[compiler-rt] Stop explictly ad-hoc signing compiler-rt dylibs in apple builds if ld is new enough

[thakis]

Summary

ld64 implicitly ad-hoc code-signs as of Xcode 12, and strip and friends know
how keep this special ad-hoc signature valid.

So this should have no effective behavior change, except that you can now strip
libclang_rt.asan_osx_dynamic.dylib and it'll still have a valid ad-hoc
signature, instead of strip printing "warning: changes being made to the file
will invalidate the code signature in:" and making the ad-hoc code signature
invalid.

[kubamracek]

+ more Apple folks

Makes sense, the only thing I can think of is if someone wants to build compiler-rt with older Xcode/SDKs. Not sure if we care about that.

[thakis]

Makes sense, the only thing I can think of is if someone wants to build compiler-rt with older Xcode/SDKs. Not sure if we care about that.

wants to build compiler-rt *for iOS* with older Xcode/SDKs, right? Mac/Intel doesn't care about the signature, and Mac/Arm requires Xcode 12+ to be able to target it at all.

I don't know if that's something people do.

I guess we can land this and put it back behind an option if it turns out someone does need it?

[delcypher]

In D123475#3443283, @kubamracek wrote:

+ more Apple folks

Makes sense, the only thing I can think of is if someone wants to build compiler-rt with older Xcode/SDKs. Not sure if we care about that.

For our own internal CI I don't think this change should cause problems. I'm not sure about the public CI (http://lab.llvm.org:8080/green/). The page says:

Builders are running macOS Catalina 10.15.5 (19F101) with Xcode 11.5 (11E608c). System tools: clang-1103.0.32.62, ld64-556.6

If this information is accurate it might cause problems but I'm not sure if this up-to-date.

[thakis]

check ld version

[thakis]

Looks like those bots do build for iossim, thanks for pointing this out.

I tweaked this so that it omits the codesign invocation only if ld64 is new enough. That makes it so that the dylib can be stripped as long as LLVM is built with a new-enough Xcode, and one day we can remove the whole block. How does that look?

[yln]

LGTM to me, thanks!
@delcypher, what do you think?

[thakis]

Thanks!

[thakis]

Looking through https://green.lab.llvm.org/green/view/Sanitizer%20CI/job/clang-san-iossim/ (the only bot I could find building compiler-rt for iOS), all its builds seem to run on https://green.lab.llvm.org/green/computer/green-dragon-08/, which does have Xcode 13 according to the web interface.

So maybe just removing this is fine after all?

But happy to keep it in as-is for a while too, let me know.

compiler-rt/cmake/Modules/AddCompilerRT.cmake

foreach(libname ${libnames})
     if(${type} STREQUAL "SHARED")
       if(COMMAND llvm_setup_rpath)
         llvm_setup_rpath(${libname})
       endif()
       if(WIN32 AND NOT CYGWIN AND NOT MINGW)
         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
       endif()
-      if(APPLE)
-        # Ad-hoc sign the dylibs
+      if (APPLE AND NOT CMAKE_LINKER MATCHES ".*lld.*")
+        # Ad-hoc sign the dylibs when using Xcode versions older than 12.
+        # Xcode 12 shipped with ld64-609.
+        # FIXME: Remove whole conditional block once everything uses Xcode 12+.
+        set(LD_V_OUTPUT)
+        execute_process(
+          COMMAND sh -c "${CMAKE_LINKER} -v 2>&1 | head -1"
+          RESULT_VARIABLE HAD_ERROR
+          OUTPUT_VARIABLE LD_V_OUTPUT
+        )
+        if (HAD_ERROR)
+          message(FATAL_ERROR "${CMAKE_LINKER} failed with status ${HAD_ERROR}")
+        endif()
+        set(NEED_EXPLICIT_ADHOC_CODESIGN 1)
+        if ("${LD_V_OUTPUT}" MATCHES ".*ld64-([0-9.]+).*")
+          string(REGEX REPLACE ".*ld64-([0-9.]+).*" "\\1" HOST_LINK_VERSION ${LD_V_OUTPUT})
+          if (HOST_LINK_VERSION VERSION_GREATER_EQUAL 609)
+            set(NEED_EXPLICIT_ADHOC_CODESIGN 0)
+          endif()
+        endif()
+        if (NEED_EXPLICIT_ADHOC_CODESIGN)
           add_custom_command(TARGET ${libname}
             POST_BUILD
             COMMAND codesign --sign - $<TARGET_FILE:${libname}>
             WORKING_DIRECTORY ${COMPILER_RT_OUTPUT_LIBRARY_DIR}
           )
         endif()
       endif()
+    endif()
 
     set(parent_target_arg)
     if(LIB_PARENT_TARGET)
       set(parent_target_arg PARENT_TARGET ${LIB_PARENT_TARGET})
     endif()
     add_compiler_rt_install_targets(${libname} ${parent_target_arg})
 
     if(APPLE)