Support codesigning bundles and forcing

[beanz]

Summary

Clangd's framework is assembled by copying binaries from the lib and bin directories into a bundle shape. This results in an invalid bundle code signature because the signature only applies to the binaries not the resources.

This patch adds two new options to llvm_codesign to enable re-signing the library and XPC service as bundles.

The BUNDLE_PATH option allow specifying an explicit path to codesign, which enables signing bundles which aren't generated using CMake's FRAMEWORK or BUNDLE target properties.

The FORCE option allows re-signing binaries that have already been signed. This is required for how clangd exposes the clangd library and tools as both XPC and non-XPC services using the same binary.

[bogner]

Seems straightforward enough

clang-tools-extra/trunk/clangd/xpc/cmake/modules/CreateClangdXPCFramework.cmake

macro(create_clangd_xpc_framework target name)
   )
 
   add_custom_target(
     ClangdXPC
     DEPENDS
     ${target}
     ${CLANGD_FRAMEWORK_LOCATION}
   )
+
+  # clangd is already signed as a standalone executable, so it must be forced.
+  llvm_codesign(ClangdXPC BUNDLE_PATH "${CLANGD_FRAMEWORK_OUT_LOCATION}/XPCServices/${CLANGD_XPC_SERVICE_NAME}.xpc/" FORCE)
+  # ClangdXPC library is already signed as a standalone library, so it must be forced.
+  llvm_codesign(ClangdXPC BUNDLE_PATH "${CLANGD_FRAMEWORK_LOCATION}" FORCE)
 endmacro(create_clangd_xpc_framework)

llvm/trunk/cmake/modules/AddLLVM.cmake

else()
     add_custom_command(TARGET ${name} POST_BUILD
       COMMAND ${CMAKE_OBJCOPY} --only-keep-debug $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.debug
       ${strip_command} -R .gnu_debuglink
       COMMAND ${CMAKE_OBJCOPY} --add-gnu-debuglink=$<TARGET_FILE:${name}>.debug $<TARGET_FILE:${name}>
       )
   endif()
 endfunction()
 
-# Usage: llvm_codesign(name [ENTITLEMENTS file])
+# Usage: llvm_codesign(name [FORCE] [ENTITLEMENTS file] [BUNDLE_PATH path])
 function(llvm_codesign name)
-  cmake_parse_arguments(ARG "" "ENTITLEMENTS" "" ${ARGN})
+  cmake_parse_arguments(ARG "FORCE" "ENTITLEMENTS;BUNDLE_PATH" "" ${ARGN})
 
   if(NOT LLVM_CODESIGNING_IDENTITY)
     return()
   endif()
 
   if(CMAKE_GENERATOR STREQUAL "Xcode")
     set_target_properties(${name} PROPERTIES
       XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY ${LLVM_CODESIGNING_IDENTITY}
if(NOT CMAKE_CODESIGN_ALLOCATE)
         OUTPUT_STRIP_TRAILING_WHITESPACE
         OUTPUT_VARIABLE CMAKE_CODESIGN_ALLOCATE
       )
     endif()
     if(DEFINED ARG_ENTITLEMENTS)
       set(pass_entitlements --entitlements ${ARG_ENTITLEMENTS})
     endif()
 
+    if (NOT ARG_BUNDLE_PATH)
+      set(ARG_BUNDLE_PATH $<TARGET_FILE:${name}>)
+    endif()
+
+    if(ARG_FORCE)
+      set(force_flag "-f")
+    endif()
+
     add_custom_command(
       TARGET ${name} POST_BUILD
       COMMAND ${CMAKE_COMMAND} -E
               env CODESIGN_ALLOCATE=${CMAKE_CODESIGN_ALLOCATE}
               ${CMAKE_CODESIGN} -s ${LLVM_CODESIGNING_IDENTITY}
-              ${pass_entitlements} $<TARGET_FILE:${name}>
+              ${pass_entitlements} ${force_flag} ${ARG_BUNDLE_PATH}
     )
   endif()
 endfunction()
 
 function(llvm_setup_rpath name)
   if(CMAKE_INSTALL_RPATH)
     return()
   endif()