Skip to content

Commit 4d30925

Browse files
svmkr-devsvmkr-dev
committed
Implement comments from review (#8378)
Add get-task-allow entitlement on platforms other than macos Add application-identifier entitlements when provisioning Don't run getTaskAllowEntitlement(data:) test with xcode build system
1 parent f5ae2ec commit 4d30925

File tree

2 files changed

+120
-129
lines changed

2 files changed

+120
-129
lines changed

‎Sources/SwiftBuildSupport/SwiftBuildSystem.swift‎

Lines changed: 24 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -112,30 +112,35 @@ func withSession(
112112
}
113113

114114
private final class PlanningOperationDelegate: SWBPlanningOperationDelegate, Sendable {
115-
private let shouldEnableMacOsDebuggingEntitlement: Bool
115+
private let shouldEnableDebuggingEntitlement: Bool
116116

117-
init(shouldEnableMacOsDebuggingEntitlement: Bool) {
118-
self.shouldEnableMacOsDebuggingEntitlement = shouldEnableMacOsDebuggingEntitlement
117+
init(shouldEnableDebuggingEntitlement: Bool) {
118+
self.shouldEnableDebuggingEntitlement = shouldEnableDebuggingEntitlement
119119
}
120120

121121
public func provisioningTaskInputs(
122122
targetGUID: String,
123123
provisioningSourceData: SWBProvisioningTaskInputsSourceData
124124
) async -> SWBProvisioningTaskInputs {
125-
// if we need to add debug entitlement we have to do codesigning, so we need to ensure at least ad-hoc signing
126-
let identity = if provisioningSourceData.signingCertificateIdentifier
127-
.isEmpty && shouldEnableMacOsDebuggingEntitlement && provisioningSourceData.supportsEntitlements
128-
{
129-
"-"
130-
} else {
131-
provisioningSourceData.signingCertificateIdentifier
132-
}
125+
let identity = provisioningSourceData.signingCertificateIdentifier
126+
127+
if identity == "-" || identity.isEmpty {
128+
let getTaskAllowEntitlementKey: String
129+
let applicationIdentifierEntitlementKey: String
130+
131+
if provisioningSourceData.sdkRoot.contains("macos") || provisioningSourceData.sdkRoot
132+
.contains("simulator")
133+
{
134+
getTaskAllowEntitlementKey = "com.apple.security.get-task-allow"
135+
applicationIdentifierEntitlementKey = "com.apple.application-identifier"
136+
} else {
137+
getTaskAllowEntitlementKey = "get-task-allow"
138+
applicationIdentifierEntitlementKey = "application-identifier"
139+
}
133140

134-
if identity == "-" {
135141
let signedEntitlements = provisioningSourceData
136-
.entitlementsDestination == "Signature" && provisioningSourceData.sdkRoot.contains("iphoneos")
137-
? provisioningSourceData.productTypeEntitlements.merging(
138-
["application-identifier": .plString(provisioningSourceData.bundleIdentifier)],
142+
.entitlementsDestination == "Signature" ? provisioningSourceData.productTypeEntitlements.merging(
143+
[applicationIdentifierEntitlementKey: .plString(provisioningSourceData.bundleIdentifier)],
139144
uniquingKeysWith: { _, new in new }
140145
).merging(provisioningSourceData.projectEntitlements ?? [:], uniquingKeysWith: { _, new in new })
141146
: [:]
@@ -149,12 +154,8 @@ private final class PlanningOperationDelegate: SWBPlanningOperationDelegate, Sen
149154

150155
var additionalEntitlements: [String: SWBPropertyListItem] = [:]
151156

152-
if provisioningSourceData.sdkRoot.contains("simulator") {
153-
additionalEntitlements["get-task-allow"] = .plBool(true)
154-
}
155-
156-
if shouldEnableMacOsDebuggingEntitlement {
157-
additionalEntitlements["com.apple.security.get-task-allow"] = .plBool(true)
157+
if shouldEnableDebuggingEntitlement {
158+
additionalEntitlements[getTaskAllowEntitlementKey] = .plBool(true)
158159
}
159160

160161
return SWBProvisioningTaskInputs(
@@ -176,8 +177,6 @@ private final class PlanningOperationDelegate: SWBPlanningOperationDelegate, Sen
176177
errors: [],
177178
warnings: []
178179
)
179-
} else if identity.isEmpty {
180-
return SWBProvisioningTaskInputs()
181180
} else {
182181
return SWBProvisioningTaskInputs(
183182
identityHash: "-",
@@ -751,9 +750,8 @@ public final class SwiftBuildSystem: SPMBuildCore.BuildSystem {
751750

752751
let operation = try await session.createBuildOperation(
753752
request: request,
754-
delegate: PlanningOperationDelegate(shouldEnableMacOsDebuggingEntitlement: self.buildParameters
755-
.triple.darwinPlatform == .macOS && self.buildParameters.debuggingParameters
756-
.shouldEnableDebuggingEntitlement
753+
delegate: PlanningOperationDelegate(shouldEnableDebuggingEntitlement: self.buildParameters
754+
.debuggingParameters.shouldEnableDebuggingEntitlement
757755
),
758756
retainBuildDescription: true
759757
)

‎Tests/CommandsTests/BuildCommandTests.swift‎

Lines changed: 96 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -1282,9 +1282,6 @@ struct BuildCommandTestCases {
12821282
}
12831283

12841284
@Test(
1285-
.SWBINTTODO(
1286-
"Implement get-task-allow entitlement for xcode build system"
1287-
),
12881285
.tags(
12891286
.Feature.CommandLineArguments.DisableGetTaskAllowEntitlement,
12901287
.Feature.CommandLineArguments.EnableGetTaskAllowEntitlement,
@@ -1293,131 +1290,127 @@ struct BuildCommandTestCases {
12931290
.tags(
12941291
.Feature.CommandLineArguments.BuildSystem,
12951292
),
1296-
arguments: getBuildData(for: SupportedBuildSystemOnPlatform),
1293+
arguments: getBuildData(for: SupportedBuildSystemOnAllPlatforms),
12971294
)
12981295
func getTaskAllowEntitlement(
12991296
data: BuildData,
13001297
) async throws {
13011298
let buildSystem = data.buildSystem
13021299
let buildConfiguration = data.config
1303-
try await withKnownIssue(isIntermittent: ProcessInfo.hostOperatingSystem == .linux) {
1304-
try await fixture(name: "ValidLayouts/SingleModule/ExecutableNew") { fixturePath in
1305-
#if os(macOS)
1306-
func codesignDisplay(execPath: AbsolutePath) async throws
1307-
-> (AsyncProcessResult.ExitStatus, PropertyListItem?)
1300+
try await fixture(name: "ValidLayouts/SingleModule/ExecutableNew") { fixturePath in
1301+
#if os(macOS)
1302+
func codesignDisplay(execPath: AbsolutePath) async throws
1303+
-> (AsyncProcessResult.ExitStatus, PropertyListItem?)
1304+
{
1305+
let args = ["codesign", "-d", "--entitlements", "-", "--xml", execPath.pathString]
1306+
let result = try await AsyncProcess.popen(arguments: args)
1307+
let entitlements: PropertyListItem? = if case .success(let output) = result.output,
1308+
!output.isEmpty
13081309
{
1309-
let args = ["codesign", "-d", "--entitlements", "-", "--xml", execPath.pathString]
1310-
let result = try await AsyncProcess.popen(arguments: args)
1311-
let entitlements: PropertyListItem? = if case .success(let output) = result.output,
1312-
!output.isEmpty
1313-
{
1314-
try PropertyList.fromBytes(output)
1315-
} else {
1316-
nil
1317-
}
1318-
1319-
return (result.exitStatus, entitlements)
1310+
try PropertyList.fromBytes(output)
1311+
} else {
1312+
nil
13201313
}
13211314

1322-
func verify(entitlements: PropertyListItem?, getTaskAllowRequired: Bool) {
1323-
if getTaskAllowRequired {
1324-
guard let entitlements, case .plDict(let dict) = entitlements else {
1325-
Issue.record("Missing expected entitlements")
1326-
return
1327-
}
1315+
return (result.exitStatus, entitlements)
1316+
}
13281317

1329-
#expect(dict["com.apple.security.get-task-allow"] == .plBool(true))
1330-
} else {
1331-
#expect(entitlements == nil)
1318+
func verify(entitlements: PropertyListItem?, getTaskAllowRequired: Bool) {
1319+
guard let entitlements, case .plDict(let dict) = entitlements else {
1320+
if getTaskAllowRequired {
1321+
Issue.record("Missing expected entitlements")
13321322
}
1323+
return
13331324
}
13341325

1335-
let execName = "ExecutableNew"
1326+
if getTaskAllowRequired {
1327+
#expect(dict["com.apple.security.get-task-allow"] == .plBool(true))
1328+
}
1329+
}
13361330

1337-
var buildResult = try await build(
1338-
["-v"],
1339-
packagePath: fixturePath,
1340-
configuration: buildConfiguration,
1341-
cleanAfterward: false,
1342-
buildSystem: buildSystem
1343-
)
1344-
var (
1345-
exitStatus,
1346-
entitlements
1347-
) = try await codesignDisplay(execPath: buildResult.binPath.appending(execName))
1331+
let execName = "ExecutableNew"
13481332

1349-
// codesign performs basic verification in display mode, which is enough to confirm ad-hoc signature
1350-
// if verification fails (eg. no signature) termination code will be 1
1351-
// though on Apple Silicon binary will always be signed because linker signs it by default
1352-
#expect(exitStatus == .terminated(code: 0))
1353-
verify(entitlements: entitlements, getTaskAllowRequired: buildConfiguration == .debug)
1333+
var buildResult = try await build(
1334+
["-v"],
1335+
packagePath: fixturePath,
1336+
configuration: buildConfiguration,
1337+
cleanAfterward: false,
1338+
buildSystem: buildSystem
1339+
)
1340+
var (
1341+
exitStatus,
1342+
entitlements
1343+
) = try await codesignDisplay(execPath: buildResult.binPath.appending(execName))
13541344

1355-
try await executeSwiftPackage(fixturePath, extraArgs: ["clean"], buildSystem: buildSystem)
1345+
// codesign performs basic verification in display mode, which is enough to confirm ad-hoc signature
1346+
// if verification fails (eg. no signature) termination code will be 1
1347+
// though on Apple Silicon binary will always be signed because linker signs it by default
1348+
#expect(exitStatus == .terminated(code: 0))
1349+
verify(entitlements: entitlements, getTaskAllowRequired: buildConfiguration == .debug)
13561350

1357-
buildResult = try await build(
1358-
["--enable-get-task-allow-entitlement"],
1359-
packagePath: fixturePath,
1360-
configuration: buildConfiguration,
1361-
cleanAfterward: false,
1362-
buildSystem: buildSystem
1363-
)
1364-
(
1365-
exitStatus,
1366-
entitlements
1367-
) = try await codesignDisplay(execPath: buildResult.binPath.appending(execName))
1351+
try await executeSwiftPackage(fixturePath, extraArgs: ["clean"], buildSystem: buildSystem)
13681352

1369-
#expect(exitStatus == .terminated(code: 0))
1370-
verify(entitlements: entitlements, getTaskAllowRequired: true)
1353+
buildResult = try await build(
1354+
["--enable-get-task-allow-entitlement"],
1355+
packagePath: fixturePath,
1356+
configuration: buildConfiguration,
1357+
cleanAfterward: false,
1358+
buildSystem: buildSystem
1359+
)
1360+
(
1361+
exitStatus,
1362+
entitlements
1363+
) = try await codesignDisplay(execPath: buildResult.binPath.appending(execName))
13711364

1372-
try await executeSwiftPackage(fixturePath, extraArgs: ["clean"], buildSystem: buildSystem)
1365+
#expect(exitStatus == .terminated(code: 0))
1366+
verify(entitlements: entitlements, getTaskAllowRequired: true)
13731367

1374-
buildResult = try await build(
1375-
["--disable-get-task-allow-entitlement"],
1376-
packagePath: fixturePath,
1377-
configuration: buildConfiguration,
1378-
cleanAfterward: false,
1379-
buildSystem: buildSystem
1380-
)
1381-
(
1382-
exitStatus,
1383-
entitlements
1384-
) = try await codesignDisplay(execPath: buildResult.binPath.appending(execName))
1385-
1386-
#expect(exitStatus == .terminated(code: 0))
1387-
verify(entitlements: entitlements, getTaskAllowRequired: false)
1388-
#else
1389-
var buildResult = try await build(
1390-
["-v"],
1391-
packagePath: fixturePath,
1392-
configuration: buildConfiguration,
1393-
buildSystem: buildSystem
1394-
)
1368+
try await executeSwiftPackage(fixturePath, extraArgs: ["clean"], buildSystem: buildSystem)
13951369

1396-
#expect(!buildResult.stdout.contains("codesign --force --sign - --entitlements"))
1370+
buildResult = try await build(
1371+
["--disable-get-task-allow-entitlement"],
1372+
packagePath: fixturePath,
1373+
configuration: buildConfiguration,
1374+
cleanAfterward: false,
1375+
buildSystem: buildSystem
1376+
)
1377+
(
1378+
exitStatus,
1379+
entitlements
1380+
) = try await codesignDisplay(execPath: buildResult.binPath.appending(execName))
1381+
1382+
#expect(exitStatus == .terminated(code: 0))
1383+
verify(entitlements: entitlements, getTaskAllowRequired: false)
1384+
#else
1385+
var buildResult = try await build(
1386+
["-v"],
1387+
packagePath: fixturePath,
1388+
configuration: buildConfiguration,
1389+
buildSystem: buildSystem
1390+
)
13971391

1398-
buildResult = try await build(
1399-
["--disable-get-task-allow-entitlement", "-v"],
1400-
packagePath: fixturePath,
1401-
configuration: buildConfiguration,
1402-
buildSystem: buildSystem,
1403-
)
1392+
#expect(!buildResult.stdout.contains("codesign --force --sign - --entitlements"))
14041393

1405-
#expect(!buildResult.stdout.contains("codesign --force --sign - --entitlements"))
1406-
#expect(buildResult.stderr.contains(SwiftCommandState.entitlementsMacOSWarning))
1394+
buildResult = try await build(
1395+
["--disable-get-task-allow-entitlement", "-v"],
1396+
packagePath: fixturePath,
1397+
configuration: buildConfiguration,
1398+
buildSystem: buildSystem,
1399+
)
14071400

1408-
buildResult = try await build(
1409-
["--enable-get-task-allow-entitlement", "-v"],
1410-
packagePath: fixturePath,
1411-
configuration: buildConfiguration,
1412-
buildSystem: buildSystem,
1413-
)
1401+
#expect(!buildResult.stdout.contains("codesign --force --sign - --entitlements"))
1402+
#expect(buildResult.stderr.contains(SwiftCommandState.entitlementsMacOSWarning))
14141403

1415-
#expect(!buildResult.stdout.contains("codesign --force --sign - --entitlements"))
1416-
#expect(buildResult.stderr.contains(SwiftCommandState.entitlementsMacOSWarning))
1417-
#endif
1418-
}
1419-
} when: {
1420-
[.xcode].contains(buildSystem) && ProcessInfo.hostOperatingSystem != .linux
1404+
buildResult = try await build(
1405+
["--enable-get-task-allow-entitlement", "-v"],
1406+
packagePath: fixturePath,
1407+
configuration: buildConfiguration,
1408+
buildSystem: buildSystem,
1409+
)
1410+
1411+
#expect(!buildResult.stdout.contains("codesign --force --sign - --entitlements"))
1412+
#expect(buildResult.stderr.contains(SwiftCommandState.entitlementsMacOSWarning))
1413+
#endif
14211414
}
14221415
}
14231416

0 commit comments

Comments
 (0)