[CMake] Accept ENTITLEMENTS in add_llvm_executable and llvm_codesign

[sgraenitz]

Summary

Allow code-signing with entitlements. FORCE may be used to avoid an error when replacing existing signatures.

[sgraenitz]

cmake/modules/AddLLVM.cmake

795

Would we want to pass FORCE to add_llvm_executable conditionally?

[beanz]

cmake/modules/AddLLVM.cmake

795

I'm trying to think about the situations in which we need the FORCE option. Since this is connecting as a post-build event it shouldn't be running unless the target re-generates the output, so I'm not sure I understand why we ever need it.

I did the git blame walk back to when the code was initially added in 49dd98a03a, and there is no explanation. I suspect debugserver doesn't actually need the --force option because the author of the initial patch probably hit errors when re-signing the pre-built binary in his build directory.

Thoughts?

[sgraenitz]

cmake/modules/AddLLVM.cmake

795

I think you are right, it shouldn't be necessary. In practice, though, I can imagine situations when we want to make sure this won't fail in any case.

The options are: remove entirely (most correct) OR allow enable per target (most flexible) OR allow enable globally.

What about the last one? I could add LLVM_CODESIGNING_FORCE which is OFF by default. In failsafe/debugging situations it could be turned ON globally. I could remove the FORCE parameter here and check the flag in llvm_codesign (similar to LLVM_CODESIGNING_IDENTITY).

[sgraenitz]

Remove FORCE parameter from llvm_codesign and instead add global option LLVM_CODESIGNING_FORCE

[sgraenitz]

CMakeLists.txt

403 ↗

(On Diff #173851)

Identity should be a string right?

cmake/modules/AddLLVM.cmake

795

Patch updated

[beanz]

CMakeLists.txt

403 ↗

(On Diff #173851)

Yep, makes sense.

cmake/modules/AddLLVM.cmake

795

My gut is to just remove forcing entirely, and only add it back if we actually need it. Short of post-build steps being incorrectly implemented in a CMake generator, I can't imagine a situation where it would be needed.

[sgraenitz]

Remove force option

[sgraenitz]

Two use-cases for executables:
LLDB lldb-server https://reviews.llvm.org/D54444
LLDB debugserver https://reviews.llvm.org/D54476

I have no use-case for shared libraries (yet), so I didn't add ENTITLEMENTS there. Is that ok?

[sgraenitz]

Tested on macOS and Linux with the use-cases mentioned.

[beanz]

LGTM.

cmake/modules/AddLLVM.cmake

if(LLVM_COMMON_DEPENDS)
     # CMake issue 14747 --  add_dependencies() might be ignored to objlib's user.
     foreach(objlib ${objlibs})
       add_dependencies(${objlib} ${LLVM_COMMON_DEPENDS})
     endforeach()
   endif()
 
   if(ARG_SHARED OR ARG_MODULE)
     llvm_externalize_debuginfo(${name})
-    llvm_codesign(${name})
+    llvm_codesign(TARGET ${name})
   endif()
 endfunction()
 
 function(add_llvm_install_targets target)
   cmake_parse_arguments(ARG "" "COMPONENT;PREFIX" "DEPENDS" ${ARGN})
   if(ARG_COMPONENT)
     set(component_option -DCMAKE_INSTALL_COMPONENT="${ARG_COMPONENT}")
   endif()
else()
     endif()
   endif()
 
   set_target_properties(${name} PROPERTIES FOLDER "Loadable modules")
 endmacro(add_llvm_loadable_module name)
 
 
 macro(add_llvm_executable name)
-  cmake_parse_arguments(ARG "DISABLE_LLVM_LINK_LLVM_DYLIB;IGNORE_EXTERNALIZE_DEBUGINFO;NO_INSTALL_RPATH" "" "DEPENDS" ${ARGN})
+  cmake_parse_arguments(ARG
+    "DISABLE_LLVM_LINK_LLVM_DYLIB;IGNORE_EXTERNALIZE_DEBUGINFO;NO_INSTALL_RPATH"
+    "ENTITLEMENTS"
+    "DEPENDS"
+    ${ARGN})
+
   llvm_process_sources( ALL_FILES ${ARG_UNPARSED_ARGUMENTS} )
 
   list(APPEND LLVM_COMMON_DEPENDS ${ARG_DEPENDS})
 
   # Generate objlib
   if(LLVM_ENABLE_OBJLIB)
     # Generate an obj library for both targets.
     set(obj_name "obj.${name}")
macro(add_llvm_executable name)
   endif()
   if (LLVM_PTHREAD_LIB)
     # libpthreads overrides some standard library symbols, so main
     # executable must be linked with it in order to provide consistent
     # API for all shared libaries loaded by this executable.
     target_link_libraries(${name} PRIVATE ${LLVM_PTHREAD_LIB})
   endif()
 
-  llvm_codesign(${name})
+  llvm_codesign(TARGET ${name} ENTITLEMENTS ${ARG_ENTITLEMENTS} FORCE)
 endmacro(add_llvm_executable name)
 
 function(export_executable_symbols target)
   if (LLVM_EXPORTED_SYMBOL_FILE)
     # The symbol file should contain the symbols we want the executable to
     # export
     set_target_properties(${target} PROPERTIES ENABLE_EXPORTS 1)
   elseif (LLVM_EXPORT_SYMBOLS_FOR_PLUGINS)
else()
     add_custom_command(TARGET ${name} POST_BUILD
       COMMAND ${CMAKE_OBJCOPY} --only-keep-debug $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.debug
       ${strip_command} -R .gnu_debuglink
       COMMAND ${CMAKE_OBJCOPY} --add-gnu-debuglink=$<TARGET_FILE:${name}>.debug $<TARGET_FILE:${name}>
       )
   endif()
 endfunction()
 
-function(llvm_codesign name)
+# Usage: llvm_codesign(TARGET name [ENTITLEMENTS file] [FORCE])
+#
+# Code-sign the given TARGET with the global LLVM_CODESIGNING_IDENTITY or skip
+# if undefined. Customize capabilities by passing a file path to ENTITLEMENTS.
+# FORCE may be used to avoid an error when replacing existing signatures.
+#
+function(llvm_codesign)
+  cmake_parse_arguments(ARG "FORCE" "TARGET;ENTITLEMENTS" "" ${ARGN})
+
   if(NOT LLVM_CODESIGNING_IDENTITY)
     return()
   endif()
 
   if(APPLE)
     if(NOT CMAKE_CODESIGN)
       set(CMAKE_CODESIGN xcrun codesign)
     endif()
     if(NOT CMAKE_CODESIGN_ALLOCATE)
       execute_process(
         COMMAND xcrun -f codesign_allocate
         OUTPUT_STRIP_TRAILING_WHITESPACE
         OUTPUT_VARIABLE CMAKE_CODESIGN_ALLOCATE
       )
     endif()
+    if(DEFINED ARG_FORCE)
+      set(PASS_FORCE --force)
+    endif()
+    if(DEFINED ARG_ENTITLEMENTS)
+      set(PASS_ENTITLEMENTS --entitlements ${ARG_ENTITLEMENTS})
+    endif()
+
     add_custom_command(
-      TARGET ${name} POST_BUILD
+      TARGET ${ARG_TARGET} POST_BUILD
       COMMAND ${CMAKE_COMMAND} -E
               env CODESIGN_ALLOCATE=${CMAKE_CODESIGN_ALLOCATE}
               ${CMAKE_CODESIGN} -s ${LLVM_CODESIGNING_IDENTITY}
-              $<TARGET_FILE:${name}>
+              ${PASS_ENTITLEMENTS} ${PASS_FORCE}
+              $<TARGET_FILE:${ARG_TARGET}>
     )
   endif()
 endfunction()
 
 function(llvm_setup_rpath name)
   if(CMAKE_INSTALL_RPATH)
     return()
   endif()