Skip to content

Commit c098720

Browse files
committed
osx/codesign.sh: apply linter recommendations
Apply linter recommendations to the codesign.sh script used on macOS. Also always pass the absolute path of the entitlements file to the codesign command as using relative paths can sometimes fail. Signed-off-by: Matthew John Cheetham <[email protected]>
1 parent 6e374ba commit c098720

File tree

1 file changed

+23
-15
lines changed

1 file changed

+23
-15
lines changed

src/osx/Installer.Mac/codesign.sh

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,37 +15,45 @@ elif [ -z "$ENTITLEMENTS_FILE" ]; then
1515
exit 1
1616
fi
1717

18+
# The codesign command needs the entitlements file to be given as an absolute
19+
# file path; relative paths can cause issues.
20+
if [[ "${ENTITLEMENTS_FILE}" != /* ]]; then
21+
echo "error: entitlements file argument must be an absolute path"
22+
exit 1
23+
fi
24+
1825
echo "======== INPUTS ========"
1926
echo "Directory: $SIGN_DIR"
2027
echo "Developer ID: $DEVELOPER_ID"
2128
echo "Entitlements: $ENTITLEMENTS_FILE"
2229
echo "======== END INPUTS ========"
2330
echo
2431
echo "======== ENTITLEMENTS ========"
25-
cat $ENTITLEMENTS_FILE
32+
cat "$ENTITLEMENTS_FILE"
2633
echo "======== END ENTITLEMENTS ========"
2734
echo
2835

29-
cd $SIGN_DIR
36+
cd "$SIGN_DIR" || exit 1
3037
for f in *
3138
do
32-
macho=$(file --mime $f | grep mach)
39+
macho=$(file --mime "$f" | grep mach)
3340
# Runtime sign dylibs and Mach-O binaries
34-
if [[ $f == *.dylib ]] || [ ! -z "$macho" ];
41+
if [[ $f == *.dylib ]] || [ -n "$macho" ];
3542
then
36-
echo "Runtime Signing $f"
37-
codesign -s "$DEVELOPER_ID" $f --timestamp --force --options=runtime --entitlements $ENTITLEMENTS_FILE
43+
echo "Signing with entitlements and hardening: $f"
44+
codesign -s "$DEVELOPER_ID" "$f" --timestamp --force --options=runtime --entitlements "$ENTITLEMENTS_FILE"
3845
elif [ -d "$f" ];
3946
then
40-
echo "Signing files in subdirectory $f"
41-
cd $f
42-
for i in *
43-
do
44-
codesign -s "$DEVELOPER_ID" $i --timestamp --force
45-
done
46-
cd ..
47+
echo "Signing files in subdirectory: $f"
48+
(
49+
cd "$f" || exit 1
50+
for i in *
51+
do
52+
codesign -s "$DEVELOPER_ID" "$i" --timestamp --force
53+
done
54+
)
4755
else
48-
echo "Signing $f"
49-
codesign -s "$DEVELOPER_ID" $f --timestamp --force
56+
echo "Signing: $f"
57+
codesign -s "$DEVELOPER_ID" "$f" --timestamp --force
5058
fi
5159
done

0 commit comments

Comments
 (0)