[CMake] llvm_codesign workaround for Xcode double-signing errors

[sgraenitz]

Summary

When using Xcode to build LLVM with code signing, the post-build rule is executed even if the actual build-step was skipped. This causes double-signing errors. We can currently only avoid it by passing the --force flag.

Plus some polishing for my previous patch D54443.

[sgraenitz]

One more note here about the --force parameter (which we shortly discussed in D54443): When using Xcode for testing multi-config generators, I run into double signing issues. I didn't investigate in detail yet, but I am slightly in favor of hardcoding it in the codesign invocation now.
Is it possible that Xcode runs PostBuild even if it did not actually regenerate the binary? With Ninja all goes well.

Link /path/to/xcode/RelWithDebInfo/bin/llvm-tblgen
Run custom shell script 'CMake PostBuild Rules'
  xcrun dsymutil /path/to/xcode/RelWithDebInfo/bin/llvm-tblgen
  warning: no debug symbols in executable (-arch x86_64)
  /.../usr/bin/strip -Sxl /path/to/xcode/RelWithDebInfo/bin/llvm-tblgen
  /.../usr/bin/strip: changes being made to the file will invalidate the code signature in: /path/to/xcode/RelWithDebInfo/bin/llvm-tblgen
  /.../usr/local/bin/cmake -E env CODESIGN_ALLOCATE=/.../usr/bin/codesign_allocate xcrun codesign -s lldb_codesign /path/to/xcode/RelWithDebInfo/bin/llvm-tblgen /path/to/xcode/RelWithDebInfo/bin/llvm-tblgen: is already signed
  make: *** [llvm-tblgen_buildpart_1] Error 1
  Command /bin/sh failed with exit code 2

[sgraenitz]

Add --force parameter

[sgraenitz]

Add --force flag when using the Xcode generator to avoid double-signing errors

[kubamracek]

I'd slightly prefer to use --force for *all* builds, not just Xcode builds, to have uniformity. But LGTM even in this form if you feel strongly about it.

[sgraenitz]

Ninja builds work well without it. In order to catch actual double-signing problems here, I would prefer to pass it only in case of Xcode generator.

[beanz]

Sorry for being behind on this, but I don't think this is the right solution to the problem.

I don't think we should ever pass --force. To avoid duplicate code signing when using the Xcode generator we should set the XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY target property so that Xcode actually knows what signing identity to use and can properly build the target.

[sgraenitz]

Fair enough. Will create a ticket for it. At least this works for now.

llvm/trunk/cmake/modules/AddLLVM.cmake

if(LLVM_COMMON_DEPENDS)
     # CMake issue 14747 --  add_dependencies() might be ignored to objlib's user.
     foreach(objlib ${objlibs})
       add_dependencies(${objlib} ${LLVM_COMMON_DEPENDS})
     endforeach()
   endif()
 
   if(ARG_SHARED OR ARG_MODULE)
     llvm_externalize_debuginfo(${name})
-    llvm_codesign(TARGET ${name})
+    llvm_codesign(${name})
   endif()
 endfunction()
 
 function(add_llvm_install_targets target)
   cmake_parse_arguments(ARG "" "COMPONENT;PREFIX" "DEPENDS" ${ARGN})
   if(ARG_COMPONENT)
     set(component_option -DCMAKE_INSTALL_COMPONENT="${ARG_COMPONENT}")
   endif()
macro(add_llvm_executable name)
   endif()
   if (LLVM_PTHREAD_LIB)
     # libpthreads overrides some standard library symbols, so main
     # executable must be linked with it in order to provide consistent
     # API for all shared libaries loaded by this executable.
     target_link_libraries(${name} PRIVATE ${LLVM_PTHREAD_LIB})
   endif()
 
-  llvm_codesign(TARGET ${name} ENTITLEMENTS ${ARG_ENTITLEMENTS})
+  llvm_codesign(${name} ENTITLEMENTS ${ARG_ENTITLEMENTS})
 endmacro(add_llvm_executable name)
 
 function(export_executable_symbols target)
   if (LLVM_EXPORTED_SYMBOL_FILE)
     # The symbol file should contain the symbols we want the executable to
     # export
     set_target_properties(${target} PROPERTIES ENABLE_EXPORTS 1)
   elseif (LLVM_EXPORT_SYMBOLS_FOR_PLUGINS)
else()
     add_custom_command(TARGET ${name} POST_BUILD
       COMMAND ${CMAKE_OBJCOPY} --only-keep-debug $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.debug
       ${strip_command} -R .gnu_debuglink
       COMMAND ${CMAKE_OBJCOPY} --add-gnu-debuglink=$<TARGET_FILE:${name}>.debug $<TARGET_FILE:${name}>
       )
   endif()
 endfunction()
 
-# Usage: llvm_codesign(TARGET name [ENTITLEMENTS file])
-#
-# Code-sign the given TARGET with the global LLVM_CODESIGNING_IDENTITY or skip
-# if undefined. Customize capabilities by passing a file path to ENTITLEMENTS.
-#
-function(llvm_codesign)
-  cmake_parse_arguments(ARG "" "TARGET;ENTITLEMENTS" "" ${ARGN})
+# Usage: llvm_codesign(name [ENTITLEMENTS file])
+function(llvm_codesign name)
+  cmake_parse_arguments(ARG "" "ENTITLEMENTS" "" ${ARGN})
 
   if(NOT LLVM_CODESIGNING_IDENTITY)
     return()
   endif()
 
   if(APPLE)
     if(NOT CMAKE_CODESIGN)
       set(CMAKE_CODESIGN xcrun codesign)
     endif()
     if(NOT CMAKE_CODESIGN_ALLOCATE)
       execute_process(
         COMMAND xcrun -f codesign_allocate
         OUTPUT_STRIP_TRAILING_WHITESPACE
         OUTPUT_VARIABLE CMAKE_CODESIGN_ALLOCATE
       )
     endif()
     if(DEFINED ARG_ENTITLEMENTS)
-      set(PASS_ENTITLEMENTS --entitlements ${ARG_ENTITLEMENTS})
+      set(pass_entitlements --entitlements ${ARG_ENTITLEMENTS})
+    endif()
+    if(CMAKE_GENERATOR STREQUAL "Xcode")
+      # Avoid double-signing error: Since output overwrites input, Xcode runs
+      # the post-build rule even if the actual build-step was skipped.
+      set(pass_force --force)
     endif()
 
     add_custom_command(
-      TARGET ${ARG_TARGET} POST_BUILD
+      TARGET ${name} POST_BUILD
       COMMAND ${CMAKE_COMMAND} -E
               env CODESIGN_ALLOCATE=${CMAKE_CODESIGN_ALLOCATE}
               ${CMAKE_CODESIGN} -s ${LLVM_CODESIGNING_IDENTITY}
-              ${PASS_ENTITLEMENTS} $<TARGET_FILE:${ARG_TARGET}>
+              ${pass_entitlements} ${pass_force} $<TARGET_FILE:${name}>
     )
   endif()
 endfunction()
 
 function(llvm_setup_rpath name)
   if(CMAKE_INSTALL_RPATH)
     return()
   endif()