fix: sign all executables

Certora · Dec 6, 2024 · fc71e1a · fc71e1a
1 parent b6420c6
commit fc71e1a
Showing 1 changed file with 71 additions and 17 deletions.
diff --git a/scripts/package.sh b/scripts/package.sh
@@ -86,24 +86,78 @@ if [[ "${HOST_TRIPLE}" != "x86_64-pc-windows-msvc" ]] ; then
 fi
 
 # Sign macOS binaries - Disabled
-# if [[ $HOST_TRIPLE == *apple-darwin* ]] && [[ ! -z "$APPLE_CODESIGN_IDENTITY" ]]; then
-#     LLVM_BIN="./deploy/llvm/bin"
-#     RUST_BIN="./deploy/rust/bin"
-#     RUST_LIB="./deploy/rust/lib"
-#     RUST_LIB_BIN="$RUST_LIB/rustlib/aarch64-apple-darwin/bin"
+if [[ $HOST_TRIPLE == *apple-darwin* ]] && [[ ! -z "$APPLE_CODESIGN_IDENTITY" ]]; then
+    LLVM_BIN="./deploy/llvm/bin"
+    while IFS= read -r f
+    do
+        bin_file="${LLVM_BIN}${f}${EXE_SUFFIX}"
+        if [[ -f "$bin_file" ]] ; then
+            ../scripts/sign.sh "$bin_file"
+        fi
+    done < <(cat <<EOF
+lld
+llc
+llvm-symbolizer
+llvm-objdump
+lldb
+llvm-ar
+llvm-readobj
+opt
+llvm-objcopy
+clang-17
+solana-lldb
+lldb-vscode
+liblldb.17.0.6-rust-dev.dylib
+EOF
+        )
+
+    RUST_BIN="./deploy/rust/bin"
+    while IFS= read -r f
+    do
+        bin_file="${RUST_BIN}${f}${EXE_SUFFIX}"
+        if [[ -f "$bin_file" ]] ; then
+            ../scripts/sign.sh "$bin_file"
+        fi
+    done < <(cat <<EOF
+rustdoc
+cargo
+rustc
+EOF
+        )
 
-#     ../scripts/sign.sh \
-#         "$LLVM_BIN/llvm-objdump" \
-#         "$LLVM_BIN/llvm-ar" \
-#         "$LLVM_BIN/llvm-readobj" \
-#         "$LLVM_BIN/llvm-objcopy" \
-#         "$RUST_BIN/rustdoc" \
-#         "$RUST_BIN/cargo" \
-#         "$RUST_LIB/librustc_driver-b4e91886a4c059a0.dylib" \
-#         "$RUST_LIB/libstd-6eff127b55c063c2.dylib" \
-#         "$RUST_LIB_BIN/rust-lld"
-#        # "$RUST_BIN/rustc" # Not signing 'rustc' duo to failing cargo build
-# fi
+    RUST_LIB_BIN="$RUST_LIB/rustlib/aarch64-apple-darwin/bin"
+    while IFS= read -r f
+    do
+        bin_file="${RUST_BIN}${f}${EXE_SUFFIX}"
+        if [[ -f "$bin_file" ]] ; then
+            ../scripts/sign.sh "$bin_file"
+        fi
+    done < <(cat <<EOF
+llvm-cov
+llc
+llvm-objdump
+llvm-as
+llvm-nm
+llvm-ar
+llvm-dis
+llvm-size
+llvm-readobj
+gcc-ld/ld.lld
+gcc-ld/wasm-ld
+gcc-ld/lld-link
+gcc-ld/ld64.lld
+opt
+llvm-profdata
+llvm-objcopy
+rust-lld
+EOF
+        )
+
+    # sign all dylib libraries
+    RUST_LIB="./deploy/rust/lib"
+    RUST_LIB_LIB="$RUST_LIB/rustlib/aarch64-apple-darwin/lib"
+    ../scripts/sign.sh $RUST_LIB/*.dylib $RUST_LIB_LIB/*.dylib
+fi
 
 # Check the Rust binaries
 while IFS= read -r f