[CMake] Check that a certificate for lldb is present at build time.

[JDevlieghere]

LGTM

[davide]

rdar://problem/52078735

[JDevlieghere]

On second thought, let's check that LLDB_CODESIGN_IDENTITY equals lldb_codesign before doing this check.

[labath]

This code should go to tools/debugserver/source/CMakeLists.txt so that it is next to the code which performs the actual code signing. Doing that will make it easier to keep it in sync with changes to code signing, as well as make it obvious that it is not in sync with them right now (there's a pretty complex interaction of various cmake options (LLDB_CODESIGN_IDENTITY, LLVM_CODESIGNING_IDENTITY, LLDB_USE_SYSTEM_DEBUGSERVER, etc.) which affects code signing, and this code is ignoring all of those)...

[xiaobai]

In D63745#1556773, @JDevlieghere wrote:

On second thought, let's check that LLDB_CODESIGN_IDENTITY equals lldb_codesign before doing this check.

This question isn't important but I'm kind of curious: Does it have to be called lldb_codesign? Could you have an arbitrary identity and then sign with that, assuming the cert exists, or does debugserver expect a cert with that name exactly?

lldb/CMakeLists.txt

77

I think CMAKE_SYSTEM_NAME MATCHES "Darwin" is redundant because debugserver should only be a target if you're running on Darwin, per the logic in tools/CMakeLists.txt.

[xiaobai]

In D63745#1556941, @labath wrote:

This code should go to tools/debugserver/source/CMakeLists.txt so that it is next to the code which performs the actual code signing. Doing that will make it easier to keep it in sync with changes to code signing, as well as make it obvious that it is not in sync with them right now (there's a pretty complex interaction of various cmake options (LLDB_CODESIGN_IDENTITY, LLVM_CODESIGNING_IDENTITY, LLDB_USE_SYSTEM_DEBUGSERVER, etc.) which affects code signing, and this code is ignoring all of those)...

+1

[friss]

In D63745#1556943, @xiaobai wrote:

In D63745#1556773, @JDevlieghere wrote:

On second thought, let's check that LLDB_CODESIGN_IDENTITY equals lldb_codesign before doing this check.

This question isn't important but I'm kind of curious: Does it have to be called lldb_codesign? Could you have an arbitrary identity and then sign with that, assuming the cert exists, or does debugserver expect a cert with that name exactly?

The name doesn't matter.

[sgraenitz]

In D63745#1556941, @labath wrote:
This code should go to tools/debugserver/source/CMakeLists.txt

+1

More precisely, this is the condition where you want to do your check:
https://github.com/llvm/llvm-project/blob/287f0403e310/lldb/tools/debugserver/source/CMakeLists.txt#L131

You don't need if(CMAKE_SYSTEM_NAME MATCHES "Darwin" AND TARGET debugserver) there.
Use ${LLDB_CODESIGN_IDENTITY_USED} instead of lldb_codesign.
Error message could recommend -DLLDB_USE_SYSTEM_DEBUGSERVER=ON and/or -DLLDB_NO_DEBUGSERVER=ON

[davide]

In D63745#1556941, @labath wrote:

This code should go to tools/debugserver/source/CMakeLists.txt so that it is next to the code which performs the actual code signing. Doing that will make it easier to keep it in sync with changes to code signing, as well as make it obvious that it is not in sync with them right now (there's a pretty complex interaction of various cmake options (LLDB_CODESIGN_IDENTITY, LLVM_CODESIGNING_IDENTITY, LLDB_USE_SYSTEM_DEBUGSERVER, etc.) which affects code signing, and this code is ignoring all of those)...

New patch coming, thanks!

[davide]

Address feedback from many.

[sgraenitz]

LGTM

lldb/CMakeLists.txt

if(LLDB_INCLUDE_TESTS)
   set(LLDB_TEST_DSYMUTIL "${LLDB_DEFAULT_TEST_DSYMUTIL}" CACHE PATH "dsymutil used for generating dSYM bundles")
   set(LLDB_TEST_FILECHECK "${LLDB_DEFAULT_TEST_FILECHECK}" CACHE PATH "FileCheck used for testing purposes")
 
   if (("${LLDB_TEST_C_COMPILER}" STREQUAL "") OR
       ("${LLDB_TEST_CXX_COMPILER}" STREQUAL ""))
     message(FATAL_ERROR "LLDB test compilers not specified.  Tests will not run")
   endif()
 
+  # On MacOS, debugserver needs to be codesigned. Check if we have a certificate instead
+  # of failing in the middle of the build.
+  if(CMAKE_SYSTEM_NAME MATCHES "Darwin" AND TARGET debugserver)
+    execute_process(
+      COMMAND security find-certificate -Z -p -c lldb_codesign /Library/Keychains/System.keychain
+      RESULT_VARIABLE cert_return
+      OUTPUT_QUIET
+      ERROR_QUIET)
+
+    if (cert_return)
+      message(FATAL_ERROR "Certificate for debugserver not found. Run scripts/macos-setup-codesign.sh")
+    endif()
+  endif()
+
   set(LLDB_TEST_DEPS lldb)
 
   # darwin-debug is an hard dependency for the testsuite.
   if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
     list(APPEND LLDB_TEST_DEPS darwin-debug)
   endif()
 
   # lldb-test is an hard dependency for the testsuite.