mirror of
https://github.com/JetBrains/JetBrainsRuntime.git
synced 2025-12-06 09:29:38 +01:00
95 lines
2.7 KiB
Bash
Executable File
95 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
APP_DIRECTORY=$1
|
|
JB_CERT=$2
|
|
|
|
if [[ -z "$APP_DIRECTORY" ]] || [[ -z "$JB_CERT" ]]; then
|
|
echo "Usage: $0 AppDirectory CertificateID"
|
|
exit 1
|
|
fi
|
|
if [[ ! -d "$APP_DIRECTORY" ]]; then
|
|
echo "AppDirectory '$APP_DIRECTORY' does not exist or not a directory"
|
|
exit 1
|
|
fi
|
|
|
|
function log() {
|
|
echo "$(date '+[%H:%M:%S]') $*"
|
|
}
|
|
|
|
#immediately exit script with an error if a command fails
|
|
set -euo pipefail
|
|
|
|
# Cleanup files left from previous sign attempt (if any)
|
|
find "$APP_DIRECTORY" -name '*.cstemp' -exec rm '{}' \;
|
|
|
|
log "Signing libraries and executables..."
|
|
# -perm +111 searches for executables
|
|
for f in \
|
|
"Contents/Home/bin" \
|
|
"Contents/Home/lib" \
|
|
"Contents/Frameworks"; do
|
|
if [ -d "$APP_DIRECTORY/$f" ]; then
|
|
find "$APP_DIRECTORY/$f" \
|
|
-type f \( -name "*.jnilib" -o -name "*.dylib" -o -name "*.so" -o -perm +111 \) \
|
|
-exec codesign --timestamp \
|
|
-v -s "$JB_CERT" --options=runtime \
|
|
--entitlements entitlements.xml {} \;
|
|
fi
|
|
done
|
|
|
|
log "Signing libraries in jars in $PWD"
|
|
|
|
# todo: add set -euo pipefail; into the inner sh -c
|
|
# `-e` prevents `grep -q && printf` loginc
|
|
# with `-o pipefail` there's no input for 'while' loop
|
|
find "$APP_DIRECTORY" -name '*.jar' \
|
|
-exec sh -c "set -u; unzip -l \"\$0\" | grep -q -e '\.dylib\$' -e '\.jnilib\$' -e '\.so\$' -e '^jattach\$' && printf \"\$0\0\" " {} \; |
|
|
while IFS= read -r -d $'\0' file; do
|
|
log "Processing libraries in $file"
|
|
|
|
rm -rf jarfolder jar.jar
|
|
mkdir jarfolder
|
|
filename="${file##*/}"
|
|
log "Filename: $filename"
|
|
cp "$file" jarfolder && (cd jarfolder && jar xf "$filename" && rm "$filename")
|
|
|
|
find jarfolder \
|
|
-type f \( -name "*.jnilib" -o -name "*.dylib" -o -name "*.so" -o -name "jattach" \) \
|
|
-exec codesign --timestamp \
|
|
-v -s "$JB_CERT" --options=runtime \
|
|
--entitlements entitlements.xml {} \;
|
|
|
|
(cd jarfolder; zip -q -r -o ../jar.jar .)
|
|
mv jar.jar "$file"
|
|
done
|
|
|
|
rm -rf jarfolder jar.jar
|
|
|
|
log "Signing other files..."
|
|
for f in \
|
|
"Contents/MacOS"; do
|
|
if [ -d "$APP_DIRECTORY/$f" ]; then
|
|
find "$APP_DIRECTORY/$f" \
|
|
-type f \( -name "*.jnilib" -o -name "*.dylib" -o -name "*.so" -o -perm +111 \) \
|
|
-exec codesign --timestamp \
|
|
-v -s "$JB_CERT" --options=runtime \
|
|
--entitlements entitlements.xml {} \;
|
|
fi
|
|
done
|
|
|
|
#log "Signing executable..."
|
|
#codesign --timestamp \
|
|
# -v -s "$JB_CERT" --options=runtime \
|
|
# --force \
|
|
# --entitlements entitlements.xml "$APP_DIRECTORY/Contents/MacOS/idea"
|
|
|
|
log "Signing whole app..."
|
|
codesign --timestamp \
|
|
-v -s "$JB_CERT" --options=runtime \
|
|
--force \
|
|
--entitlements entitlements.xml "$APP_DIRECTORY"
|
|
|
|
log "Verifying java is not broken"
|
|
find "$APP_DIRECTORY" \
|
|
-type f -name 'java' -perm +111 -exec {} -version \;
|