This is an automated email from the ASF dual-hosted git repository. leginee pushed a commit to branch mac-vcl-button-contrast in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit a5f4d92cc2831ac556385c597a71d4091e11e205 Author: peter kovacs <[email protected]> AuthorDate: Thu Sep 10 05:09:15 2026 +0200 installer: sign the .dmg as well, completing the signing chain The build signed each .app before sealing it into the image but left the image itself unsigned, so the last step still had to be done by hand. Sign it in create_package once the image is finished. Placement matters: this runs after the systemcall that builds the image rather than as part of it, because the Rez step in that same call rewrites the image to attach the license resource. Signing before that would produce an image that carries a signature and fails verification. Ad-hoc identities are skipped deliberately. MACOSX_CODESIGNING_IDENTITY=- is a documented mode, an ad-hoc signed .dmg is pointless since Gatekeeper rejects it either way, and mac-silicon-sign.sh refuses it outright - without the guard this change would turn every ad-hoc build into a hard error. A signing failure aborts the build, matching how the .app signing already behaves, so an unsigned image cannot be shipped by accident. Verified: the .dmg reports "valid on disk" and satisfies its designated requirement, and the .app inside still passes --verify --deep --strict. Notarization (notarytool, stapler) remains outstanding and needs a Developer ID identity. Co-Authored-By: Claude Opus 5 <[email protected]> --- .agent/mac-silicon-port.md | 9 +++++++-- main/solenv/bin/modules/installer/simplepackage.pm | 19 +++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/.agent/mac-silicon-port.md b/.agent/mac-silicon-port.md index d8fa0ccb2e..16382d19b6 100644 --- a/.agent/mac-silicon-port.md +++ b/.agent/mac-silicon-port.md @@ -437,8 +437,13 @@ with `Could not create parent directory` (dmake error 255), leaving a stray `xattr -dr com.apple.quarantine /Applications/OpenOffice.app` — but it is not fit for public release. That needs **Developer ID Application**, which only ASF's Account Holder can issue from the team's Apple Developer Program membership. -- Then `xcrun notarytool submit --wait` the `.dmg`, `xcrun stapler staple`, and sign the - `.dmg` itself (`mac-silicon-sign.sh -i <ID> foo.dmg`). +- The `.dmg` itself is now signed by the build too, in `simplepackage.pm` right after + the image is finalised -- it has to be after the `Rez` step, which rewrites the image + to attach the license resource and would invalidate an earlier signature. Skipped for + an ad-hoc identity, which `mac-silicon-sign.sh` refuses for a `.dmg` anyway. So the + whole chain (Mach-O objects, nested bundles, the `.app`, the `.dmg`) is one build. +- Still missing for a public release: `xcrun notarytool submit --wait` followed by + `xcrun stapler staple`. Both need a Developer ID identity to be worth wiring up. - Installing a *shared* extension writes into `share/uno_packages` inside the bundle and breaks the seal. That is inherent to signing an app that modifies itself, not to this layout change. diff --git a/main/solenv/bin/modules/installer/simplepackage.pm b/main/solenv/bin/modules/installer/simplepackage.pm index d77cefab59..1b61a1e4f3 100644 --- a/main/solenv/bin/modules/installer/simplepackage.pm +++ b/main/solenv/bin/modules/installer/simplepackage.pm @@ -601,6 +601,25 @@ sub create_package { $infoline = "Success: Executed \"$systemcall\" successfully!\n"; $installer::logger::Lang->print($infoline); + # Sign the finished disk image. This completes the chain: the .app + # inside was signed before the image was built, and the image itself + # is signed here. It has to happen at this point rather than earlier - + # the Rez step above rewrites the image to attach the license + # resource, and that would invalidate a signature applied before it. + # + # Skipped for an ad-hoc identity: an ad-hoc signed .dmg buys nothing + # (Gatekeeper rejects it either way) and mac-silicon-sign.sh refuses + # it outright, which would turn a working ad-hoc build into an error. + if (( $archive =~ /dmg$/ ) && + ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} ) && + ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} ne "-" )) + { + my $signscript = $ENV{'SRC_ROOT'} . "/mac-silicon-sign.sh"; + my $signcall = "$signscript -i \"$ENV{'MACOSX_CODESIGNING_IDENTITY'}\" \"$archive\""; + my $signreturn = system($signcall); + if ( $signreturn ) { installer::exiter::exit_program("ERROR: Could not code-sign $archive!", "create_package"); } + $installer::logger::Lang->print("Success: Code-signed $archive\n"); + } } }
