This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/openoffice-devtools.git
The following commit(s) were added to refs/heads/main by this push:
new 597e259 release-scripts: sync macosx-codesign.sh with trunk ed9fccbc30
597e259 is described below
commit 597e2595d45aa70cb9fcd8e53b45916b63d7791a
Author: Jim Jagielski <[email protected]>
AuthorDate: Thu Sep 24 16:45:49 2026 -0400
release-scripts: sync macosx-codesign.sh with trunk ed9fccbc30
---
release-scripts/macosx-codesign.sh | 8 ++++++
release-scripts/macosx-remote-sign.sh | 2 +-
release-scripts/tests/test_macosx_remote_sign.py | 33 +++++++++++++++++++++++-
3 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/release-scripts/macosx-codesign.sh
b/release-scripts/macosx-codesign.sh
index 40c8970..f05ebe6 100755
--- a/release-scripts/macosx-codesign.sh
+++ b/release-scripts/macosx-codesign.sh
@@ -214,6 +214,14 @@ sign_app() {
echo "==> signing $app (identity: $IDENTITY, hardened: $HARDENED)"
# Quarantine and other xattrs make codesign fail or produce an unstable
seal.
+ # xattr -c needs write permission, and installsets stage files
read-only.
+ local readonly_xattr=() f
+ while IFS= read -r -d '' f; do readonly_xattr+=("$f"); done < <(find
"$app" ! -type l ! -perm -u+w -xattr -print0)
+ if [ ${#readonly_xattr[@]} -gt 0 ]; then
+ printf '%s\0' "${readonly_xattr[@]}" | xargs -0 chmod u+w
+ printf '%s\0' "${readonly_xattr[@]}" | xargs -0 xattr -c
+ printf '%s\0' "${readonly_xattr[@]}" | xargs -0 chmod u-w
+ fi
xattr -cr "$app" 2>/dev/null || true
# A bundle's main executable is signed as part of its bundle, not on
its own:
diff --git a/release-scripts/macosx-remote-sign.sh
b/release-scripts/macosx-remote-sign.sh
index 1f92b22..023c98f 100755
--- a/release-scripts/macosx-remote-sign.sh
+++ b/release-scripts/macosx-remote-sign.sh
@@ -18,7 +18,7 @@
# Deploy this script together with its siblings macosx-codesign.sh,
# macosx-check-load-commands.sh and macosx-codesign-entitlements.plist, which
# do the actual signing/notarizing/verifying. They are verbatim copies of
-# openoffice trunk's main/solenv/bin/ files as of c42fc0a9ce; keep them in
+# openoffice trunk's main/solenv/bin/ files as of ed9fccbc30; keep them in
# sync from there rather than editing them here. No OpenOffice source
# checkout is needed on the signing host.
#
diff --git a/release-scripts/tests/test_macosx_remote_sign.py
b/release-scripts/tests/test_macosx_remote_sign.py
index b210fca..da682ef 100644
--- a/release-scripts/tests/test_macosx_remote_sign.py
+++ b/release-scripts/tests/test_macosx_remote_sign.py
@@ -23,12 +23,13 @@
import hashlib
import os
+import shutil
import stat
import subprocess
import pytest
-from conftest import IDENTITY, SCRIPT_DIR, Signer, legacy_fixture_dmg,
modern_fixture_dmg, xattrs, fixture_dmg, mount_point, requires_macos,
volume_name
+from conftest import INFO_PLIST, IDENTITY, SCRIPT_DIR, set_finder_info,
Signer, legacy_fixture_dmg, modern_fixture_dmg, xattrs, fixture_dmg,
mount_point, requires_macos, volume_name
pytestmark = requires_macos
@@ -517,3 +518,33 @@ def test_bundled_delegate_siblings_present():
for name in ("macosx-codesign.sh", "macosx-check-load-commands.sh"):
assert os.access(SCRIPT_DIR / name, os.X_OK), name
assert (SCRIPT_DIR / "macosx-codesign-entitlements.plist").is_file()
+
+
+def test_bundled_delegate_clears_xattrs_on_read_only_files(workdir):
+ """xattr -c needs write permission; shipped installsets stage files
+ read-only and carry FinderInfo, which codesign rejects as detritus."""
+ contents = workdir / "X.app" / "Contents"
+ (contents / "MacOS").mkdir(parents=True)
+ (contents / "Resources").mkdir()
+ (contents / "Info.plist").write_text(INFO_PLIST.replace("soffice", "x"))
+ shutil.copy("/usr/bin/true", contents / "MacOS" / "x")
+ data = contents / "Resources" / "data.txt"
+ data.write_text("data\n")
+ set_finder_info(data)
+ data.chmod(0o444)
+ ro_dir = contents / "Resources" / "ro"
+ ro_dir.mkdir()
+ (ro_dir / "f").write_text("f\n")
+ set_finder_info(ro_dir)
+ ro_dir.chmod(0o555)
+ try:
+ r = subprocess.run(
+ [str(SCRIPT_DIR / "macosx-codesign.sh"), "-i", "-", str(workdir /
"X.app")],
+ capture_output=True, text=True,
+ )
+ assert r.returncode == 0, r.stdout + r.stderr
+ assert xattrs(data) == [] and xattrs(ro_dir) == []
+ assert stat.S_IMODE(data.stat().st_mode) == 0o444
+ assert stat.S_IMODE(ro_dir.stat().st_mode) == 0o555
+ finally:
+ ro_dir.chmod(0o755)
