[libcxx] Codesign test executables if necessary

[vsk]

Summary

If LLVM_CODESIGNING_IDENTITY is set, test executables need to be
codesigned.

[vsk]

• Attach a diff with context.

[vsk]

• Teach '%run' about code signing.
• Introduce run.py to handle code signing in commands like 'not %run …'. A '%run' substitution that includes the codesign command cannot achieve the same thing.

[vsk]

Ping.

[ldionne]

libcxx/test/libcxx/strings/basic.string/PR42676.sh.cpp

12 ↗

(On Diff #216298)

Note to self and other reviewers: I checked and I don't think you missed this change in any other test -- all the other .sh.cpp tests already use %run.

libcxx/utils/libcxx/test/config.py

1034–1039

Just to be sure there's no subtle interaction I'm missing -- this is an entirely separate change packed into this patch, correct?

libcxx/utils/run.py

40 ↗

(On Diff #216298)

Why don't we instead use sys.argv[2:], and avoid the funny delete argv[0] calls above?

[vsk]

libcxx/utils/libcxx/test/config.py

1034–1039

Yes. I can split this out into a separate patch if it helps. It occurred to me that this was a problem when I wrote "subprocess.call(sign_cmd, env={})" in run.py, so I thought I'd fix it everywhere in one shot.

libcxx/utils/run.py

40 ↗

(On Diff #216298)

Sounds good. I'll update the style in not.py as a follow-up.

[vsk]

• Address coding style issue in run.py.

libcxx/test/lit.site.cfg.in

 config.has_libatomic            = @LIBCXX_HAS_ATOMIC_LIB@
 config.use_libatomic            = @LIBCXX_HAVE_CXX_ATOMICS_WITH_LIB@
 config.debug_build              = @LIBCXX_DEBUG_BUILD@
 config.libcxxabi_shared         = @LIBCXXABI_ENABLE_SHARED@
 config.cxx_ext_threads          = @LIBCXX_BUILD_EXTERNAL_THREAD_LIBRARY@
 config.pstl_src_root            = "@ParallelSTL_SOURCE_DIR@" if @LIBCXX_ENABLE_PARALLEL_ALGORITHMS@ else None
 config.pstl_obj_root            = "@ParallelSTL_BINARY_DIR@" if @LIBCXX_ENABLE_PARALLEL_ALGORITHMS@ else None
 
+# Code signing
+config.llvm_codesign_identity   = "@LLVM_CODESIGNING_IDENTITY@"
+
 # Let the main config do the real work.
 config.loaded_site_config = True
 lit_config.load_config(config, "@LIBCXX_SOURCE_DIR@/test/lit.cfg")

libcxx/utils/libcxx/compiler.py

 
 
 class CXXCompiler(object):
     CM_Default = 0
     CM_PreProcess = 1
     CM_Compile = 2
     CM_Link = 3
 
-    def __init__(self, path, flags=None, compile_flags=None, link_flags=None,
+    def __init__(self, config, path, flags=None, compile_flags=None, link_flags=None,
                  warning_flags=None, verify_supported=None,
                  verify_flags=None, use_verify=False,
                  modules_flags=None, use_modules=False,
                  use_ccache=False, use_warnings=False, compile_env=None,
                  cxx_type=None, cxx_version=None):
+        self.libcxx_config = config
         self.source_lang = 'c++'
         self.path = path
         self.flags = list(flags or [])
         self.compile_flags = list(compile_flags or [])
         self.link_flags = list(link_flags or [])
         self.warning_flags = list(warning_flags or [])
         self.verify_supported = verify_supported
         self.use_verify = use_verify
def preprocess(self, source_files, out=None, flags=[], cwd=None):
         return cmd, out, err, rc
 
     def compile(self, source_files, out=None, flags=[], cwd=None):
         cmd = self.compileCmd(source_files, out, flags)
         out, err, rc = libcxx.util.executeCommand(cmd, env=self.compile_env,
                                                   cwd=cwd)
         return cmd, out, err, rc
 
-    def link(self, source_files, out=None, flags=[], cwd=None):
-        cmd = self.linkCmd(source_files, out, flags)
+    def link(self, source_files, exec_path=None, flags=[], cwd=None):
+        cmd = self.linkCmd(source_files, exec_path, flags)
         out, err, rc = libcxx.util.executeCommand(cmd, env=self.compile_env,
                                                   cwd=cwd)
+        cs_cmd, cs_out, cs_err, cs_rc = self.codesign(exec_path, cwd)
+        if cs_rc != 0:
+            return cs_cmd, cs_out, cs_err, cs_rc
         return cmd, out, err, rc
 
-    def compileLink(self, source_files, out=None, flags=[],
+    def compileLink(self, source_files, exec_path=None, flags=[],
                     cwd=None):
-        cmd = self.compileLinkCmd(source_files, out, flags)
+        cmd = self.compileLinkCmd(source_files, exec_path, flags)
         out, err, rc = libcxx.util.executeCommand(cmd, env=self.compile_env,
                                                   cwd=cwd)
+        cs_cmd, cs_out, cs_err, cs_rc = self.codesign(exec_path, cwd)
+        if cs_rc != 0:
+            return cs_cmd, cs_out, cs_err, cs_rc
+        return cmd, out, err, rc
+
+    def codesign(self, exec_path, cwd=None):
+        null_op = [], '', '', 0
+        if not exec_path:
+            return null_op
+        codesign_ident = self.libcxx_config.get_lit_conf('llvm_codesign_identity', '')
+        if not codesign_ident:
+            return null_op
+        cmd = ['xcrun', 'codesign', '-s', codesign_ident, exec_path]
+        out, err, rc = libcxx.util.executeCommand(cmd, cwd=cwd)
         return cmd, out, err, rc
 
     def compileLinkTwoSteps(self, source_file, out=None, object_file=None,
                             flags=[], cwd=None):
         if not isinstance(source_file, str):
             raise TypeError('This function only accepts a single input file')
         if object_file is None:
             # Create, use and delete a temporary object file if none is given.
             with_fn = lambda: libcxx.util.guardedTempFilename(suffix='.o')
         else:
             # Otherwise wrap the filename in a context manager function.
             with_fn = lambda: libcxx.util.nullContext(object_file)
         with with_fn() as object_file:
             cc_cmd, cc_stdout, cc_stderr, rc = self.compile(
                 source_file, object_file, flags=flags, cwd=cwd)
             if rc != 0:
                 return cc_cmd, cc_stdout, cc_stderr, rc
 
             link_cmd, link_stdout, link_stderr, rc = self.link(
-                object_file, out=out, flags=flags, cwd=cwd)
+                object_file, exec_path=out, flags=flags, cwd=cwd)
             return (cc_cmd + ['&&'] + link_cmd, cc_stdout + link_stdout,
                     cc_stderr + link_stderr, rc)
 
     def dumpMacros(self, source_files=None, flags=[], cwd=None):
         if source_files is None:
             source_files = os.devnull
         flags = ['-dM'] + flags
         cmd, out, err, rc = self.preprocess(source_files, flags=flags, cwd=cwd)

libcxx/utils/libcxx/test/config.py

def configure_cxx(self):
                 self.lit_config.note(
                     "inferred cxx_under_test as: %r" % cxx)
             elif self.cxx_is_clang_cl:
                 self.lit_config.fatal('Failed to find clang++ substitution for'
                                       ' clang-cl')
         if not cxx:
             self.lit_config.fatal('must specify user parameter cxx_under_test '
                                   '(e.g., --param=cxx_under_test=clang++)')
-        self.cxx = CXXCompiler(cxx) if not self.cxx_is_clang_cl else \
+        self.cxx = CXXCompiler(self, cxx) if not self.cxx_is_clang_cl else \
                    self._configure_clang_cl(cxx)
         cxx_type = self.cxx.type
         if cxx_type is not None:
             assert self.cxx.version is not None
             maj_v, min_v, patch_v = self.cxx.version
             self.config.available_features.add(cxx_type)
             self.config.available_features.add('%s-%s' % (cxx_type, maj_v))
             self.config.available_features.add('%s-%s.%s' % (
def _configure_clang_cl(self, clang_path):
             return list(chain.from_iterable((prefix, path) for path in _split_env_var(var)))
 
         assert self.cxx_is_clang_cl
         flags = []
         compile_flags = _prefixed_env_list('INCLUDE', '-isystem')
         link_flags = _prefixed_env_list('LIB', '-L')
         for path in _split_env_var('LIB'):
             self.add_path(self.exec_env, path)
-        return CXXCompiler(clang_path, flags=flags,
+        return CXXCompiler(self, clang_path, flags=flags,
                            compile_flags=compile_flags,
                            link_flags=link_flags)
 
     def _dump_macros_verbose(self, *args, **kwargs):
         macros_or_error = self.cxx.dumpMacros(*args, **kwargs)
         if isinstance(macros_or_error, tuple):
             cmd, out, err, rc = macros_or_error
             report = libcxx.util.makeReport(cmd, out, err, rc)
def configure_modules(self):
         os.makedirs(module_cache)
         self.cxx.modules_flags += modules_flags + \
             ['-fmodules-cache-path=' + module_cache]
         if enable_modules:
             self.config.available_features.add('-fmodules')
             self.cxx.useModules()
 
     def configure_substitutions(self):
         sub = self.config.substitutions
         cxx_path = pipes.quote(self.cxx.path)
         # Configure compiler substitutions
         sub.append(('%cxx', cxx_path))
         sub.append(('%libcxx_src_root', self.libcxx_src_root))
         # Configure flags substitutions
         flags_str = ' '.join([pipes.quote(f) for f in self.cxx.flags])
         compile_flags_str = ' '.join([pipes.quote(f) for f in self.cxx.compile_flags])
         link_flags_str = ' '.join([pipes.quote(f) for f in self.cxx.link_flags])
         all_flags = '%s %s %s' % (flags_str, compile_flags_str, link_flags_str)
         sub.append(('%flags', flags_str))
         sub.append(('%compile_flags', compile_flags_str))
         sub.append(('%link_flags', link_flags_str))
         sub.append(('%all_flags', all_flags))