Location:

trunk

Files:

• Config.kmk (modified) (2 diffs)
• src/VBox/Installer/darwin/Makefile.kmk (modified) (6 diffs)

trunk/Config.kmk

@@ -3706 +3706 @@
   # @param 3  Additional codesign command line parameters, optional.
   if $(intersects darwin all 1,$(VBOX_WITH_CORP_CODE_SIGNING))
-   ## @todo cannot handle $(2), the identifier. $(3) is hopefully either empty or --deep
+   ## @todo cannot handle $(2), the identifier.
+   ## @todo $(3) is hopefully either empty, --deep or --entitlements=...
    VBOX_SIGN_BUNDLE_FN = $(call MSG_TOOL,SIGNTOOL,,$(1),$(2))$(NLTAB) \
         ditto -c -k --keepParent "$(1)" "$(1).zip"$(NLTAB) \
-        $(call VBOX_CCS_SIGN_CMD,apple,$(1).zip,,$(if $(eq $(3),--deep),-deep,))$(NLTAB) \
+        $(call VBOX_CCS_SIGN_CMD,apple,$(1).zip,,$(subst --entitlements=,-entitlement_file_path ,$(subst --deep,-deep,$(3))) \
+                $(if $(VBOX_WITH_MACOS_HARDENED_RUNTIME),-hardened_runtime))$(NLTAB) \
         ditto -x -k "$(1).zip" "$(1)/../"$(NLTAB) \
         $(RM) -f -- "$(1).zip"
@@ -3731 +3733 @@
   if $(intersects darwin all 1,$(VBOX_WITH_CORP_CODE_SIGNING))
    ## @todo cannot handle $(2), the identifier.
-   ## @todo must handle $(3) if entitlement.
-   VBOX_SIGN_MACHO_FN = $(call MSG_TOOL,SIGNTOOL,,$(1),$(2))$(NLTAB)$(call VBOX_CCS_SIGN_CMD,binary,$(1))
+   ## @todo $(3) is hopefully either empty or --entitlements=...
+   VBOX_SIGN_MACHO_FN = $(call MSG_TOOL,SIGNTOOL,,$(1),$(2))$(NLTAB) \
+        $(call VBOX_CCS_SIGN_CMD,binary,$(1),,$(subst --entitlements=,-entitlement_file_path ,$(3)) \
+                $(if $(VBOX_WITH_MACOS_HARDENED_RUNTIME),-hardened_runtime))
   else
    VBOX_SIGN_MACHO_FN = $(call MSG_TOOL,SIGNTOOL,,$(1),$(2))$(NLTAB)$(VBOX_CODESIGN) \

trunk/src/VBox/Installer/darwin/Makefile.kmk

@@ -238 +238 @@
                 --identifier org.VirtualBox.mpkg.virtualbox \
                 --version $(VBOX_VERSION_MAJOR).$(VBOX_VERSION_MINOR).$(VBOX_VERSION_BUILD) \
-                $(if $(VBOX_MACOSX_INSTALLER_SIGN),--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
+                $(if-expr defined(VBOX_MACOSX_INSTALLER_SIGN) && $(intersects darwin all 1,$(VBOX_WITH_CORP_CODE_SIGNING)) == "",--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
                 $@
 ifdef VBOX_SIGNING_MODE
@@ -298 +298 @@
         $(foreach kext,$(VBOX_DI_KEXTS), \
                 $(NLTAB)$(INSTALL) -m 0755 $(VBOX_PATH_DIST)/$(kext).kext/Contents/MacOS/$(kext) $(VBOX_PATH_PACK_TMP)/VBoxKEXTs.pkg.root/$(kext).kext/Contents/MacOS/)
-        @# Signed the kext bundles.
+        @# Sign the kext bundles.
 ifdef VBOX_SIGNING_MODE
         $(foreach kext,$(VBOX_DI_KEXTS) \
@@ -330 +330 @@
                 --install-location "/Library/Application Support/VirtualBox" \
                 --ownership preserve \
-                $(if $(VBOX_MACOSX_INSTALLER_SIGN),--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
+                $(if-expr defined(VBOX_MACOSX_INSTALLER_SIGN) && $(intersects darwin all 1,$(VBOX_WITH_CORP_CODE_SIGNING)) == "",--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
                 $@
 ifdef VBOX_SIGNING_MODE
@@ -700 +700 @@
                         $(VBOX_PATH_VBOX_APP_TMP)/Contents/MacOS/dtrace/$(file)$(NLTAB))
 endif
-        @# Signed the binaries and the application bundle.
+        @# Sign the binaries and the application bundle.
 ifdef VBOX_SIGNING_MODE
         $(foreach qtmod, $(VBOX_QT_MOD_NAMES) \
@@ -788 +788 @@
                 --ownership preserve \
                 --preserve-xattr \
-                $(if $(VBOX_MACOSX_INSTALLER_SIGN),--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
+                $(if-expr defined(VBOX_MACOSX_INSTALLER_SIGN) && $(intersects darwin all 1,$(VBOX_WITH_CORP_CODE_SIGNING)) == "",--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
                 $@
 ifdef VBOX_SIGNING_MODE
@@ -875 +875 @@
                 --install-location /usr/local/bin \
                 --ownership preserve \
-                $(if $(VBOX_MACOSX_INSTALLER_SIGN),--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
+                $(if-expr defined(VBOX_MACOSX_INSTALLER_SIGN) && $(intersects darwin all 1,$(VBOX_WITH_CORP_CODE_SIGNING)) == "",--sign "$(VBOX_MACOSX_INSTALLER_SIGN)",) \
                 $@
 ifdef VBOX_SIGNING_MODE