[CMake] Streamline code signing for debugserver #2

[sgraenitz]

Summary

The first patch had to be reverted as I missed a few details. This review continues from https://reviews.llvm.org/D54476 and I will add the required fixes.

Change log:

• Use llvm_codesign to sign debugserver with entitlements.
• Set global LLVM_CODESIGNING_IDENTITY from LLDB_CODESIGN_IDENTITY (if given).
• Pass through ENTITLEMENTS from add_lldb_executable to add_llvm_executable.
• Handle reconfigurations correctly.

We have a lot of cases, make them explicit:

(1) build and sign debugserver, if all conditions apply:

• LLDB_NO_DEBUGSERVER=OFF (default)
• On Darwin: LLDB_USE_SYSTEM_DEBUGSERVER=OFF (default)
• On Darwin: LLVM_CODESIGNING_IDENTITY == lldb_codesign

(2) use system debugserver, if on Darwin and any of:

• LLDB_USE_SYSTEM_DEBUGSERVER=ON and found on system (explicit case)
• LLVM_CODESIGNING_IDENTITY != lldb_codesign and found on system (fallback case)

(3) debugserver will not be available, in case of:

• LLDB_NO_DEBUGSERVER=ON
• On Darwin: LLVM_CODESIGNING_IDENTITY != lldb_codesign and not found on system

(4) error state, in case of:

• LLDB_USE_SYSTEM_DEBUGSERVER=ON and not found on system
• LLDB_USE_SYSTEM_DEBUGSERVER=ON and LLDB_NO_DEBUGSERVER=ON

[sgraenitz]

Fix target directory for debugserver: it must not be LLVM_TOOLS_BINARY_DIR but LLVM_RUNTIME_OUTPUT_INTDIR. It's a difference in standalone builds of LLDB. LLVM_TOOLS_BINARY_DIR was wrong here as it points to the binary directory in the detached LLVM build tree. It should make no difference for in-tree builds.

[sgraenitz]

The default identity for code signing must be lldb_codesign. Also remove the comment to deprecate LLDB_CODESIGN_IDENTITY in favor of LLVM_CODESIGNING_IDENTITY.

[sgraenitz]

Move code sign settings to LLDBConfig.cmake + polishing

CMakeLists.txt

 cmake_minimum_required(VERSION 3.4.3)
 
 # Add path for custom modules
 set(CMAKE_MODULE_PATH
   ${CMAKE_MODULE_PATH}
   "${CMAKE_CURRENT_SOURCE_DIR}/cmake"
   "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules"
   )
 
 include(LLDBStandalone)
 include(LLDBConfig)
 include(AddLLDB)
 
-option(LLDB_USE_ENTITLEMENTS "When codesigning, use entitlements if available" ON)
-set(LLDB_CODESIGN_IDENTITY lldb_codesign CACHE STRING
-    "Identity for code signing debugserver (Darwin only)")
-
-if(LLDB_CODESIGN_IDENTITY)
-  set(LLVM_CODESIGNING_IDENTITY ${LLDB_CODESIGN_IDENTITY} CACHE STRING "" FORCE)
-endif()
-
 # Define the LLDB_CONFIGURATION_xxx matching the build type
 if( uppercase_CMAKE_BUILD_TYPE STREQUAL "DEBUG" )
   add_definitions( -DLLDB_CONFIGURATION_DEBUG )
 else()
   add_definitions( -DLLDB_CONFIGURATION_RELEASE )
 endif()
 
 if (CMAKE_SYSTEM_NAME MATCHES "Windows|Android")

cmake/modules/LLDBConfig.cmake

 if ((NOT MSVC) OR MSVC12)
   add_definitions( -DHAVE_ROUND )
 endif()
 
 if (LLDB_DISABLE_CURSES)
   add_definitions( -DLLDB_DISABLE_CURSES )
 endif()
 
+option(LLDB_USE_ENTITLEMENTS "When code signing, use entitlements if available" ON)
+set(LLDB_CODESIGN_IDENTITY lldb_codesign CACHE STRING
+    "Identity for code signing debugserver (Darwin only)")
+
+if(LLDB_CODESIGN_IDENTITY)
+  set(LLVM_CODESIGNING_IDENTITY ${LLDB_CODESIGN_IDENTITY} CACHE STRING "" FORCE)
+endif()
+
 # On Windows, we can't use the normal FindPythonLibs module that comes with CMake,
 # for a number of reasons.
 # 1) Prior to MSVC 2015, it is only possible to embed Python if python itself was
 #    compiled with an identical version (and build configuration) of MSVC as LLDB.
 #    The standard algorithm does not take into account the differences between
 #    a binary release distribution of python and a custom built distribution.
 # 2) From MSVC 2015 and onwards, it is only possible to use Python 3.5 or later.
 # 3) FindPythonLibs queries the registry to locate Python, and when looking for a

tools/debugserver/CMakeLists.txt

set(CMAKE_MODULE_PATH
     )
 
   include(LLDBStandalone)
   include(AddLLDB)
 
   set(LLDB_SOURCE_DIR "${CMAKE_SOURCE_DIR}/../../")
   include_directories(${LLDB_SOURCE_DIR}/include)
 
-  option(LLDB_USE_ENTITLEMENTS "When codesigning, use entitlements if available" ON)
+  option(LLDB_USE_ENTITLEMENTS "When code signing, use entitlements if available" ON)
   set(LLDB_CODESIGN_IDENTITY lldb_codesign CACHE STRING
       "Identity for code signing debugserver (Darwin only)")
 
   if(LLDB_CODESIGN_IDENTITY)
     set(LLVM_CODESIGNING_IDENTITY ${LLDB_CODESIGN_IDENTITY} CACHE STRING "" FORCE)
   endif()
 endif()
 
 add_subdirectory(source)

tools/debugserver/source/CMakeLists.txt

else()
     set(LLDB_USE_SYSTEM_DEBUGSERVER OFF CACHE BOOL "" FORCE)
   endif()
 elseif(NOT LLDB_NO_DEBUGSERVER)
   # Default case: on Darwin we need the right code signing ID.
   # See lldb/docs/code-signing.txt for details.
   if(CMAKE_HOST_APPLE AND NOT LLVM_CODESIGNING_IDENTITY STREQUAL "lldb_codesign")
     set(msg "Cannot code sign debugserver with identity '${LLVM_CODESIGNING_IDENTITY}'.")
     if(system_debugserver)
-      message(WARNING "${msg} Will fall back to system's debugserver.")
+      message(WARNING "${msg} Will fall back to copy system's debugserver.")
       set(use_system_debugserver ON)
     else()
       message(WARNING "${msg} debugserver will not be available.")
     endif()
   else()
     set(build_and_sign_debugserver ON)
   endif()
 endif()