This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/openoffice.git
The following commit(s) were added to refs/heads/trunk by this push:
new f3385db031 macOS: code-signable bundle layout, opt-in signing of the
.app and .dmg Select patches from the mac-vcl-button-contrast branch.
f3385db031 is described below
commit f3385db031069db3e0655c6a4d85518bf39a7b68
Author: Jim Jagielski <[email protected]>
AuthorDate: Thu Sep 10 11:18:37 2026 -0400
macOS: code-signable bundle layout, opt-in signing of the .app and .dmg
Select patches from the mac-vcl-button-contrast branch.
codesign rejects a bundle with anything but Mach-O binaries in
Contents/MacOS,
where scp2 installed everything; the installation now lives in
Contents/program.
Signing only runs with --with-macosx-codesigning-identity (or the env var)
set.
---
main/configure.ac | 30 ++++
main/cppuhelper/source/findsofficepath.c | 21 ++-
main/desktop/util/makefile.mk | 6 +
main/icu/icu-darwin.patch | 2 +-
main/icu/icu4c-4_2_1-src.patch | 2 +-
main/libxml2/makefile.mk | 5 +-
main/odk/setsdkenv_unix.sh.in | 4 +-
main/sal/rtl/source/bootstrap.cxx | 22 +++
main/scp2/source/ooo/common_brand.scp | 44 +++---
main/scp2/source/ooo/directory_ooo.scp | 10 ++
main/scp2/source/ooo/file_library_ooo.scp | 16 +-
main/scp2/source/ooo/ooo_brand.scp | 7 +-
main/scp2/source/python/file_python.scp | 175 +--------------------
main/scp2/source/python/profileitem_python.scp | 11 --
main/set_soenv.in | 10 ++
main/solenv/bin/macosx-change-install-names.pl | 14 +-
main/solenv/bin/macosx-codesign-entitlements.plist | 21 +++
main/solenv/bin/macosx-codesign.sh | 168 ++++++++++++++++++++
main/solenv/bin/modules/installer/scriptitems.pm | 18 ++-
main/solenv/bin/modules/installer/simplepackage.pm | 47 +++++-
main/solenv/inc/unxmacc.mk | 1 +
main/solenv/inc/unxmacx.mk | 1 +
22 files changed, 408 insertions(+), 227 deletions(-)
diff --git a/main/configure.ac b/main/configure.ac
index 954c09a69e..cc214ad613 100644
--- a/main/configure.ac
+++ b/main/configure.ac
@@ -982,6 +982,21 @@ AC_ARG_WITH(macosx-sdk,
Usage: --with-macosx-sdk=10.11
(or full path:
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk)
],with_macosx_sdk=$withval,)
+AC_ARG_WITH(macosx-codesigning-identity,
+[ --with-macosx-codesigning-identity
+ Code-sign the macOS application bundle and disk image
+ while packaging, with this codesign identity
+ ("-" for ad-hoc). Unset: package unsigned, as before.
+
+ Usage:
--with-macosx-codesigning-identity="Developer ID Application: ..."
+],with_macosx_codesigning_identity=$withval,)
+AC_ARG_WITH(macosx-codesigning-keychain,
+[ --with-macosx-codesigning-keychain
+ Keychain holding that identity (default: the
+ keychain search list, i.e. normally the login
keychain).
+
+ Usage:
--with-macosx-codesigning-keychain=/path/to/build.keychain-db
+],with_macosx_codesigning_keychain=$withval,)
AC_ARG_WITH(rat-scan,
[ --with-rat-scan Scan source code for license headers.
Use as --with-rat-scan to automatically download
pre-built Rat binaries.
@@ -4562,9 +4577,24 @@ if test "$_os" = "Darwin"; then
fi
fi
+dnl Code signing during packaging:
solenv/bin/modules/installer/simplepackage.pm
+dnl reads these from the environment (via set_soenv), so a bare "yes" is an
error.
+MACOSX_CODESIGNING_IDENTITY=
+MACOSX_CODESIGNING_KEYCHAIN=
+if test "$with_macosx_codesigning_identity" = "yes"; then
+ AC_MSG_ERROR([--with-macosx-codesigning-identity needs a codesign identity,
or "-" for ad-hoc])
+fi
+if test -n "$with_macosx_codesigning_identity" -a
"$with_macosx_codesigning_identity" != "no"; then
+ MACOSX_CODESIGNING_IDENTITY=$with_macosx_codesigning_identity
+fi
+if test -n "$with_macosx_codesigning_keychain" -a
"$with_macosx_codesigning_keychain" != "no" -a
"$with_macosx_codesigning_keychain" != "yes"; then
+ MACOSX_CODESIGNING_KEYCHAIN=$with_macosx_codesigning_keychain
+fi
AC_SUBST(MACOSX_DEPLOYMENT_TARGET)
AC_SUBST(MACOSX_SDK_PATH)
AC_SUBST(SDKROOT)
+AC_SUBST(MACOSX_CODESIGNING_IDENTITY)
+AC_SUBST(MACOSX_CODESIGNING_KEYCHAIN)
dnl ===================================================================
diff --git a/main/cppuhelper/source/findsofficepath.c
b/main/cppuhelper/source/findsofficepath.c
index eccb7bdeba..93e410adc0 100644
--- a/main/cppuhelper/source/findsofficepath.c
+++ b/main/cppuhelper/source/findsofficepath.c
@@ -135,13 +135,26 @@ static char* platformSpecific()
/* On MacOS we have no soffice link under /usr/bin but the default office
location is known
and we check this only
*/
- const char* MACDEFAULTOFFICEPATH =
"/Applications/OpenOffice.app/Contents/MacOS";
- const char* MACDEFAULTSOFFICE =
"/Applications/OpenOffice.app/Contents/MacOS/soffice";
+ /* The installation lives in Contents/program (Contents/MacOS holds only
the
+ launcher, so that the bundle can be code-signed); soffice is reachable
+ there through a symlink. Before 4.2 everything was in Contents/MacOS, so
+ fall back to that for an older office -- it has to be tried second, as
+ the launcher is in Contents/MacOS in both layouts. */
+ const char* MACDEFAULTOFFICEPATH =
"/Applications/OpenOffice.app/Contents/program";
+ const char* MACDEFAULTSOFFICE =
"/Applications/OpenOffice.app/Contents/program/soffice";
+ const char* MACLEGACYOFFICEPATH =
"/Applications/OpenOffice.app/Contents/MacOS";
+ const char* MACLEGACYSOFFICE =
"/Applications/OpenOffice.app/Contents/MacOS/soffice";
+ const char* found = NULL;
if ( !access( MACDEFAULTSOFFICE, F_OK ) )
+ found = MACDEFAULTOFFICEPATH;
+ else if ( !access( MACLEGACYSOFFICE, F_OK ) )
+ found = MACLEGACYOFFICEPATH;
+
+ if ( found )
{
- path = (char*) malloc( strlen(MACDEFAULTOFFICEPATH) + 1 );
- strcpy( path, MACDEFAULTOFFICEPATH);
+ path = (char*) malloc( strlen(found) + 1 );
+ strcpy( path, found );
}
return path;
#else
diff --git a/main/desktop/util/makefile.mk b/main/desktop/util/makefile.mk
index 3163142cc9..f19ecad786 100644
--- a/main/desktop/util/makefile.mk
+++ b/main/desktop/util/makefile.mk
@@ -101,6 +101,12 @@ APP1STACK=10000000
APP5TARGET=soffice
APP5NOSAL=TRUE
APP5RPATH=BRAND
+.IF "$(OS)" == "MACOSX"
+# soffice is the bundle launcher and lives alone in Contents/MacOS (only
+# Mach-O binaries may, or the bundle cannot be code-signed); the libraries it
+# links against are installed in Contents/program.
+APP5RPATH=BRANDBIN
+.ENDIF # MACOSX
APP5OBJS=$(OBJ)$/copyright_ascii_ooo.obj $(OBJ)$/main.obj
APP5STDLIBS = $(SALLIB) $(SOFFICELIB)
.IF "$(OS)" == "LINUX"
diff --git a/main/icu/icu-darwin.patch b/main/icu/icu-darwin.patch
index 8ee7976878..4f9df08f3d 100644
--- a/main/icu/icu-darwin.patch
+++ b/main/icu/icu-darwin.patch
@@ -8,7 +8,7 @@ diff -ru misc/icu/source/data/pkgdataMakefile.in
misc/build/icu/source/data/pkgd
+# LD_SONAME must end with a path, but on Darwin this does not happen, because
+# file source/config/mh-darwin makes it end with FINAL_SO_TARGET, instead of
+# MIDDLE_SO_TARGET like other Unixes.
-+LD_SONAME = -Wl,-compatibility_version -Wl,$(SO_TARGET_VERSION_MAJOR)
-Wl,-current_version -Wl,$(SO_TARGET_VERSION) -install_name @executable_path/
++LD_SONAME = -Wl,-compatibility_version -Wl,$(SO_TARGET_VERSION_MAJOR)
-Wl,-current_version -Wl,$(SO_TARGET_VERSION) -install_name @loader_path/
all : clean
@echo GENCCODE_ASSEMBLY_TYPE=$(GENCCODE_ASSEMBLY) >> $(OUTPUTFILE)
diff --git a/main/icu/icu4c-4_2_1-src.patch b/main/icu/icu4c-4_2_1-src.patch
index 572572a3ea..2649f18999 100644
--- a/main/icu/icu4c-4_2_1-src.patch
+++ b/main/icu/icu4c-4_2_1-src.patch
@@ -56,7 +56,7 @@ diff -ru misc/icu/source/config/mh-darwin
misc/build/icu/source/config/mh-darwin
## Compiler switches to embed a library name and version information
-LD_SONAME = -Wl,-compatibility_version -Wl,$(SO_TARGET_VERSION_MAJOR)
-Wl,-current_version -Wl,$(SO_TARGET_VERSION) -install_name $(notdir
$(MIDDLE_SO_TARGET))
-+LD_SONAME = -Wl,-compatibility_version -Wl,$(SO_TARGET_VERSION_MAJOR)
-Wl,-current_version -Wl,$(SO_TARGET_VERSION) -install_name
@executable_path/$(notdir $(FINAL_SO_TARGET))
++LD_SONAME = -Wl,-compatibility_version -Wl,$(SO_TARGET_VERSION_MAJOR)
-Wl,-current_version -Wl,$(SO_TARGET_VERSION) -install_name
@loader_path/$(notdir $(FINAL_SO_TARGET))
## Compiler switch to embed a runtime search path
LD_RPATH=
diff --git a/main/libxml2/makefile.mk b/main/libxml2/makefile.mk
index 8f5a105406..3716ac0fbf 100644
--- a/main/libxml2/makefile.mk
+++ b/main/libxml2/makefile.mk
@@ -118,7 +118,10 @@ OUTDIR2INC=include$/libxml
.IF "$(OS)"=="MACOSX"
EXTRPATH=URELIB
OUT2LIB+=.libs$/libxml2.a
-OUT2BIN+=.libs$/xmllint
+# With --enable-shared=no (see CONFIGURE_FLAGS above), libtool links xmllint
+# directly against the static lib -- no .libs/ wrapper copy -- so the binary
+# lands at the build root. (Cf. libxslt/makefile.mk's xsltproc handling.)
+OUT2BIN+=xmllint
OUT2BIN+=xml2-config
.ELIF "$(OS)"=="WNT"
.IF "$(COM)"=="GCC"
diff --git a/main/odk/setsdkenv_unix.sh.in b/main/odk/setsdkenv_unix.sh.in
index f9ac1c3a0b..8d818fc4a3 100644
--- a/main/odk/setsdkenv_unix.sh.in
+++ b/main/odk/setsdkenv_unix.sh.in
@@ -101,7 +101,9 @@ programdir=program
javadir=bin
case ${sdk_platform} in
darwin*)
- programdir="Contents/MacOS"
+ # The installation lives in Contents/program; Contents/MacOS holds only the
+ # soffice launcher, so that the bundle can be code-signed.
+ programdir="Contents/program"
javacdir=Commands
;;
esac
diff --git a/main/sal/rtl/source/bootstrap.cxx
b/main/sal/rtl/source/bootstrap.cxx
index 35a3a9f8c1..2ca20daa1d 100644
--- a/main/sal/rtl/source/bootstrap.cxx
+++ b/main/sal/rtl/source/bootstrap.cxx
@@ -271,6 +271,28 @@ static OUString & getIniFileName_Impl()
// append config file suffix
fileName +=
OUString(RTL_CONSTASCII_USTRINGPARAM(SAL_CONFIGFILE("")));
+
+#ifdef MACOSX
+ // In an application bundle only Mach-O binaries may
live in
+ // Contents/MacOS -- code signing rejects the bundle
otherwise --
+ // so the installation itself (rc files, rdbs, the
libraries) sits
+ // in Contents/program, exactly as on the other UNX
platforms.
+ // Look the ini file up there; $ORIGIN is derived from
it below,
+ // which anchors the whole bootstrap chain in the
program dir.
+ OUString macOSDir
(RTL_CONSTASCII_USTRINGPARAM("/Contents/MacOS/"));
+ sal_Int32 nMacOSDir = fileName.lastIndexOf(macOSDir);
+ if (nMacOSDir >= 0)
+ {
+ OUString programName =
+ fileName.replaceAt(nMacOSDir,
macOSDir.getLength(),
+
OUString(RTL_CONSTASCII_USTRINGPARAM("/Contents/program/")));
+ // Fall back to the old location for anything
that is not laid
+ // out this way (a plain bundle, an mdimporter,
...).
+ ::osl::DirectoryItem item;
+ if (::osl::DirectoryItem::get(programName,
item) == ::osl::DirectoryItem::E_None)
+ fileName = programName;
+ }
+#endif
}
static OUString theFileName;
diff --git a/main/scp2/source/ooo/common_brand.scp
b/main/scp2/source/ooo/common_brand.scp
index 42769143ed..ff45b6060a 100644
--- a/main/scp2/source/ooo/common_brand.scp
+++ b/main/scp2/source/ooo/common_brand.scp
@@ -84,7 +84,7 @@ Module gid_Module_Root_Brand
gid_Brand_File_Share_Xdg_StartCenter,
gid_Brand_File_Share_Xdg_Writer,
gid_Brand_File_Txt_Package);
- Unixlinks = (gid_Brand_Unixlink_Program,
+ Unixlinks = (gid_Brand_Unixlink_Soffice,
gid_Brand_Unixlink_Unopkg);
// Unixlinks = (gid_Brand_Unixlink_BasisLink,
// gid_Brand_Unixlink_Program,
@@ -122,11 +122,10 @@ End
Directory gid_Brand_Dir_Program
#if defined MACOSX
ParentID = gid_Dir_Bundle_Contents;
- DosName = "MacOS";
#else
ParentID = gid_Dir_Brand_Root;
- DosName = "program";
#endif
+ DosName = "program";
End
Directory gid_Brand_Dir_Resource
@@ -269,29 +268,21 @@ End
// UnixLinks
-#if defined MACOSX
-Unixlink gid_Brand_Unixlink_Urelibs
- Dir = gid_Brand_Dir_Program;
- Name = "urelibs";
- Target = "../basis-link/ure-link/lib";
-End
-#endif
-
-#if defined MACOSX
-Unixlink gid_Brand_Unixlink_Program
- BIN_FILE_BODY;
- Dir = gid_Dir_Bundle_Contents;
- Name = "program";
- Target = "MacOS";
- Styles = ();
-End
-#endif
+// gid_Brand_Unixlink_Urelibs (urelibs -> ../basis-link/ure-link/lib) and
+// gid_Brand_Unixlink_Program (Contents/program -> MacOS) are gone: the first
+// has pointed at nothing since the basis/ure split was dropped, and
+// Contents/program is now the real installation directory.
// Files
File gid_Brand_File_Bin_Soffice
BIN_FILE_BODY;
+#if defined MACOSX
+ // the bundle's CFBundleExecutable, and the only thing in Contents/MacOS
+ Dir = gid_Dir_Bundle_Contents_MacOS;
+#else
Dir = gid_Brand_Dir_Program;
+#endif
Name = EXENAME(soffice);
#ifdef WNT
Styles = (PACKED, PATCH_SO_NAME);
@@ -411,6 +402,19 @@ Unixlink gid_Brand_Unixlink_Unopkg
End
#endif
+// The launcher itself has to sit in Contents/MacOS, but everything that looks
+// for the office binary next to the installation -- cppuhelper's
+// findsofficepath(), scripts, the SDK -- expects it in the program directory.
+#if defined MACOSX
+Unixlink gid_Brand_Unixlink_Soffice
+ BIN_FILE_BODY;
+ Dir = gid_Brand_Dir_Program;
+ Name = "soffice";
+ Target = "../MacOS/soffice";
+ Styles = ();
+End
+#endif
+
#ifndef OS2
File gid_Brand_File_Bin_Unopkg
BIN_FILE_BODY;
diff --git a/main/scp2/source/ooo/directory_ooo.scp
b/main/scp2/source/ooo/directory_ooo.scp
index b69c6a2079..52fa8869bd 100644
--- a/main/scp2/source/ooo/directory_ooo.scp
+++ b/main/scp2/source/ooo/directory_ooo.scp
@@ -37,6 +37,16 @@ Directory gid_Dir_Bundle_Contents_Resources_Lang
End
#endif
+// Only Mach-O binaries may live here: code signing refuses to seal a bundle
+// with anything else in Contents/MacOS. The installation itself goes to
+// Contents/program, so this holds just the soffice launcher.
+#ifdef MACOSX
+Directory gid_Dir_Bundle_Contents_MacOS
+ ParentID = gid_Dir_Bundle_Contents;
+ HostName = "MacOS";
+End
+#endif
+
#ifdef MACOSX
Directory gid_Dir_Bundle_Contents_Library
ParentID = gid_Dir_Bundle_Contents;
diff --git a/main/scp2/source/ooo/file_library_ooo.scp
b/main/scp2/source/ooo/file_library_ooo.scp
index bae968b757..345048aa2f 100644
--- a/main/scp2/source/ooo/file_library_ooo.scp
+++ b/main/scp2/source/ooo/file_library_ooo.scp
@@ -1593,16 +1593,16 @@ STD_JAR_FILE( gid_File_Jar_Xsltvalidate, XSLTValidate )
#endif
#ifndef SYSTEM_LIBXSLT
+// On macOS the bundled libxslt is built static (--enable-shared=no, like
+// main/libxml2) and linked into its consumers, so there is no shared
+// libxslt to package -- mirror libxml2, which has no scp2 File entry.
+#ifndef MACOSX
File gid_File_Lib_Xslt
TXT_FILE_BODY;
Styles = (PACKED);
Dir = SCP2_OOO_BIN_DIR;
#ifdef UNX
- #ifdef MACOSX
- Name = STRING(CONCAT4(libxslt,.,LIBXSLT_MAJOR,UNXSUFFIX));
- #else
Name = STRING(CONCAT4(libxslt,UNXSUFFIX,.,LIBXSLT_MAJOR));
- #endif
#else
#ifdef _gcc3
Name = "libxslt-1.dll";
@@ -1612,6 +1612,7 @@ File gid_File_Lib_Xslt
#endif
End
#endif
+#endif
STD_LIB_FILE( gid_File_Lib_Unoxml, unoxml )
@@ -1791,6 +1792,10 @@ File gid_File_Lib_Openssl
Name = "libssl-3.dll";
#elif defined(WNT) && defined(X86_64)
Name = "libssl-3-x64.dll";
+ #elif defined(MACOSX)
+ /* macOS versions dylibs as libNAME.V.dylib, not SCP2_URE_DL_VER's
+ libNAME.dylib.V; match what main/openssl delivers. */
+ Name = "libssl.3.dylib";
#else
Name = SCP2_URE_DL_VER("ssl", "3");
#endif
@@ -1806,6 +1811,9 @@ File gid_File_Lib_Crypto
Name = "libcrypto-3.dll";
#elif defined(WNT) && defined(X86_64)
Name = "libcrypto-3-x64.dll";
+ #elif defined(MACOSX)
+ /* see gid_File_Lib_Openssl above */
+ Name = "libcrypto.3.dylib";
#else
Name = SCP2_URE_DL_VER("crypto", "3");
#endif
diff --git a/main/scp2/source/ooo/ooo_brand.scp
b/main/scp2/source/ooo/ooo_brand.scp
index fc617ad70a..d521fbd6d8 100644
--- a/main/scp2/source/ooo/ooo_brand.scp
+++ b/main/scp2/source/ooo/ooo_brand.scp
@@ -37,11 +37,10 @@ End
File gid_File_Txt_Notice
TXT_FILE_BODY;
-#ifndef MACOSX
+ // next to LICENSE in the program directory on every platform; on Mac OS X
+ // it used to go into the bundle's Contents, which cannot be signed with a
+ // stray file in it
Dir = gid_Brand_Dir_Program;
-#else
- Dir = gid_Dir_Bundle_Contents;
-#endif
Name = "NOTICE";
Styles = (PACKED);
End
diff --git a/main/scp2/source/python/file_python.scp
b/main/scp2/source/python/file_python.scp
index 95f64c09db..7116bb0b2e 100644
--- a/main/scp2/source/python/file_python.scp
+++ b/main/scp2/source/python/file_python.scp
@@ -112,27 +112,24 @@ File gid_File_Py_Python_Core
Dir = gid_Dir_Common_Ure;
#endif
// Dir = gid_Dir_Program;
- #ifdef MACOSX
- Name = "OOoPython.framework.zip";
- Styles = (ARCHIVE,USE_INTERNAL_RIGHTS);
- #else
Name = STRING(CONCAT3(python-core-,PYVERSION,.zip));
Styles = (ARCHIVE);
- #endif
End
#ifdef UNX
-#ifndef MACOSX
File gid_File_Py_Python_Bin
BIN_FILE_BODY;
+#if defined MACOSX
+ Dir = gid_Brand_Dir_Program;
+#else
Dir = gid_Dir_Common_Ure;
+#endif
// Dir = gid_Dir_Program;
Name = "python.bin";
Styles = (PACKED);
End
#endif
#endif
-#endif
// Scripting Framework Python script proxy
@@ -167,177 +164,17 @@ File gid_File_Share_Registry_Pyuno_Xcd
End
#ifndef SYSTEM_PYTHON
-#ifndef MACOSX
File gid_File_Lib_Python_So
TXT_FILE_BODY;
- Dir = gid_Dir_Common_Ure;
-// Dir = gid_Dir_Program;
- Name = STRING(PY_FULL_DLL_NAME);
- Styles = (PACKED);
-End
-#else //MACOSX
-//directory entries solely to be able to create the symlinks
-Directory gid_Dir_PythonFramework
#if defined MACOSX
Dir = gid_Brand_Dir_Program;
#else
Dir = gid_Dir_Common_Ure;
#endif
-// ParentID = gid_Dir_Program;
- HostName = "OOoPython.framework";
-End
-
-Unixlink gid_Unixlink_Python_Headers
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework;
- Name = "Headers";
- Target = "Versions/Current/Headers";
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_Resources
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework;
- Name = "Resources";
- Target = "Versions/Current/Resources";
- Styles = ();
-End
-
-Directory gid_Dir_PythonFramework_Versions
- ParentID = gid_Dir_PythonFramework;
- HostName = "Versions";
-End
-
-Unixlink gid_Unixlink_Python_Versions_Current
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions;
- Name = "Current";
- Target = STRING(PYMAJMIN);
- Styles = ();
-End
-
-Directory gid_Dir_PythonFramework_Versions_ver
- ParentID = gid_Dir_PythonFramework_Versions;
- HostName = STRING(PYMAJMIN);
-End
-
-Unixlink gid_Unixlink_Python_Versions_ver_Headers
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver;
- Name = "Headers";
- Target = STRING(CONCAT2(include/python,PYMAJMIN));
- Styles = ();
-End
-
-Directory gid_Dir_PythonFramework_Versions_ver_bin
- ParentID = gid_Dir_PythonFramework_Versions_ver;
- HostName = "bin";
-End
-
-Directory gid_Dir_PythonFramework_Versions_ver_lib
- ParentID = gid_Dir_PythonFramework_Versions_ver;
- HostName = "lib";
-End
-
-Directory gid_Dir_PythonFramework_Versions_ver_lib_pythonver
- ParentID = gid_Dir_PythonFramework_Versions_ver_lib;
- HostName = STRING(CONCAT2(python,PYMAJMIN));
-End
-
-Directory gid_Dir_PythonFramework_Versions_ver_lib_pythonver_config
- ParentID = gid_Dir_PythonFramework_Versions_ver_lib_pythonver;
- HostName = "config";
-End
-
-Unixlink gid_Unixlink_Python_OOoPython
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework;
- Name = "OOoPython";
- Target = "Versions/Current/OOoPython";
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_idle
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "idle";
- Target = STRING(CONCAT2(idle,PYMAJMIN));
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_pydoc
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "pydoc";
- Target = STRING(CONCAT2(pydoc,PYMAJMIN));
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_python_real
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "python";
- Target = "../Resources/Python.app/Contents/MacOS/OOoPython";
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_python
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "python";
- Target = STRING(CONCAT2(python,PYMAJMIN));
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_pythonconfig
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "python-config";
- Target = STRING(CONCAT3(python,PYMAJMIN,-config));
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_pythonw_real
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "pythonw";
- Target = "../Resources/Python.app/Contents/MacOS/OOoPython";
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_pythonw
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "pythonw";
- Target = STRING(CONCAT2(pythonw,PYMAJMIN));
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_bin_smtpdpy
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_bin;
- Name = "smtpd.py";
- Target = STRING(CONCAT3(smtpd,PYMAJMIN,.py));
- Styles = ();
-End
-
-Unixlink gid_Unixlink_Python_libpython
- BIN_FILE_BODY;
- Dir = gid_Dir_PythonFramework_Versions_ver_lib_pythonver_config;
+// Dir = gid_Dir_Program;
Name = STRING(PY_FULL_DLL_NAME);
- Target = "../../../OOoPython";
- Styles = ();
+ Styles = (PACKED);
End
-#endif //MACOSX
-
-//#ifdef WNT
-//File gid_File_Lib_Python_So_Brand // Fix for system-python-problem on windows
-// TXT_FILE_BODY;
-// Dir = gid_Brand_Dir_Program;
-// Name = STRING(PY_FULL_DLL_NAME);
-// Styles = (PACKED);
-//End
-//#endif
#endif
#ifdef UNX
diff --git a/main/scp2/source/python/profileitem_python.scp
b/main/scp2/source/python/profileitem_python.scp
index 4ae2f5b177..00c02d91bd 100644
--- a/main/scp2/source/python/profileitem_python.scp
+++ b/main/scp2/source/python/profileitem_python.scp
@@ -47,11 +47,7 @@ ProfileItem gid_Profileitem_Pythonloader_Pythonhome
Section = "Bootstrap";
Order = 1;
Key = "PYUNO_LOADER_PYTHONHOME";
- #ifdef MACOSX
- Value = CONCAT2($ORIGIN,"OOoPython.framework");
- #else
Value = CONCAT2($ORIGIN/python-core-,PYVERSION);
- #endif
End
#endif
@@ -65,17 +61,10 @@ ProfileItem gid_Profileitem_Pythonloader_Pythonpath
Value = "$ORIGIN";
#else
#ifdef UNX
- #ifdef MACOSX
- #define FRAMEWORKLIB
CONCAT4($ORIGIN/OOoPython.framework/Versions/,PYMAJMIN,/lib/python,PYMAJMIN)
- Value = CONCAT3(FRAMEWORKLIB FRAMEWORKLIB,
- /lib-dynload FRAMEWORKLIB,
- /site-packages $ORIGIN);
- #else
Value = CONCAT7($ORIGIN/python-core-,PYVERSION,
/lib $ORIGIN/python-core-,PYVERSION,
/lib/lib-dynload $ORIGIN/python-core-,PYVERSION,
/lib/site-packages $ORIGIN);
- #endif
#else
#ifdef _gcc3
Value = STRING(CONCAT7($ORIGIN/python-core-,PYVERSION,
diff --git a/main/set_soenv.in b/main/set_soenv.in
index b684ec6b96..9e24f77a51 100644
--- a/main/set_soenv.in
+++ b/main/set_soenv.in
@@ -1859,6 +1859,16 @@ if ( $platform =~ m/darwin/ )
ToFile( "MACOSX_DEPLOYMENT_TARGET", "@MACOSX_DEPLOYMENT_TARGET@",
"e" );
ToFile( "MACOSX_SDK_PATH", "@MACOSX_SDK_PATH@", "e" );
ToFile( "SDKROOT", "@SDKROOT@", "e" );
+# Optional code signing while packaging (simplepackage.pm). Only written when
+# configure was given a value, so an identity exported by hand is not
clobbered.
+ if ( "@MACOSX_CODESIGNING_IDENTITY@" ne "" )
+ {
+ ToFile( "MACOSX_CODESIGNING_IDENTITY",
"@MACOSX_CODESIGNING_IDENTITY@", "e" );
+ }
+ if ( "@MACOSX_CODESIGNING_KEYCHAIN@" ne "" )
+ {
+ ToFile( "MACOSX_CODESIGNING_KEYCHAIN",
"@MACOSX_CODESIGNING_KEYCHAIN@", "e" );
+ }
ToFile( "LIBINTL_PREFIX", "@LIBINTL_PREFIX@", "e" );
}
if ( $platform =~ m/freebsd/ )
diff --git a/main/solenv/bin/macosx-change-install-names.pl
b/main/solenv/bin/macosx-change-install-names.pl
index ba4a60a91c..eaaea58373 100644
--- a/main/solenv/bin/macosx-change-install-names.pl
+++ b/main/solenv/bin/macosx-change-install-names.pl
@@ -33,6 +33,10 @@ sub action($$$)
'app/SDK/URELIB' => '@executable_path',
'app/BRAND/URELIB' => '@executable_path',
'app/BRAND/OOO' => '@executable_path',
+ # BRANDBIN: the executable is the bundle launcher in Contents/MacOS,
+ # while the libraries are installed in Contents/program.
+ 'app/BRANDBIN/URELIB' => '@executable_path/../program',
+ 'app/BRANDBIN/OOO' => '@executable_path/../program',
'app/NONE/URELIB' => '@__VIA_LIBRARY_PATH__',
'app/NONE/OOO' => '@__VIA_LIBRARY_PATH__',
'app/NONE/NONE' => '@__VIA_LIBRARY_PATH__',
@@ -40,8 +44,12 @@ sub action($$$)
'shl/OOO/URELIB' => '@loader_path',
'shl/OOO/OOO' => '@loader_path',
'shl/LOADER/LOADER' => '@loader_path',
- 'shl/OXT/URELIB' => '@executable_path',
- 'shl/BOXT/URELIB' => '@executable_path',
+ # Extension libraries can live inside the installation or in an
+ # extension directory, so they cannot use @loader_path; the office
+ # libraries are always in Contents/program, one level up from the
+ # launcher in Contents/MacOS and from the helper binaries themselves.
+ 'shl/OXT/URELIB' => '@executable_path/../program',
+ 'shl/BOXT/URELIB' => '@executable_path/../program',
'shl/BOXT/OOO' => '@loader_path',
'shl/NONE/URELIB' => '@__VIA_LIBRARY_PATH__',
'shl/NONE/OOO' => '@__VIA_LIBRARY_PATH__',
@@ -74,7 +82,7 @@ sub action($$$)
}
@ARGV == 3 || @ARGV >= 2 && $ARGV[0] eq "extshl" or die
- 'Usage: app|shl|extshl UREBIN|URELIB|OOO|SDK|BRAND|OXT|BOXT|NONE|LOADER
<filepath>*';
+ 'Usage: app|shl|extshl
UREBIN|URELIB|OOO|SDK|BRAND|BRANDBIN|OXT|BOXT|NONE|LOADER <filepath>*';
$type = shift @ARGV;
$loc = shift @ARGV;
if ($type eq "SharedLibrary")
diff --git a/main/solenv/bin/macosx-codesign-entitlements.plist
b/main/solenv/bin/macosx-codesign-entitlements.plist
new file mode 100644
index 0000000000..ca5913f7e6
--- /dev/null
+++ b/main/solenv/bin/macosx-codesign-entitlements.plist
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd";>
+<plist version="1.0">
+<dict>
+ <!-- The bundled JVM/Java bridge and Basic runtime generate and run
code at runtime. -->
+ <key>com.apple.security.cs.allow-jit</key>
+ <true/>
+ <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+ <true/>
+ <!-- soffice dlopens an external JDK's libjvm.dylib, user-installed UNO
extensions
+ and Python modules; none of those carry our Team ID. -->
+ <key>com.apple.security.cs.disable-library-validation</key>
+ <true/>
+ <!-- sofficerc / the launcher set DYLD_* to find the bundled URE
libraries. -->
+ <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+ <true/>
+ <!-- Mail merge, "Send Document as E-Mail" and the installer script
drive other apps. -->
+ <key>com.apple.security.automation.apple-events</key>
+ <true/>
+</dict>
+</plist>
diff --git a/main/solenv/bin/macosx-codesign.sh
b/main/solenv/bin/macosx-codesign.sh
new file mode 100755
index 0000000000..57d7762944
--- /dev/null
+++ b/main/solenv/bin/macosx-codesign.sh
@@ -0,0 +1,168 @@
+#!/bin/bash
+#
+# Code-sign a built Apache OpenOffice .app (or .dmg) on macOS.
+#
+# ./solenv/bin/macosx-codesign.sh [options] <OpenOffice.app|installer.dmg>
...
+#
+# Options:
+# -i, --identity ID codesign identity; "-" = ad-hoc (default, or
+# $MACOSX_CODESIGNING_IDENTITY when set)
+# -e, --entitlements entitlements plist (default:
macosx-codesign-entitlements.plist)
+# -k, --keychain PATH keychain holding the identity (default: the search
list)
+# --hardened force hardened runtime even for an ad-hoc signature
+# (implied by a real identity)
+# --verify only report the current signing state, change nothing
+#
+# The linker already ad-hoc-signs each Mach-O it produces, which is why the
+# binaries load at all on arm64. What it does not do is seal the *bundles*:
+# without a _CodeSignature/CodeResources the .app has no identity, Gatekeeper
+# rejects it once it carries a quarantine flag, and it can never be notarized.
+#
+# This signs inside-out -- every Mach-O, then the nested bundles, then the app.
+# It relies on the installation being laid out so that Contents/MacOS holds
+# only the soffice launcher (see scp2/source/ooo/common_brand.scp); codesign
+# refuses to seal a bundle with anything else in there.
+
+set -euo pipefail
+
+SRCDIR=$(cd "$(dirname "$0")" && pwd)
+IDENTITY="${MACOSX_CODESIGNING_IDENTITY:--}"
+ENTITLEMENTS="$SRCDIR/macosx-codesign-entitlements.plist"
+KEYCHAIN="${MACOSX_CODESIGNING_KEYCHAIN:-}"
+HARDENED=no
+VERIFY_ONLY=no
+TARGETS=()
+
+while [ $# -gt 0 ]; do
+ case "$1" in
+ -i|--identity) IDENTITY="$2"; shift 2 ;;
+ -e|--entitlements) ENTITLEMENTS="$2"; shift 2 ;;
+ -k|--keychain) KEYCHAIN="$2"; shift 2 ;;
+ --hardened) HARDENED=yes; shift ;;
+ --verify) VERIFY_ONLY=yes; shift ;;
+ -h|--help) sed -n '2,25p' "$0"; exit 0 ;;
+ -*) echo "unknown option: $1" >&2; exit 2 ;;
+ *) TARGETS+=("$1"); shift ;;
+ esac
+done
+
+[ ${#TARGETS[@]} -gt 0 ] || { echo "usage: $(basename "$0") [options]
<app-or-dmg> ..." >&2; exit 2; }
+[ "$IDENTITY" = "-" ] || HARDENED=yes
+
+sign_one() {
+ local path="$1"; shift
+ local args=(--force --sign "$IDENTITY" --timestamp=none)
+ if [ "$IDENTITY" != "-" ]; then
+ args=(--force --sign "$IDENTITY" --timestamp)
+ fi
+ if [ "$HARDENED" = yes ]; then
+ args+=(--options runtime --entitlements "$ENTITLEMENTS")
+ fi
+ if [ -n "$KEYCHAIN" ]; then
+ args+=(--keychain "$KEYCHAIN")
+ fi
+ codesign "${args[@]}" "$@" "$path"
+}
+
+report() {
+ local app="$1"
+ echo "--- $app"
+ codesign -dv --verbose=2 "$app" 2>&1 | grep -E
'Identifier|Format|CodeDirectory|Authority|TeamIdentifier|Sealed' || true
+ if codesign --verify --deep --strict "$app" 2>/dev/null; then
+ echo "verify: OK"
+ else
+ echo "verify: FAILED"
+ codesign --verify --deep --strict --verbose=2 "$app" 2>&1 |
tail -5
+ fi
+ spctl --assess --type exec --verbose=4 "$app" 2>&1 | tail -2 || true
+}
+
+# codesign rewrites every Mach-O it signs and writes _CodeSignature/ into
+# every bundle it seals; the installer stages files read-only. Open just those
+# for writing rather than the whole tree, so the staged UnixRights survive.
+open_for_signing() {
+ local b="$1" d
+ for d in "$b" "$b/Contents" "$b"/Versions/*/; do
+ if [ -d "$d" ]; then chmod u+w "$d"; fi
+ done
+ find "$b" -maxdepth 3 -name _CodeSignature -exec chmod -R u+w {} +
2>/dev/null || true
+}
+
+sign_app() {
+ local app="$1"
+ echo "==> signing $app (identity: $IDENTITY, hardened: $HARDENED)"
+
+ # Quarantine and other xattrs make codesign fail or produce an unstable
seal.
+ xattr -cr "$app" 2>/dev/null || true
+
+ # A bundle's main executable is signed as part of its bundle, not on
its own:
+ # codesign silently redirects such a path to the enclosing bundle.
+ local bundles=() main_execs=() b exe
+ while IFS= read -r b; do bundles+=("$b"); done < <(find "$app" \
+ \( -name '*.app' -o -name '*.framework' -o -name '*.bundle' \
+ -o -name '*.mdimporter' -o -name '*.plugin' -o -name
'*.qlgenerator' \) \
+ | awk '{ print gsub(/\//,"/") "\t" $0 }' | sort -rn | cut -f2-)
+ for b in ${bundles[@]+"${bundles[@]}"}; do
+ exe=$(/usr/libexec/PlistBuddy -c 'Print CFBundleExecutable'
"$b/Contents/Info.plist" 2>/dev/null) || continue
+ main_execs+=("$b/Contents/MacOS/$exe")
+ done
+
+ # Find every Mach-O with one batched file(1) run instead of a process
per
+ # file (an installation holds ~10k). --print0 emits "path\0: type\n".
+ local machos=() f type
+ while IFS= read -r -d '' f && IFS= read -r type; do
+ case "$type" in ": Mach-O"*) machos+=("$f") ;; esac
+ done < <(find "$app" -type f -print0 | xargs -0 file --no-pad --print0
-- 2>/dev/null)
+ # codesign rewrites a Mach-O through a temporary file beside it, so the
+ # containing directory has to be writable as well.
+ if [ ${#machos[@]} -gt 0 ]; then
+ local dirs=()
+ for f in "${machos[@]}"; do dirs+=("${f%/*}"); done
+ chmod u+w "${machos[@]}"
+ printf '%s\n' "${dirs[@]}" | sort -u | tr '\n' '\0' | xargs -0
chmod u+w
+ fi
+ for b in ${bundles[@]+"${bundles[@]}"}; do open_for_signing "$b"; done
+
+ # 1. every Mach-O object, deepest path first
+ local count=0
+ if [ ${#machos[@]} -gt 0 ]; then
+ while IFS= read -r f; do
+ case " ${main_execs[*]-} " in *" $f "*) continue ;; esac
+ sign_one "$f"
+ count=$((count + 1))
+ done < <(printf '%s\n' "${machos[@]}" | awk '{ print
gsub(/\//,"/") "\t" $0 }' | sort -rn | cut -f2-)
+ fi
+ echo " signed $count Mach-O objects"
+
+ # 2. nested bundles, deepest first, so each seal covers already-signed
contents
+ for b in ${bundles[@]+"${bundles[@]}"}; do
+ [ "$b" = "$app" ] && continue
+ sign_one "$b"
+ echo " sealed nested bundle: ${b#"$app"/}"
+ done
+
+ # 3. the app bundle itself
+ sign_one "$app"
+ echo " sealed $app"
+ report "$app"
+}
+
+for target in "${TARGETS[@]}"; do
+ [ -e "$target" ] || { echo "no such path: $target" >&2; exit 1; }
+ case "$target" in
+ *.dmg)
+ if [ "$VERIFY_ONLY" = yes ]; then report "$target";
continue; fi
+ # A .dmg is signed as a whole; the .app inside must
already be signed.
+ if [ "$IDENTITY" = "-" ]; then
+ echo "refusing to ad-hoc sign a .dmg
(pointless); pass -i <Developer ID>" >&2
+ exit 1
+ fi
+ codesign --force --sign "$IDENTITY" --timestamp
"$target"
+ report "$target"
+ ;;
+ *)
+ if [ "$VERIFY_ONLY" = yes ]; then report "$target";
continue; fi
+ sign_app "$target"
+ ;;
+ esac
+done
diff --git a/main/solenv/bin/modules/installer/scriptitems.pm
b/main/solenv/bin/modules/installer/scriptitems.pm
index fe002f4a30..9d931573b9 100644
--- a/main/solenv/bin/modules/installer/scriptitems.pm
+++ b/main/solenv/bin/modules/installer/scriptitems.pm
@@ -1713,12 +1713,20 @@ sub add_License_Files_into_Installdir
$newfile->{'modules'} =
$installer::globals::rootbrandpackage;
}
- push(@newfilesarray, $newfile);
+ # On Mac OS X the installation root is the bundle's
Contents
+ # directory, where only the entries defined by Apple
may live --
+ # a stray LICENSE or README there makes the bundle
unsignable.
+ # The copy in the installation set (the .dmg root,
below) is the
+ # one users actually see anyway.
+ if ( ! $installer::globals::ismacosx )
+ {
+ push(@newfilesarray, $newfile);
- $installer::logger::Lang->printf(
- "New files: Adding file %s for the installation root to the
file list. Language: %s\n",
- $newfilename,
- $defaultlanguage);
+ $installer::logger::Lang->printf(
+ "New files: Adding file %s for the
installation root to the file list. Language: %s\n",
+ $newfilename,
+ $defaultlanguage);
+ }
if ( defined $newfile->{'InstallName'} )
{
diff --git a/main/solenv/bin/modules/installer/simplepackage.pm
b/main/solenv/bin/modules/installer/simplepackage.pm
index 63b78932c3..4e94abf12b 100644
--- a/main/solenv/bin/modules/installer/simplepackage.pm
+++ b/main/solenv/bin/modules/installer/simplepackage.pm
@@ -541,11 +541,33 @@ sub create_package
chdir $localfrom;
}
- $systemcall = "cd $localtempdir && hdiutil makehybrid -hfs
-hfs-openfolder $folder $folder -hfs-volume-name \"$volume_name\" -ov -o
$installdir/tmp && hdiutil convert -ov -format UDZO $installdir/tmp.dmg -o
$archive && ";
+ # Code-sign the .app before it is sealed into the .dmg. Opt-in:
without
+ # MACOSX_CODESIGNING_IDENTITY the installation set is left as
it was.
+ if ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} )
+ {
+ my $signscript = $ENV{'SOLARENV'} .
"/bin/macosx-codesign.sh";
+ foreach my $appdir (
glob("$localtempdir/$folder/*.app") )
+ {
+ my $signcall = "$signscript -i
\"$ENV{'MACOSX_CODESIGNING_IDENTITY'}\" \"$appdir\"";
+ my $signreturn = system($signcall);
+ if ( $signreturn ) {
installer::exiter::exit_program("ERROR: Could not code-sign $appdir!",
"create_package"); }
+ $installer::logger::Lang->print("Success:
Code-signed $appdir\n");
+ }
+ }
+
+ # "hdiutil makehybrid -hfs" stamps an (empty)
com.apple.FinderInfo onto
+ # every file in the image, which makes "codesign --verify
--strict"
+ # reject the signed application inside the .dmg and would fail
+ # notarization. "hdiutil create -srcfolder" copies the files as
they
+ # are. (The -hfs-openfolder auto-open it also did is not
supported on
+ # Apple Silicon any more: bless refuses it.)
+ # "-fs HFS+" is not optional: left to itself "hdiutil create"
makes an
+ # APFS image on recent macOS, which will not mount before 10.12.
+ # "makehybrid -hfs" always produced HFS+.
+ $systemcall = "cd $localtempdir && hdiutil create -srcfolder
$folder -volname \"$volume_name\" -fs HFS+ -format UDZO -ov $archive";
if (( $ref ne "" ) && ( $$ref ne "" )) {
- $systemcall .= "hdiutil unflatten $archive && Rez -a
$$ref -o $archive && hdiutil flatten $archive &&";
+ $systemcall .= " && hdiutil unflatten $archive && Rez
-a $$ref -o $archive && hdiutil flatten $archive";
}
- $systemcall .= "rm -f $installdir/tmp.dmg";
}
else
{
@@ -581,6 +603,25 @@ sub create_package
{
$infoline = "Success: Executed \"$systemcall\"
successfully!\n";
$installer::logger::Lang->print($infoline);
+ # Sign the finished disk image. This completes the
chain: the .app
+ # inside was signed before the image was built, and the
image itself
+ # is signed here. It has to happen at this point rather
than earlier -
+ # the Rez step above rewrites the image to attach the
license
+ # resource, and that would invalidate a signature
applied before it.
+ #
+ # Skipped for an ad-hoc identity: an ad-hoc signed .dmg
buys nothing
+ # (Gatekeeper rejects it either way) and
macosx-codesign.sh refuses
+ # it outright, which would turn a working ad-hoc build
into an error.
+ if (( $archive =~ /dmg$/ ) &&
+ ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} ) &&
+ ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} ne "-" ))
+ {
+ my $signscript = $ENV{'SOLARENV'} .
"/bin/macosx-codesign.sh";
+ my $signcall = "$signscript -i
\"$ENV{'MACOSX_CODESIGNING_IDENTITY'}\" \"$archive\"";
+ my $signreturn = system($signcall);
+ if ( $signreturn ) {
installer::exiter::exit_program("ERROR: Could not code-sign $archive!",
"create_package"); }
+ $installer::logger::Lang->print("Success:
Code-signed $archive\n");
+ }
}
}
diff --git a/main/solenv/inc/unxmacc.mk b/main/solenv/inc/unxmacc.mk
index 5f2d00fbda..9cb1c134e4 100644
--- a/main/solenv/inc/unxmacc.mk
+++ b/main/solenv/inc/unxmacc.mk
@@ -185,6 +185,7 @@ LINKFLAGSRUNPATH_UREBIN=
LINKFLAGSRUNPATH_OOO=-install_name '@_______OOO/$(@:f)'
LINKFLAGSRUNPATH_SDK=
LINKFLAGSRUNPATH_BRAND=
+LINKFLAGSRUNPATH_BRANDBIN=
LINKFLAGSRUNPATH_OXT=
LINKFLAGSRUNPATH_BOXT=
LINKFLAGSRUNPATH_NONE=-install_name '@_______NONE/$(@:f)'
diff --git a/main/solenv/inc/unxmacx.mk b/main/solenv/inc/unxmacx.mk
index 0980e03e27..13dfaa9b13 100644
--- a/main/solenv/inc/unxmacx.mk
+++ b/main/solenv/inc/unxmacx.mk
@@ -194,6 +194,7 @@ LINKFLAGSRUNPATH_UREBIN=
LINKFLAGSRUNPATH_OOO=-install_name '@_______OOO/$(@:f)'
LINKFLAGSRUNPATH_SDK=
LINKFLAGSRUNPATH_BRAND=
+LINKFLAGSRUNPATH_BRANDBIN=
LINKFLAGSRUNPATH_OXT=
LINKFLAGSRUNPATH_BOXT=
LINKFLAGSRUNPATH_NONE=-install_name '@_______NONE/$(@:f)'
