[CMake] Streamline code signing for debugserver #2

[sgraenitz]

Summary

Major fixes after D54476 (use Diff1 as base for comparison to see only recent changes):

• In standalone builds target directory for debugserver must be LLDB's bin, not LLVM's bin
• Default identity for code signing must not force-override LLVM_CODESIGNING_IDENTITY globally

We have a lot of cases, make them explicit:

• ID used for code signing (debugserver and in tests):
  • LLDB_CODESIGN_IDENTITY if set explicitly, or otherwise
  • LLVM_CODESIGNING_IDENTITY if set explicitly, or otherwise
  • lldb_codesign as the default

• On Darwin we have a debugserver target that:
  1. we build and sign if:
     1. LLDB_NO_DEBUGSERVER=OFF (default) && LLDB_USE_SYSTEM_DEBUGSERVER=OFF (default) && code signing ID == lldb_codesign
  2. we copy from the system if:
     1. LLDB_USE_SYSTEM_DEBUGSERVER=ON and found on system (explicit case)
     2. code signing ID != lldb_codesign and found on system (fallback case)
  3. will not be available if
     1. LLDB_NO_DEBUGSERVER=ON
     2. code signing ID != lldb_codesign and not found on system

• On other systems, the debugserver target is not defined, which is equivalent to [3A]

Common configurations on Darwin:

• [1A] cmake -GNinja ../llvm builds debugserver from source and signs with lldb_codesign, no code signing for other binaries (prints status: lldb debugserver: /path/to/bin/debugserver)
• [1A] cmake -GNinja -DLLVM_CODESIGNING_IDENTITY=- -DLLDB_CODESIGN_IDENTITY=lldb_codesign ../llvm builds debugserver from source and signs with lldb_codesign, ad-hoc code signing for other binaries (prints status: lldb debugserver: /path/to/bin/debugserver)
• [2A] cmake -GNinja -DLLVM_CODESIGNING_IDENTITY=- -DLLDB_USE_SYSTEM_DEBUGSERVER=ON ../llvm copies debugserver from system, ad-hoc code signing for other binaries (prints status: Copy system debugserver from: /path/to/system/debugserver)
• [2B] cmake -GNinja -DLLVM_CODESIGNING_IDENTITY=- ../llvm same, but prints additional warning: Cannot code sign debugserver with identity '-'. Will fall back to system's debugserver.
• [3A] cmake -GNinja -DLLVM_CODESIGNING_IDENTITY=- -DLLDB_NO_DEBUGSERVER=ON ../llvm debugserver not available (prints status: lldb debugserver will not be available)

[sgraenitz]

Fix target directory for debugserver: it must not be LLVM_TOOLS_BINARY_DIR but LLVM_RUNTIME_OUTPUT_INTDIR. It's a difference in standalone builds of LLDB. LLVM_TOOLS_BINARY_DIR was wrong here as it points to the binary directory in the detached LLVM build tree. It should make no difference for in-tree builds.

[sgraenitz]

Default identity for code signing must be lldb_codesign. Also remove the comment to deprecate LLDB_CODESIGN_IDENTITY in favor of LLVM_CODESIGNING_IDENTITY.

[sgraenitz]

Move code sign settings to LLDBConfig.cmake

[JDevlieghere]

tools/debugserver/CMakeLists.txt

18 ↗

(On Diff #175739)

Why do we need to define this option again for the debugserver? Why can't it use the one from LLDBConfig.cmake?

[sgraenitz]

Thanks for having a look.

tools/debugserver/CMakeLists.txt

18 ↗

(On Diff #175739)

In a debugserver standalone build we don't include(LLDBConfig). It makes sense to me, because there is not much to configure when only building the debugserver.

[sgraenitz]

In-tree builds look good now. I successfully built and tested with these configurations:

green dragon: xcrun cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_ASSERTIONS=On -DLLVM_ENABLE_MODULES=On ../llvm
my default: xcrun cmake -GNinja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64" ../llvm

Had a short look at standalone builds. Including the test suite is currently not supported. With this config I could build the binaries successfully (with a quick-fix for debugserver D55032):

LLDB standalone: xcrun cmake -GNinja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64" -DLLVM_CONFIG=/path/to/llvm-build/llvm-config ../lldb
debugserver standalone: xcrun cmake -GNinja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64" -DLLVM_CONFIG=/path/to/llvm-build/bin/llvm-config ../lldb/tools/debugserver

[JDevlieghere]

tools/debugserver/CMakeLists.txt

18 ↗

(On Diff #175739)

Makes sense. Maybe we could put this in the top level CMakeLists.txt?

[sgraenitz]

tools/debugserver/CMakeLists.txt

18 ↗

(On Diff #175739)

This is the top level CMakeLists.txt for standalone debugserver :) See my previous comment about testing.

[JDevlieghere]

LGTM. Thanks!

tools/debugserver/CMakeLists.txt

18 ↗

(On Diff #175739)

Thanks. I'm not super excited about duplicating the variables but I understand why it's needed. I think long term it'd be great if we could extract some stuff form the top-level cmake file and just make it dispatch things, but that's beyond the scope of what you're doing right now.

[sgraenitz]

Avoid conflicts: updating diff for recent changes on master

[sgraenitz]

Avoid force-overwriting of LLVM_CODESIGNING_IDENTITY

[sgraenitz]

Sorry for editing this again, but D55328 brought up an important change request (see https://reviews.llvm.org/D55328#anchor-1322655) and I only realized this side-effect afterwards: adding LLDB to a LLVM build tree (all with default configurations), would have caused all binaries to be signed with the lldb_codesign identity. This is clearly not intended. The modified summary now outlines the identity handling in more detail. @labath thanks for bringing up your concerns, I did the change here and will adjust the other review.

[sgraenitz]

CMakeLists.txt

141 ↗

(On Diff #177486)

If we have a debugserver target, tests should depend on it (either copy or build).

tools/debugserver/CMakeLists.txt

18 ↗

(On Diff #175739)

Less duplication as LLDB_CODESIGN_IDENTITY went back to debugserver CMakeLists.txt

tools/debugserver/source/CMakeLists.txt

109 ↗

(On Diff #177486)

New logic for code sign identity. Using a separate cache variable to avoid varying behavior on reconfigurations.

[labath]

This looks much better. Thanks.

tools/debugserver/source/CMakeLists.txt

104 ↗

(On Diff #177486)

Could you also mark this as internal, to avoid it showing up in the GUIs and such.

[sgraenitz]

Turn LLDB_CODESIGN_IDENTITY_USED variable from STRING into INTERNAL

lldb/trunk/CMakeLists.txt

if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
     list(APPEND LLDB_TEST_DEPS darwin-debug)
   endif()
 
   if(TARGET lldb-server)
     list(APPEND LLDB_TEST_DEPS lldb-server)
   endif()
 
   if(TARGET debugserver)
-    if(NOT CMAKE_HOST_APPLE OR LLDB_CODESIGN_IDENTITY)
-      list(APPEND LLDB_TEST_DEPS debugserver)
-    endif()
-  endif()
 
   if(TARGET lldb-mi)
     list(APPEND LLDB_TEST_DEPS lldb-mi)
   endif()
 
   if(NOT LLDB_BUILT_STANDALONE)
     list(APPEND LLDB_TEST_DEPS yaml2obj)
   endif()

lldb/trunk/cmake/modules/AddLLDB.cmake

function(add_lldb_library name)
   target_compile_options(${name} PRIVATE ${PARAM_EXTRA_CXXFLAGS})
 
   set_target_properties(${name} PROPERTIES FOLDER "lldb libraries")
 endfunction(add_lldb_library)
 
 function(add_lldb_executable name)
   cmake_parse_arguments(ARG
     "INCLUDE_IN_SUITE;GENERATE_INSTALL"
-    ""
+    "ENTITLEMENTS"
     "LINK_LIBS;LINK_COMPONENTS"
     ${ARGN}
     )
 
   list(APPEND LLVM_LINK_COMPONENTS ${ARG_LINK_COMPONENTS})
-  add_llvm_executable(${name} ${ARG_UNPARSED_ARGUMENTS})
+  add_llvm_executable(${name} ${ARG_UNPARSED_ARGUMENTS} ENTITLEMENTS ${ARG_ENTITLEMENTS})
 
   target_link_libraries(${name} PRIVATE ${ARG_LINK_LIBS})
   set_target_properties(${name} PROPERTIES
     FOLDER "lldb executables")
 
   if(ARG_INCLUDE_IN_SUITE)
     add_dependencies(lldb-suite ${name})
     if(LLDB_BUILD_FRAMEWORK)

lldb/trunk/cmake/modules/LLDBConfig.cmake

 if ((NOT MSVC) OR MSVC12)
   add_definitions( -DHAVE_ROUND )
 endif()
 
 if (LLDB_DISABLE_CURSES)
   add_definitions( -DLLDB_DISABLE_CURSES )
 endif()
 
+option(LLDB_USE_ENTITLEMENTS "When code signing, use entitlements if available" ON)
+
 # On Windows, we can't use the normal FindPythonLibs module that comes with CMake,
 # for a number of reasons.
 # 1) Prior to MSVC 2015, it is only possible to embed Python if python itself was
 #    compiled with an identical version (and build configuration) of MSVC as LLDB.
 #    The standard algorithm does not take into account the differences between
 #    a binary release distribution of python and a custom built distribution.
 # 2) From MSVC 2015 and onwards, it is only possible to use Python 3.5 or later.
 # 3) FindPythonLibs queries the registry to locate Python, and when looking for a

lldb/trunk/test/CMakeLists.txt

if (LLDB_TEST_DEBUG_TEST_CRASHES)
     set(LLDB_TEST_COMMON_ARGS ${LLDB_TEST_COMMON_ARGS} --enable-crash-dialog)
   endif()
 
   if (NOT LLDB_TEST_HIDE_CONSOLE_WINDOWS)
     set(LLDB_TEST_COMMON_ARGS ${LLDB_TEST_COMMON_ARGS} --show-inferior-console)
   endif()
 endif()
 
-if(LLDB_CODESIGN_IDENTITY)
-  list(APPEND LLDB_TEST_COMMON_ARGS --codesign-identity "${LLDB_CODESIGN_IDENTITY}")
+if(LLDB_CODESIGN_IDENTITY_USED)
+  list(APPEND LLDB_TEST_COMMON_ARGS --codesign-identity "${LLDB_CODESIGN_IDENTITY_USED}")
 endif()
 
 if(LLDB_BUILD_FRAMEWORK)
   list(APPEND LLDB_TEST_COMMON_ARGS --framework ${LLDB_FRAMEWORK_DIR}/LLDB.framework)
 endif()
 
 if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Windows|Darwin")
   list(APPEND LLDB_TEST_COMMON_ARGS
     --env ARCHIVER=${CMAKE_AR} --env OBJCOPY=${CMAKE_OBJCOPY})
 endif()
 
 if (NOT "${LLDB_LIT_TOOLS_DIR}" STREQUAL "")
   if (NOT EXISTS "${LLDB_LIT_TOOLS_DIR}")
     message(WARNING "LLDB_LIT_TOOLS_DIR ${LLDB_LIT_TOOLS_DIR} does not exist.")
   endif()
 endif()
 
-if(CMAKE_HOST_APPLE)
+if(CMAKE_HOST_APPLE AND DEBUGSERVER_PATH)
   list(APPEND LLDB_TEST_COMMON_ARGS --server ${DEBUGSERVER_PATH})
 endif()
 
-if(SKIP_DEBUGSERVER)
+if(SKIP_TEST_DEBUGSERVER)
   list(APPEND LLDB_TEST_COMMON_ARGS --out-of-tree-debugserver)
 endif()
 
 set(LLDB_DOTEST_ARGS ${LLDB_TEST_COMMON_ARGS};${LLDB_TEST_USER_ARGS})
 set_property(GLOBAL PROPERTY LLDB_DOTEST_ARGS_PROPERTY ${LLDB_DOTEST_ARGS})
 
 add_python_test_target(check-lldb-single
   ${LLDB_SOURCE_DIR}/test/dotest.py

lldb/trunk/tools/debugserver/CMakeLists.txt

set(CMAKE_MODULE_PATH
     )
 
   include(LLDBStandalone)
   include(AddLLDB)
 
   set(LLDB_SOURCE_DIR "${CMAKE_SOURCE_DIR}/../../")
   include_directories(${LLDB_SOURCE_DIR}/include)
 
+  option(LLDB_USE_ENTITLEMENTS "When code signing, use entitlements if available" ON)
+
   # lldb-suite is a dummy target that encompasses all the necessary tools and
   # libraries for building a fully-functioning liblldb.
   add_custom_target(lldb-suite)
   set(LLDB_SUITE_TARGET lldb-suite)
 endif()
 
 add_subdirectory(source)

lldb/trunk/tools/debugserver/source/CMakeLists.txt

set(lldbDebugserverCommonSources
   MacOSX/MachVMMemory.cpp
   MacOSX/MachVMRegion.cpp
   MacOSX/OsLogger.cpp
   ${generated_mach_interfaces}
   ${DEBUGSERVER_VERS_GENERATED_FILE})
 
 add_library(lldbDebugserverCommon ${lldbDebugserverCommonSources})
 
+# LLDB-specific identity, currently used for code signing debugserver.
+set(LLDB_CODESIGN_IDENTITY "" CACHE STRING
+    "Override code sign identity for debugserver and for use in tests; falls back to LLVM_CODESIGNING_IDENTITY if set or lldb_codesign otherwise (Darwin only)")
+
+# Determine which identity to use and store it in the separate cache entry.
+# We will query it later for LLDB_TEST_COMMON_ARGS.
+if(LLDB_CODESIGN_IDENTITY)
+  set(LLDB_CODESIGN_IDENTITY_USED ${LLDB_CODESIGN_IDENTITY} CACHE INTERNAL "" FORCE)
+elseif(LLVM_CODESIGNING_IDENTITY)
+  set(LLDB_CODESIGN_IDENTITY_USED ${LLVM_CODESIGNING_IDENTITY} CACHE INTERNAL "" FORCE)
+else()
+  set(LLDB_CODESIGN_IDENTITY_USED lldb_codesign CACHE INTERNAL "" FORCE)
+endif()
 
-set(LLDB_CODESIGN_IDENTITY "lldb_codesign"
-  CACHE STRING "Identity used for code signing. Set to empty string to skip the signing step.")
+# Override locally, so the identity is used for targets created in this scope.
+set(LLVM_CODESIGNING_IDENTITY ${LLDB_CODESIGN_IDENTITY_USED})
 
-if(NOT LLDB_CODESIGN_IDENTITY STREQUAL "")
-  set(DEBUGSERVER_PATH ${LLVM_RUNTIME_OUTPUT_INTDIR}/debugserver${CMAKE_EXECUTABLE_SUFFIX} CACHE PATH "Path to debugserver.")
-  set(SKIP_DEBUGSERVER OFF CACHE BOOL "Skip building the in-tree debug server")
-else()
+option(LLDB_NO_DEBUGSERVER "Disable the debugserver target" OFF)
+option(LLDB_USE_SYSTEM_DEBUGSERVER "Use the system's debugserver instead of building it from source (Darwin only)." OFF)
+
+# Incompatible options
+if(LLDB_NO_DEBUGSERVER AND LLDB_USE_SYSTEM_DEBUGSERVER)
+  message(FATAL_ERROR "Inconsistent options: LLDB_NO_DEBUGSERVER and LLDB_USE_SYSTEM_DEBUGSERVER")
+endif()
+
+# Try to locate the system debugserver.
+# Subsequent feasibility checks depend on it.
+if(APPLE AND CMAKE_HOST_APPLE)
   execute_process(
     COMMAND xcode-select -p
-    OUTPUT_VARIABLE XCODE_DEV_DIR)
-  string(STRIP ${XCODE_DEV_DIR} XCODE_DEV_DIR)
-  if(EXISTS "${XCODE_DEV_DIR}/../SharedFrameworks/LLDB.framework/")
-    set(DEBUGSERVER_PATH
-      "${XCODE_DEV_DIR}/../SharedFrameworks/LLDB.framework/Resources/debugserver" CACHE PATH "Path to debugserver.")
-  elseif(EXISTS "${XCODE_DEV_DIR}/Library/PrivateFrameworks/LLDB.framework/")
-    set(DEBUGSERVER_PATH
-      "${XCODE_DEV_DIR}/Library/PrivateFrameworks/LLDB.framework/Resources/debugserver" CACHE PATH "Path to debugserver.")
+    OUTPUT_VARIABLE xcode_dev_dir)
+  string(STRIP ${xcode_dev_dir} xcode_dev_dir)
+
+  set(debugserver_rel_path "LLDB.framework/Resources/debugserver")
+  set(debugserver_shared "${xcode_dev_dir}/../SharedFrameworks/${debugserver_rel_path}")
+  set(debugserver_private "${xcode_dev_dir}/Library/PrivateFrameworks/${debugserver_rel_path}")
+
+  if(EXISTS ${debugserver_shared})
+    set(system_debugserver ${debugserver_shared})
+  elseif(EXISTS ${debugserver_private})
+    set(system_debugserver ${debugserver_private})
+  endif()
+endif()
+
+# Handle unavailability
+if(LLDB_USE_SYSTEM_DEBUGSERVER)
+  if(system_debugserver)
+    set(use_system_debugserver ON)
+  elseif(APPLE AND CMAKE_HOST_APPLE)
+    # Binary not found on system. Keep cached variable, to try again on reconfigure.
+    message(SEND_ERROR
+      "LLDB_USE_SYSTEM_DEBUGSERVER option set, but no debugserver found in:\
+        ${debugserver_shared}\
+        ${debugserver_private}")
+  else()
+    # Non-Apple target platform or non-Darwin host. Reset invalid cached variable.
+    message(WARNING "Reverting invalid option LLDB_USE_SYSTEM_DEBUGSERVER (Darwin only)")
+    set(LLDB_USE_SYSTEM_DEBUGSERVER OFF CACHE BOOL "" FORCE)
+  endif()
+elseif(NOT LLDB_NO_DEBUGSERVER)
+  # Default case: on Darwin we need the right code signing ID.
+  # See lldb/docs/code-signing.txt for details.
+  if(CMAKE_HOST_APPLE AND NOT LLVM_CODESIGNING_IDENTITY STREQUAL "lldb_codesign")
+    set(problem "Cannot code sign debugserver with LLVM_CODESIGNING_IDENTITY '${LLVM_CODESIGNING_IDENTITY}'.")
+    set(advice "Pass -DLLDB_CODESIGN_IDENTITY=lldb_codesign to override the LLVM value for debugserver.")
+    if(system_debugserver)
+      set(effect "Will fall back to system's debugserver.")
+      set(use_system_debugserver ON)
+    else()
+      set(effect "debugserver will not be available.")
+    endif()
+    message(WARNING "${problem} ${effect} ${advice}")
   else()
-    message(SEND_ERROR "Cannot find debugserver on system.")
+    set(build_and_sign_debugserver ON)
   endif()
-  set(SKIP_DEBUGSERVER ON CACHE BOOL "Skip building the in-tree debug server")
 endif()
-message(STATUS "Path to the lldb debugserver: ${DEBUGSERVER_PATH}")
+
+# TODO: We don't use the $<TARGET_FILE:debugserver> generator expression here,
+# because the value of DEBUGSERVER_PATH is used to build LLDB_DOTEST_ARGS,
+# which is used for configuring lldb-dotest.in, which does not have a generator
+# step at the moment.
+set(default_debugserver_path "${LLVM_RUNTIME_OUTPUT_INTDIR}/debugserver${CMAKE_EXECUTABLE_SUFFIX}")
+
+# Remember where debugserver binary goes and whether or not we have to test it.
+set(DEBUGSERVER_PATH "" CACHE FILEPATH "Path to debugserver")
+set(SKIP_TEST_DEBUGSERVER OFF CACHE BOOL "Building the in-tree debugserver was skipped")
+
+# Reset values in all cases in order to correctly support reconfigurations.
+if(use_system_debugserver)
+  add_custom_target(debugserver
+    COMMAND ${CMAKE_COMMAND} -E copy_if_different
+            ${system_debugserver} ${LLVM_RUNTIME_OUTPUT_INTDIR}
+    COMMENT "Copying the system debugserver to LLDB's binaries directory.")
+
+  # Don't test debugserver itself.
+  # Tests that require debugserver will use the copy.
+  set(DEBUGSERVER_PATH ${default_debugserver_path} CACHE FILEPATH "" FORCE)
+  set(SKIP_TEST_DEBUGSERVER ON CACHE BOOL "" FORCE)
+
+  message(STATUS "Copy system debugserver from: ${system_debugserver}")
+elseif(build_and_sign_debugserver)
+  # Build, sign and test debugserver (below)
+  set(DEBUGSERVER_PATH ${default_debugserver_path} CACHE FILEPATH "" FORCE)
+  set(SKIP_TEST_DEBUGSERVER OFF CACHE BOOL "" FORCE)
+
+  message(STATUS "lldb debugserver: ${DEBUGSERVER_PATH}")
+else()
+  # No tests for debugserver, no tests that require it.
+  set(DEBUGSERVER_PATH "" CACHE FILEPATH "" FORCE)
+  set(SKIP_TEST_DEBUGSERVER ON CACHE BOOL "" FORCE)
+
+  message(STATUS "lldb debugserver will not be available.")
+endif()
 
-if (APPLE)
+if(APPLE)
   if(IOS)
     find_library(BACKBOARD_LIBRARY BackBoardServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)
     find_library(FRONTBOARD_LIBRARY FrontBoardServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)
     find_library(SPRINGBOARD_LIBRARY SpringBoardServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)
     find_library(MOBILESERVICES_LIBRARY MobileCoreServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)
     find_library(LOCKDOWN_LIBRARY lockdown)
 
     if(NOT BACKBOARD_LIBRARY)
-      set(SKIP_DEBUGSERVER ON CACHE BOOL "Skip building the in-tree debug server" FORCE)
+      set(SKIP_TEST_DEBUGSERVER ON CACHE BOOL "" FORCE)
     endif()
   else()
     find_library(COCOA_LIBRARY Cocoa)
   endif()
 endif()
 
 if(HAVE_LIBCOMPRESSION)
   set(LIBCOMPRESSION compression)
 endif()
 
-if(NOT SKIP_DEBUGSERVER)
+if(LLDB_USE_ENTITLEMENTS)
+  if(IOS)
+    set(entitlements ${CMAKE_CURRENT_SOURCE_DIR}/debugserver-entitlements.plist)
+  else()
+    # Same entitlements file as used for lldb-server
+    set(entitlements ${LLDB_SOURCE_DIR}/resources/debugserver-macosx-entitlements.plist)
+  endif()
+endif()
+
+if(build_and_sign_debugserver)
   target_link_libraries(lldbDebugserverCommon
                         INTERFACE ${COCOA_LIBRARY}
                         ${CORE_FOUNDATION_LIBRARY}
                         ${FOUNDATION_LIBRARY}
                         ${BACKBOARD_LIBRARY}
                         ${FRONTBOARD_LIBRARY}
                         ${SPRINGBOARD_LIBRARY}
                         ${MOBILESERVICES_LIBRARY}
                         ${LOCKDOWN_LIBRARY}
                         lldbDebugserverArchSupport
                         lldbDebugserverDarwin_DarwinLog
                         ${LIBCOMPRESSION})
   if(HAVE_LIBCOMPRESSION)
     set_property(TARGET lldbDebugserverCommon APPEND PROPERTY
                  COMPILE_DEFINITIONS HAVE_LIBCOMPRESSION)
   endif()
   set(LLVM_OPTIONAL_SOURCES ${lldbDebugserverCommonSources})
   add_lldb_tool(debugserver INCLUDE_IN_SUITE
     debugserver.cpp
 
     LINK_LIBS
       lldbDebugserverCommon
+
+    ENTITLEMENTS
+      ${entitlements}
     )
   if(IOS)
     set_property(TARGET lldbDebugserverCommon APPEND PROPERTY COMPILE_DEFINITIONS
       WITH_LOCKDOWN
       WITH_FBS
       WITH_BKS
       )
     set_property(TARGET debugserver APPEND PROPERTY COMPILE_DEFINITIONS
set_property(TARGET lldbDebugserverCommon_NonUI APPEND PROPERTY
                  COMPILE_DEFINITIONS HAVE_LIBCOMPRESSION)
   endif()
 
   add_lldb_tool(debugserver-nonui
     debugserver.cpp
 
     LINK_LIBS
       lldbDebugserverCommon_NonUI
-    )
-endif()
 
-set(entitlements_xml ${CMAKE_CURRENT_SOURCE_DIR}/debugserver-macosx-entitlements.plist)
-if(IOS)
-  set(entitlements_xml ${CMAKE_CURRENT_SOURCE_DIR}/debugserver-entitlements.plist)
-else()
-  set(entitlements_xml ${CMAKE_CURRENT_SOURCE_DIR}/../../../resources/debugserver-macosx-entitlements.plist)
-endif()
-
-set(LLDB_USE_ENTITLEMENTS_Default On)
-option(LLDB_USE_ENTITLEMENTS "Use entitlements when codesigning (Defaults Off when using lldb_codesign identity, otherwise On)" ${LLDB_USE_ENTITLEMENTS_Default})
-
-if (SKIP_DEBUGSERVER)
-  if (CMAKE_HOST_APPLE)
-    # If we haven't built a signed debugserver, copy the one from the system.
-    add_custom_target(debugserver
-      COMMAND ${CMAKE_COMMAND} -E copy_if_different ${DEBUGSERVER_PATH} ${CMAKE_BINARY_DIR}/bin
-      VERBATIM
-      COMMENT "Copying the system debugserver to LLDB's binaries directory.")
-  endif()
-else()
-  if(LLDB_USE_ENTITLEMENTS)
-    set(entitlements_flags --entitlements ${entitlements_xml})
-  endif()
-  execute_process(
-    COMMAND xcrun -f codesign_allocate
-    OUTPUT_STRIP_TRAILING_WHITESPACE
-    OUTPUT_VARIABLE CODESIGN_ALLOCATE
-    )
-  add_custom_command(TARGET debugserver
-    POST_BUILD
-    COMMAND ${CMAKE_COMMAND} -E env CODESIGN_ALLOCATE=${CODESIGN_ALLOCATE}
-            codesign --force --sign ${LLDB_CODESIGN_IDENTITY}
-            ${entitlements_flags}
-            $<TARGET_FILE:debugserver>
+    ENTITLEMENTS
+      ${entitlements}
     )
-  if(IOS)
-    add_custom_command(TARGET debugserver-nonui
-      POST_BUILD
-      COMMAND ${CMAKE_COMMAND} -E env CODESIGN_ALLOCATE=${CODESIGN_ALLOCATE}
-              codesign --force --sign ${LLDB_CODESIGN_IDENTITY}
-              ${entitlements_flags}
-              $<TARGET_FILE:debugserver>
-    )
-  endif()
 endif()
-
-
-
-

lldb/trunk/unittests/tools/CMakeLists.txt

 if(CMAKE_SYSTEM_NAME MATCHES "Android|Darwin|Linux|NetBSD")
-  if ((CMAKE_SYSTEM_NAME MATCHES "Darwin" AND SKIP_DEBUGSERVER) OR (NOT CMAKE_SYSTEM_NAME MATCHES "Darwin" AND SKIP_LLDB_SERVER_BUILD))
+  if ((CMAKE_SYSTEM_NAME MATCHES "Darwin" AND SKIP_TEST_DEBUGSERVER) OR (NOT CMAKE_SYSTEM_NAME MATCHES "Darwin" AND SKIP_LLDB_SERVER_BUILD))
     # These tests are meant to test lldb-server/debugserver in isolation, and
     # don't provide any value if run against a server copied from somewhere.
   else()
     add_subdirectory(lldb-server)
   endif()
 endif()

lldb/trunk/unittests/tools/lldb-server/CMakeLists.txt

 set(ALL_LLDB_TEST_EXECUTABLES)
 
 function(add_lldb_test_executable test_name)
   set(EXCLUDE_FROM_ALL ON)
   add_llvm_executable(${test_name} NO_INSTALL_RPATH ${ARGN})
   set(outdir ${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_CFG_INTDIR})
   set_output_directory(${test_name} BINARY_DIR ${outdir} LIBRARY_DIR ${outdir})
   list(APPEND ALL_LLDB_TEST_EXECUTABLES ${test_name})
   set(ALL_LLDB_TEST_EXECUTABLES ${ALL_LLDB_TEST_EXECUTABLES} PARENT_SCOPE)
 endfunction()
 
 add_lldb_test_executable(thread_inferior inferior/thread_inferior.cpp)
 add_lldb_test_executable(environment_check inferior/environment_check.cpp)
 
-if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
+if(DEBUGSERVER_PATH)
   add_definitions(-DLLDB_SERVER="${DEBUGSERVER_PATH}" -DLLDB_SERVER_IS_DEBUGSERVER=1)
 else()
   add_definitions(-DLLDB_SERVER="$<TARGET_FILE:lldb-server>" -DLLDB_SERVER_IS_DEBUGSERVER=0)
 endif()
 
 add_definitions(
   -DLLDB_TEST_INFERIOR_PATH="${CMAKE_CURRENT_BINARY_DIR}/${CMAKE_CFG_INTDIR}"
   -DLLDB_TEST_INFERIOR_SUFFIX="${CMAKE_EXECUTABLE_SUFFIX}"
   )
 add_subdirectory(tests)