[CMake] Check that a certificate for lldb is present at build time.

[JDevlieghere]

LGTM

[davide]

rdar://problem/52078735

[JDevlieghere]

On second thought, let's check that LLDB_CODESIGN_IDENTITY equals lldb_codesign before doing this check.

[labath]

This code should go to tools/debugserver/source/CMakeLists.txt so that it is next to the code which performs the actual code signing. Doing that will make it easier to keep it in sync with changes to code signing, as well as make it obvious that it is not in sync with them right now (there's a pretty complex interaction of various cmake options (LLDB_CODESIGN_IDENTITY, LLVM_CODESIGNING_IDENTITY, LLDB_USE_SYSTEM_DEBUGSERVER, etc.) which affects code signing, and this code is ignoring all of those)...

[xiaobai]

In D63745#1556773, @JDevlieghere wrote:

On second thought, let's check that LLDB_CODESIGN_IDENTITY equals lldb_codesign before doing this check.

This question isn't important but I'm kind of curious: Does it have to be called lldb_codesign? Could you have an arbitrary identity and then sign with that, assuming the cert exists, or does debugserver expect a cert with that name exactly?

lldb/CMakeLists.txt

77 ↗

(On Diff #206330)

I think CMAKE_SYSTEM_NAME MATCHES "Darwin" is redundant because debugserver should only be a target if you're running on Darwin, per the logic in tools/CMakeLists.txt.

[xiaobai]

In D63745#1556941, @labath wrote:

This code should go to tools/debugserver/source/CMakeLists.txt so that it is next to the code which performs the actual code signing. Doing that will make it easier to keep it in sync with changes to code signing, as well as make it obvious that it is not in sync with them right now (there's a pretty complex interaction of various cmake options (LLDB_CODESIGN_IDENTITY, LLVM_CODESIGNING_IDENTITY, LLDB_USE_SYSTEM_DEBUGSERVER, etc.) which affects code signing, and this code is ignoring all of those)...

+1

[friss]

In D63745#1556943, @xiaobai wrote:

In D63745#1556773, @JDevlieghere wrote:

On second thought, let's check that LLDB_CODESIGN_IDENTITY equals lldb_codesign before doing this check.

This question isn't important but I'm kind of curious: Does it have to be called lldb_codesign? Could you have an arbitrary identity and then sign with that, assuming the cert exists, or does debugserver expect a cert with that name exactly?

The name doesn't matter.

[sgraenitz]

In D63745#1556941, @labath wrote:
This code should go to tools/debugserver/source/CMakeLists.txt

+1

More precisely, this is the condition where you want to do your check:
https://github.com/llvm/llvm-project/blob/287f0403e310/lldb/tools/debugserver/source/CMakeLists.txt#L131

You don't need if(CMAKE_SYSTEM_NAME MATCHES "Darwin" AND TARGET debugserver) there.
Use ${LLDB_CODESIGN_IDENTITY_USED} instead of lldb_codesign.
Error message could recommend -DLLDB_USE_SYSTEM_DEBUGSERVER=ON and/or -DLLDB_NO_DEBUGSERVER=ON

[davide]

In D63745#1556941, @labath wrote:

This code should go to tools/debugserver/source/CMakeLists.txt so that it is next to the code which performs the actual code signing. Doing that will make it easier to keep it in sync with changes to code signing, as well as make it obvious that it is not in sync with them right now (there's a pretty complex interaction of various cmake options (LLDB_CODESIGN_IDENTITY, LLVM_CODESIGNING_IDENTITY, LLDB_USE_SYSTEM_DEBUGSERVER, etc.) which affects code signing, and this code is ignoring all of those)...

New patch coming, thanks!

[davide]

Address feedback from many.

[sgraenitz]

LGTM

lldb/trunk/tools/debugserver/source/CMakeLists.txt

 else()
   # No tests for debugserver, no tests that require it.
   set(DEBUGSERVER_PATH "" CACHE FILEPATH "" FORCE)
   set(SKIP_TEST_DEBUGSERVER ON CACHE BOOL "" FORCE)
 
   message(STATUS "lldb debugserver will not be available.")
 endif()
 
+# On MacOS, debugserver needs to be codesigned when built. Check if we have
+# a certificate instead of failing in the middle of the build.
+if(build_and_sign_debugserver)
+  execute_process(
+    COMMAND security find-certificate -Z -p -c ${LLDB_CODESIGN_IDENTITY_USED} /Library/Keychains/System.keychain
+    RESULT_VARIABLE cert_return
+    OUTPUT_QUIET
+    ERROR_QUIET)
+
+  if (cert_return)
+    message(FATAL_ERROR "Certificate for debugserver not found. Run scripts/macos-setup-codesign.sh or "
+                        "use the system debugserver passing -DLLDB_USE_SYSTEM_DEBUGSERVER=ON to CMake")
+  endif()
+endif()
+
 if(APPLE)
   if(IOS)
     find_library(BACKBOARD_LIBRARY BackBoardServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)
     find_library(FRONTBOARD_LIBRARY FrontBoardServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)
     find_library(SPRINGBOARD_LIBRARY SpringBoardServices
       PATHS ${CMAKE_OSX_SYSROOT}/System/Library/PrivateFrameworks)