This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
The following commit(s) were added to refs/heads/AOO50X by this push:
new fa471f8dff macOS: clear xattrs on read-only files before signing
fa471f8dff is described below
commit fa471f8dffce740919666972c0fa033f8abd6123
Author: Jim Jagielski <[email protected]>
AuthorDate: Thu Sep 24 16:45:37 2026 -0400
macOS: clear xattrs on read-only files before signing
---
main/solenv/bin/macosx-codesign.sh | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/main/solenv/bin/macosx-codesign.sh
b/main/solenv/bin/macosx-codesign.sh
index 40c8970fed..f05ebe6ec3 100755
--- a/main/solenv/bin/macosx-codesign.sh
+++ b/main/solenv/bin/macosx-codesign.sh
@@ -214,6 +214,14 @@ sign_app() {
echo "==> signing $app (identity: $IDENTITY, hardened: $HARDENED)"
# Quarantine and other xattrs make codesign fail or produce an unstable
seal.
+ # xattr -c needs write permission, and installsets stage files
read-only.
+ local readonly_xattr=() f
+ while IFS= read -r -d '' f; do readonly_xattr+=("$f"); done < <(find
"$app" ! -type l ! -perm -u+w -xattr -print0)
+ if [ ${#readonly_xattr[@]} -gt 0 ]; then
+ printf '%s\0' "${readonly_xattr[@]}" | xargs -0 chmod u+w
+ printf '%s\0' "${readonly_xattr[@]}" | xargs -0 xattr -c
+ printf '%s\0' "${readonly_xattr[@]}" | xargs -0 chmod u-w
+ fi
xattr -cr "$app" 2>/dev/null || true
# A bundle's main executable is signed as part of its bundle, not on
its own:
