[CMake] Use extended llvm_codesign to pass entitlements for lldb-server

[sgraenitz]

Summary

Use llvm_codesign from https://reviews.llvm.org/D54443 to sign lldb-server with entitlements.

[sgraenitz]

debugserver was not that simple. For now only lldb-server as an example.

cmake/modules/AddLLDB.cmake

109

I am parsing ENTITLEMENTS above and passing it on here explicitly. Had expected it to be passed along with ARG_UNPARSED_ARGUMENTS otherwise, but for some reason that didn't work. Is that the expected behaviour?

[sgraenitz]

tools/lldb-server/CMakeLists.txt

50

TODO: Fix comment "debugserver"

[sgraenitz]

unset not necessary, fix comment, globally set LLVM_CODESIGNING_IDENTITY from LLDB_CODESIGN_IDENTITY

[aprantl]

Why does lldb-server need to be signed? I was under the impression that on macOS lldb-server is not used? Or are we building it for testing and need sign it because of that?

[sgraenitz]

In Xcode we have ad-hoc signing when targeting iOS and signing with entitlements in case of macOS for lldb-server.

[sgraenitz]

+ LLDB.framework has lldb-server as a dependency there. Not sure if it's (really) necessary, though.

[jingham]

We do use lldb-server, though only in the platform mode, for remote testsuite running. The gdbserver mode doesn't do anything for a macOS hosted lldb-server, so lldb-server should not require any entitlements. But we do use it.

[sgraenitz]

Ok, I will close this then. Added the remaining part of the patch to https://reviews.llvm.org/D54476

CMakeLists.txt

 cmake_minimum_required(VERSION 3.4.3)
 
 # Add path for custom modules
 set(CMAKE_MODULE_PATH
   ${CMAKE_MODULE_PATH}
   "${CMAKE_CURRENT_SOURCE_DIR}/cmake"
   "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules"
   )
 
 include(LLDBStandalone)
 include(LLDBConfig)
 include(AddLLDB)
 
+option(LLDB_USE_ENTITLEMENTS "When codesigning, use entitlements if available" ON)
+if(LLDB_CODESIGN_IDENTITY)
+  # In the future we may use LLVM_CODESIGNING_IDENTITY directly.
+  set(LLVM_CODESIGNING_IDENTITY ${LLDB_CODESIGN_IDENTITY})
+endif()
+
 # Define the LLDB_CONFIGURATION_xxx matching the build type
 if( uppercase_CMAKE_BUILD_TYPE STREQUAL "DEBUG" )
   add_definitions( -DLLDB_CONFIGURATION_DEBUG )
 else()
   add_definitions( -DLLDB_CONFIGURATION_RELEASE )
 endif()
 
 if (CMAKE_SYSTEM_NAME MATCHES "Windows|Android")

cmake/modules/AddLLDB.cmake

function(add_lldb_library name)
   target_compile_options(${name} PRIVATE ${PARAM_EXTRA_CXXFLAGS})
 
   set_target_properties(${name} PROPERTIES FOLDER "lldb libraries")
 endfunction(add_lldb_library)
 
 function(add_lldb_executable name)
   cmake_parse_arguments(ARG
     "INCLUDE_IN_SUITE;GENERATE_INSTALL"
-    ""
+    "ENTITLEMENTS"
     "LINK_LIBS;LINK_COMPONENTS"
     ${ARGN}
     )
 
   list(APPEND LLVM_LINK_COMPONENTS ${ARG_LINK_COMPONENTS})
-  add_llvm_executable(${name} ${ARG_UNPARSED_ARGUMENTS})
+  add_llvm_executable(${name} ${ARG_UNPARSED_ARGUMENTS} ENTITLEMENTS ${ARG_ENTITLEMENTS})
 
   target_link_libraries(${name} PRIVATE ${ARG_LINK_LIBS})
   set_target_properties(${name} PROPERTIES
     FOLDER "lldb executables")
 
   if(ARG_INCLUDE_IN_SUITE)
     add_dependencies(lldb-suite ${name})
     if(LLDB_BUILD_FRAMEWORK)

tools/lldb-server/CMakeLists.txt

 if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
   list(APPEND LLDB_PLUGINS lldbPluginObjectFileMachO)
 elseif(CMAKE_SYSTEM_NAME MATCHES "Windows")
   list(APPEND LLDB_PLUGINS lldbPluginObjectFilePECOFF)
 else()
   list(APPEND LLDB_PLUGINS lldbPluginObjectFileELF)
 endif()
 
+if(LLDB_USE_ENTITLEMENTS AND NOT IOS)
+  # Same entitlements file as used for debugserver
+  set(entitlements ${LLDB_SOURCE_DIR}/resources/debugserver-macosx-entitlements.plist)
+endif()
+
 add_lldb_tool(lldb-server INCLUDE_IN_SUITE
     Acceptor.cpp
     lldb-gdbserver.cpp
     lldb-platform.cpp
     lldb-server.cpp
     LLDBServerUtilities.cpp
     SystemInitializerLLGS.cpp
 
     LINK_LIBS
       lldbBase
       lldbCore
       lldbHost
       lldbInitialization
       lldbInterpreter
       ${LLDB_PLUGINS}
       ${LLDB_SYSTEM_LIBS}
 
     LINK_COMPONENTS
       Support
+
+    ENTITLEMENTS
+      ${entitlements}
 )
 
 target_link_libraries(lldb-server PRIVATE ${LLDB_SYSTEM_LIBS})