Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug Fix For MacOS code signing resilience check. #756

Closed
wants to merge 8 commits into from
Closed

Bug Fix For MacOS code signing resilience check. #756

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
eab15dd
Add check for codesigning process.
steelhead31 Jul 5, 2023
cf90489
Add looping signing attempts
steelhead31 Jul 5, 2023
ecbf38c
Fix extra space
steelhead31 Jul 5, 2023
2cad753
Review fixes
steelhead31 Jul 6, 2023
56bf947
Add fail switch to curl
steelhead31 Jul 6, 2023
75ee4c5
Use constant for signing string.
steelhead31 Jul 6, 2023
cc3417e
Bug fix in library signing check.
steelhead31 Jul 12, 2023
f3881e9
Merge branch 'master' into fix_issue_596
steelhead31 Jul 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 44 additions & 36 deletions pipelines/build/common/openjdk_build_pipeline.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1479,7 +1479,7 @@ class Build {
context.withEnv(["macos_base_path=${macos_base_path}"]) {
// groovylint-disable
try {
context.sh '''
context.sh '''
#!/bin/bash
set -eu
echo "Signing JMOD files"
Expand All @@ -1489,43 +1489,51 @@ class Build {
FILES=$(find "${TMP_DIR}" -perm +111 -type f -o -name '*.dylib' -type f || find "${TMP_DIR}" -perm /111 -type f -o -name '*.dylib' -type f)
for f in $FILES
do
echo "Signing $f using Eclipse Foundation codesign service"
dir=$(dirname "$f")
file=$(basename "$f")
mv "$f" "${dir}/unsigned_${file}"
curl --fail -o "$f" -F file="@${dir}/unsigned_${file}" -F entitlements="@$ENTITLEMENTS" https://cbi.eclipse.org/macos/codesign/sign
TESTMACSIGN=`grep -i "$MACSIGNSTRING" "$f"|wc -l`
if [ $TESTMACSIGN -gt 0 ]
echo "Signing $f using Eclipse Foundation codesign service"
dir=$(dirname "$f")
file=$(basename "$f")
mv "$f" "${dir}/unsigned_${file}"
curl --fail --silent --show-error -o "$f" -F file="@${dir}/unsigned_${file}" -F entitlements="@$ENTITLEMENTS" https://cbi.eclipse.org/macos/codesign/sign
echo File = $f
TESTMACSIGN=`grep -i "$MACSIGNSTRING" "$f"|wc -l`
echo "Sign Result = $TESTMACSIGN"
if [[ $TESTMACSIGN -gt 0 ]]
then
echo "Code Signed For File $f"
chmod --reference="${dir}/unsigned_${file}" "$f"
rm -rf "${dir}/unsigned_${file}"
else
max_iterations=20
iteration=1
success=false
errcount=0
echo "Code Not Signed For File $f"
while [[ $iteration -le $max_iterations ]] && [ $success = false ]; do
echo $iteration Of $max_iterations
sleep 1
curl --fail -o "$f" -F file="@${dir}/unsigned_${file}" -F entitlements="@$ENTITLEMENTS" https://cbi.eclipse.org/macos/codesign/sign
TESTMACSIGN2=`grep -i "$MACSIGNSTRING" "$f"|wc -l`
echo TESTMACSIGN2 = $TESTMACSIGN2
if [[ $TESTMACSIGN2 -gt 0 ]]
then
echo "$f Signed OK On Attempt $iteration"
chmod --reference="${dir}/unsigned_${file}" "$f"
rm -rf "${dir}/unsigned_${file}"
success=true
else
echo "$f Failed Signing On Attempt $iteration"
success=false
iteration=$((iteration+1))
errcount=$((errcount+1))
fi
done
if [[ $errcount -gt 0 ]]
then
echo "Code Signed"
chmod --reference="${dir}/unsigned_${file}" "$f"
rm -rf "${dir}/unsigned_${file}"
else
max_iterations=20
iteration=1
while [ $iteration -le $max_iterations ]
do
echo "Code Not Signed - Have Another Try"
sleep 1
curl --fail -o "$f" -F file="@${dir}/unsigned_${file}" -F entitlements="@$ENTITLEMENTS" https://cbi.eclipse.org/macos/codesign/sign
TESTMACSIGN2=`grep -i "$MACSIGNSTRING" "$f"|wc -l`
if [ $TESTMACSIGN2 -gt 0 ]
then
echo "$f Signed OK On Attempt $iteration"
chmod --reference="${dir}/unsigned_${file}" "$f"
rm -rf "${dir}/unsigned_${file}"
break
else
echo "$f Failed Signing On Attempt $iteration"
iteration=$((iteration+1))
fi
if [ $iteration -eq $max_iterations ]
then
echo "Reached Max Attempts = $max_iterations"
exit 1
fi
done
echo "Errors Encountered During Signing"
echo "Error Count = $errcount"
exit 1
fi
fi
done
'''
} catch (e) {
Expand Down