Verified Commit a9325827 authored by boklm's avatar boklm
Browse files

Bug 41476: Remove tools/signing/wrappers/sign-rcodesign 

And related files.

This was used to sign 13.5 releases.
parent 3e7a89e1

tools/signing/alpha.entitlements.xml

deleted100644 → 0
+0 −26
Original line number Diff line number Diff line 
<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<!--

     Entitlements to apply during codesigning of production builds.

-->

<plist version="1.0">

  <dict>

    <!-- Firefox needs to create executable pages (without MAP_JIT) -->

    <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>



    <!-- Allow loading third party libraries. Needed for Flash and CDMs -->

    <key>com.apple.security.cs.disable-library-validation</key><true/>



    <!-- Firefox needs to access the microphone on sites the user allows -->

    <key>com.apple.security.device.audio-input</key><true/>



    <!-- Firefox needs to access the camera on sites the user allows -->

    <key>com.apple.security.device.camera</key><true/>



    <!-- Firefox needs to access the location on sites the user allows -->

    <key>com.apple.security.personal-information.location</key><true/>



    <!-- For SmartCardServices(7) -->

    <key>com.apple.security.smartcard</key><true/>

  </dict>

</plist>

tools/signing/machines-setup/setup-signing-machine

+8 −1
Original line number Diff line number Diff line
@@ -41,6 +41,12 @@ function authorized_keys { 
  chmod 600 "$authkeysfile"

}



function remove_sudoers_file {

  # Remove a sudoers file that previously existed but is no longer used

  sfile="$1"

  rm -f "/etc/sudoers.d/$sfile"

}



function sudoers_file {

  sfile="$1"

  cp "$script_dir/sudoers.d/$sfile" "/etc/sudoers.d/$sfile"
@@ -91,7 +97,8 @@ sudoers_file sign-mar 
sudoers_file sign-exe

sudoers_file sign-apk

sudoers_file sign-aab

sudoers_file sign-rcodesign

# sign-rcodesign is removed - tor-browser-build#41476

remove_sudoers_file sign-rcodesign

sudoers_file sign-rcodesign-128

sudoers_file sign-rcodesign-146

sudoers_file set-date

tools/signing/machines-setup/sudoers.d/sign-rcodesign

deleted100644 → 0
+0 −2
Original line number Diff line number Diff line 
Defaults>signing-macos env_keep += "SIGNING_PROJECTNAME tbb_version_type RCODESIGN_PW"

%signing ALL = (signing-macos) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign

tools/signing/release.entitlements.xml

deleted100644 → 0
+0 −26
Original line number Diff line number Diff line 
<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<!--

     Entitlements to apply during codesigning of production builds.

-->

<plist version="1.0">

  <dict>

    <!-- Firefox needs to create executable pages (without MAP_JIT) -->

    <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>



    <!-- Allow loading third party libraries. Needed for Flash and CDMs -->

    <key>com.apple.security.cs.disable-library-validation</key><true/>



    <!-- Firefox needs to access the microphone on sites the user allows -->

    <key>com.apple.security.device.audio-input</key><true/>



    <!-- Firefox needs to access the camera on sites the user allows -->

    <key>com.apple.security.device.camera</key><true/>



    <!-- Firefox needs to access the location on sites the user allows -->

    <key>com.apple.security.personal-information.location</key><true/>



    <!-- For SmartCardServices(7) -->

    <key>com.apple.security.smartcard</key><true/>

  </dict>

</plist>

tools/signing/wrappers/sign-rcodesign

deleted100755 → 0
+0 −106
Original line number Diff line number Diff line 
#!/bin/bash

set -e



function exit_error {

  for msg in "$@"

  do

    echo "$msg" >&2

  done

  exit 1

}



test $# -eq 2 || exit_error "Wrong number of arguments"

dmg_file="$1"

display_name="$2"



output_file="/home/signing-macos/last-signed-$display_name.tar.zst"

rm -f "$output_file"



rcodesign_signing_p12_file=/home/signing-macos/keys/key-1.p12

test -f "$rcodesign_signing_p12_file" || exit_error "$rcodesign_signing_p12_file is missing"



tmpdir=$(mktemp -d)

trap "rm -Rf $tmpdir" EXIT

cd "$tmpdir"

7z x "$dmg_file"



# Fix permission on files:

# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2957050

# FIXME: Maybe we should extract the .mar file instead of the .dmg to

# preserve permissions

chmod ugo+x "$display_name/$display_name.app/Contents/MacOS"/* \

            "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/MacOS"/* \

            "$display_name/$display_name.app/Contents/MacOS/plugin-container.app/Contents/MacOS"/*

test -d "$display_name/$display_name.app/Contents/MacOS/Tor" && \

  chmod -R ugo+x "$display_name/$display_name.app/Contents/MacOS/Tor"



pwdir=/run/lock/rcodesign-pw

trap "rm -Rf $pwdir" EXIT

rm -Rf "$pwdir"

mkdir "$pwdir"

chmod 700 "$pwdir"

cat > "$pwdir/rcodesign-pw-2" << EOF

$RCODESIGN_PW

EOF

tr -d '\n' < "$pwdir/rcodesign-pw-2" > "$pwdir/rcodesign-pw"

rm "$pwdir/rcodesign-pw-2"



rcodesign_opts="

  --code-signature-flags runtime

  --timestamp-url http://timestamp.apple.com:8080/ts01

  --p12-file $rcodesign_signing_p12_file

  --p12-password-file $pwdir/rcodesign-pw

  "



# sign updater.app and plugin-container.app separately

echo '**** Signing updater.app ****'

/signing/rcodesign/rcodesign sign \

  $rcodesign_opts \

  --info-plist-path "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/Info.plist" \

  -- \

  "$display_name/$display_name.app/Contents/MacOS/updater.app"

echo '**** Signing plugin-container.app ****'

/signing/rcodesign/rcodesign sign \

  $rcodesign_opts \

  --entitlements-xml-path /signing/tor-browser-build/tools/signing/${tbb_version_type}.entitlements.xml \

  -- \

  "$display_name/$display_name.app/Contents/MacOS/plugin-container.app"



# Setting binary-identifier on some files, to avoid signature errors. See:

# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2956149

pushd "$display_name/$display_name.app/Contents/MacOS/"

for lib in *.dylib

do

  binident=$(echo $lib | sed 's/\.dylib$//')

  binident="--binary-identifier Contents/MacOS/$lib:$binident"

  echo "Adding option $binident"

  rcodesign_opts="$rcodesign_opts $binident"

done

popd



if test -d "$display_name/$display_name.app/Contents/MacOS/Tor/PluggableTransports/"

then

  pushd "$display_name/$display_name.app/Contents/MacOS/Tor/PluggableTransports/"

  for file in echo *

  do

    binident="--binary-identifier Contents/MacOS/Tor/PluggableTransports/$file:$file"

    echo "Adding option $binident"

    rcodesign_opts="$rcodesign_opts $binident"

  done

  popd

fi



echo "**** Signing main bundle ($display_name.app) ****"

# We use `--exclude '**'` to avoid re-signing nested bundles

/signing/rcodesign/rcodesign sign \

  $rcodesign_opts \

  --entitlements-xml-path /signing/tor-browser-build/tools/signing/${tbb_version_type}.entitlements.xml \

  --exclude '**' \

  -- \

  "$display_name/$display_name.app"



rm -f "$pwdir/rcodesign-pw"

rmdir "$pwdir"

tar -C "$display_name" -caf "$output_file" "$display_name.app"

cd -

rm -Rf "$tmpdir"