[CMake] Teach the build system to codesign built products

[bogner]

Summary

Automatically codesign all executables and dynamic libraries if a
codesigning identity is given (via LLVM_CODESIGNING_IDENTITY). This
option is darwin only for now.

Also update platforms/iOS.cmake to pick up the right versions of
codesign and codesign_allocate.

[bogner]

Update to set path to codesign_allocate correctly and set the extra tool paths in platforms/iOS.cmake.

[beanz]

Looping in @davide and @JDevlieghere. LLDB has some hand-rolled goop in debug server's build that could potentially be replaced by this.

LGTM!

[bogner]

Committed in r336708.

[davide]

Stefan (in our group) is going to look at CMake'y stuffs so I'm going to cc: him (he doesn't have a Phabricator account yet, so I just forwarded this e-mail to him for now).
Thanks for keeping us in the loop.

[sgraenitz]

cmake/modules/AddLLVM.cmake

1603

I am way too late with this, but shouldn't it be set(CMAKE_CODESIGN "xcrun codesign") to avoid getting a list "xcrun;codesign"?

[sgraenitz]

cmake/modules/AddLLVM.cmake

1603

Oh ok, the implementation is correct. Getting a list seems to be the preferable behaviour here. (https://stackoverflow.com/questions/8925396)

CMakeLists.txt

 endif( LLVM_USE_INTEL_JITEVENTS )
 
 option(LLVM_USE_OPROFILE
   "Use opagent JIT interface to inform OProfile about JIT code" OFF)
 
 option(LLVM_EXTERNALIZE_DEBUGINFO
   "Generate dSYM files and strip executables and libraries (Darwin Only)" OFF)
 
+option(LLVM_CODESIGNING_IDENTITY
+  "Sign executables and dylibs with the given identity (Darwin Only)" OFF)
+
 # If enabled, verify we are on a platform that supports oprofile.
 if( LLVM_USE_OPROFILE )
   if( NOT CMAKE_SYSTEM_NAME MATCHES "Linux" )
     message(FATAL_ERROR "OProfile support is available on Linux only.")
   endif( NOT CMAKE_SYSTEM_NAME MATCHES "Linux" )
 endif( LLVM_USE_OPROFILE )
 
 set(LLVM_USE_SANITIZER "" CACHE STRING

cmake/modules/AddLLVM.cmake

if(LLVM_COMMON_DEPENDS)
     # CMake issue 14747 --  add_dependencies() might be ignored to objlib's user.
     foreach(objlib ${objlibs})
       add_dependencies(${objlib} ${LLVM_COMMON_DEPENDS})
     endforeach()
   endif()
 
   if(ARG_SHARED OR ARG_MODULE)
     llvm_externalize_debuginfo(${name})
+    llvm_codesign(${name})
   endif()
 endfunction()
 
 function(add_llvm_install_targets target)
   cmake_parse_arguments(ARG "" "COMPONENT;PREFIX" "DEPENDS" ${ARGN})
   if(ARG_COMPONENT)
     set(component_option -DCMAKE_INSTALL_COMPONENT="${ARG_COMPONENT}")
   endif()
if(NOT ARG_IGNORE_EXTERNALIZE_DEBUGINFO)
     llvm_externalize_debuginfo(${name})
   endif()
   if (LLVM_PTHREAD_LIB)
     # libpthreads overrides some standard library symbols, so main
     # executable must be linked with it in order to provide consistent
     # API for all shared libaries loaded by this executable.
     target_link_libraries(${name} PRIVATE ${LLVM_PTHREAD_LIB})
   endif()
+
+  llvm_codesign(${name})
 endmacro(add_llvm_executable name)
 
 function(export_executable_symbols target)
   if (LLVM_EXPORTED_SYMBOL_FILE)
     # The symbol file should contain the symbols we want the executable to
     # export
     set_target_properties(${target} PROPERTIES ENABLE_EXPORTS 1)
   elseif (LLVM_EXPORT_SYMBOLS_FOR_PLUGINS)
else()
     add_custom_command(TARGET ${name} POST_BUILD
       COMMAND ${CMAKE_OBJCOPY} --only-keep-debug $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.debug
       ${strip_command} -R .gnu_debuglink
       COMMAND ${CMAKE_OBJCOPY} --add-gnu-debuglink=$<TARGET_FILE:${name}>.debug $<TARGET_FILE:${name}>
       )
   endif()
 endfunction()
 
+function(llvm_codesign name)
+  if(NOT LLVM_CODESIGNING_IDENTITY)
+    return()
+  endif()
+
+  if(APPLE)
+    if(NOT CMAKE_CODESIGN)
+      set(CMAKE_CODESIGN xcrun codesign)
+    endif()
+    if(NOT CMAKE_CODESIGN_ALLOCATE)
+      execute_process(
+        COMMAND xcrun -f codesign_allocate
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        OUTPUT_VARIABLE CMAKE_CODESIGN_ALLOCATE
+      )
+    endif()
+    add_custom_command(
+      TARGET ${name} POST_BUILD
+      COMMAND ${CMAKE_COMMAND} -E
+              env CODESIGN_ALLOCATE=${CMAKE_CODESIGN_ALLOCATE}
+              ${CMAKE_CODESIGN} -s ${LLVM_CODESIGNING_IDENTITY}
+              $<TARGET_FILE:${name}>
+    )
+  endif()
+endfunction()
+
 function(llvm_setup_rpath name)
   if(CMAKE_INSTALL_RPATH)
     return()
   endif()
 
   if(LLVM_INSTALL_PREFIX AND NOT (LLVM_INSTALL_PREFIX STREQUAL CMAKE_INSTALL_PREFIX))
     set(extra_libdir ${LLVM_LIBRARY_DIR})
   elseif(LLVM_BUILD_LIBRARY_DIR)

cmake/platforms/iOS.cmake

 IF(NOT CMAKE_LIBTOOL)
   execute_process(COMMAND xcrun -sdk ${CMAKE_OSX_SYSROOT} -find libtool
    OUTPUT_VARIABLE CMAKE_LIBTOOL_val
    ERROR_QUIET
    OUTPUT_STRIP_TRAILING_WHITESPACE)
   SET(CMAKE_LIBTOOL ${CMAKE_LIBTOOL_val} CACHE FILEPATH "Libtool")
   message(STATUS "Using libtool ${CMAKE_LIBTOOL}")
 ENDIF()
+
+IF(NOT CMAKE_CODESIGN)
+  execute_process(COMMAND xcrun -sdk ${CMAKE_OSX_SYSROOT} -find codesign
+   OUTPUT_VARIABLE CMAKE_CODESIGN_val
+   ERROR_QUIET
+   OUTPUT_STRIP_TRAILING_WHITESPACE)
+  SET(CMAKE_CODESIGN ${CMAKE_CODESIGN_val} CACHE FILEPATH "Codesign")
+  message(STATUS "Using codesign ${CMAKE_CODESIGN}")
+ENDIF()
+
+IF(NOT CMAKE_CODESIGN_ALLOCATE)
+  execute_process(
+    COMMAND xcrun -sdk ${CMAKE_OSX_SYSROOT} -find codesign_allocate
+    OUTPUT_VARIABLE CMAKE_CODESIGN_ALLOCATE_val
+    ERROR_QUIET
+    OUTPUT_STRIP_TRAILING_WHITESPACE)
+  SET(CMAKE_CODESIGN_ALLOCATE ${CMAKE_CODESIGN_ALLOCATE_val} CACHE
+      FILEPATH "Codesign_Allocate")
+  message(STATUS "Using codesign_allocate ${CMAKE_CODESIGN_ALLOCATE}")
+ENDIF()