1843bee81d
This is a reland of commit 6f0d2bf494
Includes a fix for iOS codesigning script to be python3 compatible.
Original change's description:
> Set GN's script_executable to "python3"
>
> In some environments, GN would end up running scripts with python2.
> This change requires that python3 be in the path, but is the safest
> way to guarantee that all scripts are run correctly.
>
> Change-Id: Ifc2601ff9c9f3705ac7f1057a26a87a61211ff67
> Reviewed-on: https://skia-review.googlesource.com/c/skia/+/528337
> Reviewed-by: Kevin Lubick <kjlubick@google.com>
> Commit-Queue: Brian Osman <brianosman@google.com>
Change-Id: I785909f3c7d51d6fd1c90114d01f114be76981f2
Cq-Include-Trybots: luci.skia.skia.primary:Build-Mac-Clang-arm64-Debug-iOS
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/528441
Reviewed-by: Ben Wagner <bungeman@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
82 lines
2.8 KiB
Python
Executable File
82 lines
2.8 KiB
Python
Executable File
#!/usr/bin/env python2.7
|
|
#
|
|
# Copyright 2017 Google Inc.
|
|
#
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
import glob
|
|
import os
|
|
import os.path
|
|
import re
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
|
|
# Arguments to the script:
|
|
# pkg path to application directory, e.g. out/Debug/dm.app
|
|
# executable and plist should already be in this directory
|
|
# identstr search string (regex fragment) for code signing identity
|
|
# profile path or name of provisioning profile
|
|
pkg,identstr,profile = sys.argv[1:]
|
|
|
|
# Find the signing identity.
|
|
identity = None
|
|
for line in subprocess.check_output([
|
|
'security', 'find-identity']).decode('utf-8').split('\n'):
|
|
m = re.match(r'''.*\) (.*) "''' + identstr + '"', line)
|
|
if m:
|
|
identity = m.group(1)
|
|
if identity is None:
|
|
print("Signing identity matching '" + identstr + "' not found.")
|
|
print("Please verify by running 'security find-identity' or checking your keychain.")
|
|
sys.exit(1)
|
|
|
|
# Find the mobile provisioning profile.
|
|
mobileprovision = None
|
|
if os.path.isfile(profile):
|
|
mobileprovision = profile
|
|
else:
|
|
for p in glob.glob(os.path.join(os.environ['HOME'], 'Library', 'MobileDevice',
|
|
'Provisioning Profiles',
|
|
'*.mobileprovision')):
|
|
if re.search(r'''<key>Name</key>
|
|
\t<string>''' + profile + r'''</string>''', open(p, 'rb').read().decode("utf-8", "ignore"), re.MULTILINE):
|
|
mobileprovision = p
|
|
if mobileprovision is None:
|
|
print("Provisioning profile matching '" + profile + "' not found.")
|
|
print("Please verify that the correct profile is installed in '${HOME}/Library/MobileDevice/Provisioning Profiles' or specify the path directly.")
|
|
sys.exit(1)
|
|
|
|
# The .mobileprovision just gets copied into the package.
|
|
shutil.copy(mobileprovision,
|
|
os.path.join(pkg, 'embedded.mobileprovision'))
|
|
|
|
# Extract the appliciation identitifer prefix from the .mobileprovision.
|
|
m = re.search(r'''<key>ApplicationIdentifierPrefix</key>
|
|
\t<array>
|
|
\t<string>(.*)</string>''', open(mobileprovision, 'rb').read().decode("utf-8", "ignore"), re.MULTILINE)
|
|
prefix = m.group(1)
|
|
|
|
app, _ = os.path.splitext(os.path.basename(pkg))
|
|
|
|
# Write a minimal entitlements file, then codesign.
|
|
with tempfile.NamedTemporaryFile() as f:
|
|
f.write('''
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>application-identifier</key> <string>{prefix}.com.google.{app}</string>
|
|
<key>get-task-allow</key> <true/>
|
|
</dict>
|
|
</plist>
|
|
'''.format(prefix=prefix, app=app).encode("utf-8"))
|
|
f.flush()
|
|
|
|
subprocess.check_call(['codesign',
|
|
'--force',
|
|
'--sign', identity,
|
|
'--entitlements', f.name,
|
|
'--timestamp=none',
|
|
pkg])
|