Mac pkg: Fix issues that prevent notarization

- Explicitly sign all binaries included in the package.

- Enable the hardened runtime.
This commit is contained in:
DRC
2025-04-02 13:59:17 -04:00
parent adbb328159
commit 2f26b48f10

View File

@@ -114,46 +114,18 @@ install_secondarybuild()
pushd $BUILDDIR pushd $BUILDDIR
DESTDIR=$TMPDIR/dist.secondary @CMAKE_MAKE_PROGRAM@ install DESTDIR=$TMPDIR/dist.secondary @CMAKE_MAKE_PROGRAM@ install
popd popd
$LIPO -create \ for file in $LIBJPEG_DSO_NAME libjpeg.a $TURBOJPEG_DSO_NAME libturbojpeg.a; do
$PKGROOT/$LIBDIR/$LIBJPEG_DSO_NAME \ $LIPO -create \
$TMPDIR/dist.secondary/$LIBDIR/$LIBJPEG_DSO_NAME \ $PKGROOT/$LIBDIR/$file \
-output $PKGROOT/$LIBDIR/$LIBJPEG_DSO_NAME $TMPDIR/dist.secondary/$LIBDIR/$file \
$LIPO -create \ -output $PKGROOT/$LIBDIR/$file
$PKGROOT/$LIBDIR/libjpeg.a \ done
$TMPDIR/dist.secondary/$LIBDIR/libjpeg.a \ for file in cjpeg djpeg jpegtran tjbench rdjpgcom wrjpgcom; do
-output $PKGROOT/$LIBDIR/libjpeg.a $LIPO -create \
$LIPO -create \ $PKGROOT/$BINDIR/$file \
$PKGROOT/$LIBDIR/$TURBOJPEG_DSO_NAME \ $TMPDIR/dist.secondary/$BINDIR/$file \
$TMPDIR/dist.secondary/$LIBDIR/$TURBOJPEG_DSO_NAME \ -output $PKGROOT/$BINDIR/$file
-output $PKGROOT/$LIBDIR/$TURBOJPEG_DSO_NAME done
$LIPO -create \
$PKGROOT/$LIBDIR/libturbojpeg.a \
$TMPDIR/dist.secondary/$LIBDIR/libturbojpeg.a \
-output $PKGROOT/$LIBDIR/libturbojpeg.a
$LIPO -create \
$PKGROOT/$BINDIR/cjpeg \
$TMPDIR/dist.secondary/$BINDIR/cjpeg \
-output $PKGROOT/$BINDIR/cjpeg
$LIPO -create \
$PKGROOT/$BINDIR/djpeg \
$TMPDIR/dist.secondary/$BINDIR/djpeg \
-output $PKGROOT/$BINDIR/djpeg
$LIPO -create \
$PKGROOT/$BINDIR/jpegtran \
$TMPDIR/dist.secondary/$BINDIR/jpegtran \
-output $PKGROOT/$BINDIR/jpegtran
$LIPO -create \
$PKGROOT/$BINDIR/tjbench \
$TMPDIR/dist.secondary/$BINDIR/tjbench \
-output $PKGROOT/$BINDIR/tjbench
$LIPO -create \
$PKGROOT/$BINDIR/rdjpgcom \
$TMPDIR/dist.secondary/$BINDIR/rdjpgcom \
-output $PKGROOT/$BINDIR/rdjpgcom
$LIPO -create \
$PKGROOT/$BINDIR/wrjpgcom \
$TMPDIR/dist.secondary/$BINDIR/wrjpgcom \
-output $PKGROOT/$BINDIR/wrjpgcom
} }
if [ "$BUILDDIRSECONDARY" != "" ]; then if [ "$BUILDDIRSECONDARY" != "" ]; then
@@ -171,6 +143,19 @@ fi
mkdir -p $TMPDIR/pkg mkdir -p $TMPDIR/pkg
if [ "$MACOS_APP_CERT_NAME" != "" ]; then
for file in $LIBJPEG_DSO_NAME $TURBOJPEG_DSO_NAME; do
codesign -s "$MACOS_APP_CERT_NAME" --options=runtime \
--timestamp $PKGROOT/$LIBDIR/$file
codesign --verify --strict -v $PKGROOT/$LIBDIR/$file
done
for file in cjpeg djpeg jpegtran tjbench rdjpgcom wrjpgcom; do
codesign -s "$MACOS_APP_CERT_NAME" --options=runtime \
--timestamp $PKGROOT/$BINDIR/$file
codesign --verify --strict -v $PKGROOT/$BINDIR/$file
done
fi
install -m 755 pkgscripts/uninstall $PKGROOT/$BINDIR/ install -m 755 pkgscripts/uninstall $PKGROOT/$BINDIR/
find $PKGROOT -type f | while read file; do xattr -c $file; done find $PKGROOT -type f | while read file; do xattr -c $file; done