Skip to content

Commit 914868a

Browse files
theunitheuni
committed
build: add a deterministic dmg signer
1 parent d69ed2b commit 914868a

File tree

5 files changed

+153
-2
lines changed

5 files changed

+153
-2
lines changed

‎Makefile.am‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,9 @@ WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/bitcoin.ico \
2626

2727
OSX_PACKAGING = $(OSX_DEPLOY_SCRIPT) $(OSX_FANCY_PLIST) $(OSX_INSTALLER_ICONS) \
2828
$(top_srcdir)/contrib/macdeploy/background.png \
29-
$(top_srcdir)/contrib/macdeploy/DS_Store
29+
$(top_srcdir)/contrib/macdeploy/DS_Store \
30+
$(top_srcdir)/contrib/macdeploy/detached-sig-apply.sh \
31+
$(top_srcdir)/contrib/macdeploy/detached-sig-create.sh
3032

3133
COVERAGE_INFO = baseline_filtered_combined.info baseline.info block_test.info \
3234
leveldb_baseline.info test_bitcoin_filtered.info total_coverage.info \

‎contrib/gitian-descriptors/gitian-osx-signer.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
name: "bitcoin-dmg-signer"
3+
suites:
4+
- "precise"
5+
architectures:
6+
- "amd64"
7+
packages:
8+
- "libc6:i386"
9+
- "faketime"
10+
reference_datetime: "2013-06-01 00:00:00"
11+
remotes: []
12+
files:
13+
- "bitcoin-0.9.99-osx-unsigned.tar.gz"
14+
- "signature.tar.gz"
15+
script: |
16+
WRAP_DIR=$HOME/wrapped
17+
mkdir -p ${WRAP_DIR}
18+
export PATH=`pwd`:$PATH
19+
FAKETIME_PROGS="dmg genisoimage"
20+
21+
# Create global faketime wrappers
22+
for prog in ${FAKETIME_PROGS}; do
23+
echo '#!/bin/bash' > ${WRAP_DIR}/${prog}
24+
echo "REAL=\`which -a ${prog} | grep -v ${WRAP_DIR}/${prog} | head -1\`" >> ${WRAP_DIR}/${prog}
25+
echo 'export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1' >> ${WRAP_DIR}/${prog}
26+
echo "export FAKETIME=\"${REFERENCE_DATETIME}\"" >> ${WRAP_DIR}/${prog}
27+
echo "\$REAL \$@" >> $WRAP_DIR/${prog}
28+
chmod +x ${WRAP_DIR}/${prog}
29+
done
30+
31+
UNSIGNED=`echo bitcoin-*.tar.gz`
32+
SIGNED=`echo ${UNSIGNED} | sed 's/.tar.*//' | sed 's/-unsigned//'`.dmg
33+
34+
tar -xf ${UNSIGNED}
35+
./detached-sig-apply.sh ${UNSIGNED} signature.tar.gz
36+
${WRAP_DIR}/genisoimage -no-cache-inodes -D -l -probe -V "Bitcoin-Qt" -no-pad -r -apple -o uncompressed.dmg signed-app
37+
${WRAP_DIR}/dmg dmg uncompressed.dmg ${OUTDIR}/${SIGNED}

‎contrib/gitian-descriptors/gitian-osx.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,21 @@ script: |
106106
./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS}
107107
make ${MAKEOPTS}
108108
make install-strip
109+
110+
make deploydir
111+
mkdir -p unsigned-app-${i}
112+
cp contrib/macdeploy/detached-sig-apply.sh unsigned-app-${i}
113+
cp contrib/macdeploy/detached-sig-create.sh unsigned-app-${i}
114+
cp ${BASEPREFIX}/${i}/native/bin/dmg ${BASEPREFIX}/${i}/native/bin/genisoimage unsigned-app-${i}
115+
cp ${BASEPREFIX}/${i}/native/bin/${i}-codesign_allocate unsigned-app-${i}/codesign_allocate
116+
cp ${BASEPREFIX}/${i}/native/bin/${i}-pagestuff unsigned-app-${i}/pagestuff
117+
mv dist unsigned-app-${i}
118+
pushd unsigned-app-${i}
119+
find . | sort | tar --no-recursion -czf ${OUTDIR}/${DISTNAME}-osx-unsigned.tar.gz -T -
120+
popd
121+
109122
make deploy
110-
${WRAP_DIR}/dmg dmg Bitcoin-Qt.dmg ${OUTDIR}/${DISTNAME}-osx.dmg
123+
${WRAP_DIR}/dmg dmg Bitcoin-Qt.dmg ${OUTDIR}/${DISTNAME}-osx-unsigned.dmg
111124
112125
cd installed
113126
find . -name "lib*.la" -delete

‎contrib/macdeploy/detached-sig-apply.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/sh
2+
set -e
3+
4+
UNSIGNED=$1
5+
SIGNATURE=$2
6+
ARCH=x86_64
7+
ROOTDIR=dist
8+
BUNDLE=${ROOTDIR}/Bitcoin-Qt.app
9+
TEMPDIR=signed.temp
10+
OUTDIR=signed-app
11+
12+
if [ -z "$UNSIGNED" ]; then
13+
echo "usage: $0 <unsigned app> <signature>"
14+
exit 1
15+
fi
16+
17+
if [ -z "$SIGNATURE" ]; then
18+
echo "usage: $0 <unsigned app> <signature>"
19+
exit 1
20+
fi
21+
22+
rm -rf ${TEMPDIR} && mkdir -p ${TEMPDIR}
23+
tar -C ${TEMPDIR} -xf ${UNSIGNED}
24+
tar -C ${TEMPDIR} -xf ${SIGNATURE}
25+
26+
if [ -z "${PAGESTUFF}" ]; then
27+
PAGESTUFF=${TEMPDIR}/pagestuff
28+
fi
29+
30+
if [ -z "${CODESIGN_ALLOCATE}" ]; then
31+
CODESIGN_ALLOCATE=${TEMPDIR}/codesign_allocate
32+
fi
33+
34+
for i in `find ${TEMPDIR} -name "*.sign"`; do
35+
SIZE=`stat -c %s ${i}`
36+
TARGET_FILE=`echo ${i} | sed 's/\.sign$//'`
37+
38+
echo "Allocating space for the signature of size ${SIZE} in ${TARGET_FILE}"
39+
${CODESIGN_ALLOCATE} -i ${TARGET_FILE} -a ${ARCH} ${SIZE} -o ${i}.tmp
40+
41+
OFFSET=`${PAGESTUFF} ${i}.tmp -p | tail -2 | grep offset | sed 's/[^0-9]*//g'`
42+
if [ -z ${QUIET} ]; then
43+
echo "Attaching signature at offset ${OFFSET}"
44+
fi
45+
46+
dd if=$i of=${i}.tmp bs=1 seek=${OFFSET} count=${SIZE} 2>/dev/null
47+
mv ${i}.tmp ${TARGET_FILE}
48+
rm ${i}
49+
echo "Success."
50+
done
51+
mv ${TEMPDIR}/${ROOTDIR} ${OUTDIR}
52+
rm -rf ${TEMPDIR}
53+
echo "Signed: ${OUTDIR}"

‎contrib/macdeploy/detached-sig-create.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/sh
2+
set -e
3+
4+
ROOTDIR=dist
5+
BUNDLE=${ROOTDIR}/Bitcoin-Qt.app
6+
CODESIGN=codesign
7+
TEMPDIR=sign.temp
8+
TEMPLIST=${TEMPDIR}/signatures.txt
9+
OUT=signature.tar.gz
10+
11+
if [ ! -n "$1" ]; then
12+
echo "usage: $0 <codesign args>"
13+
echo "example: $0 -s MyIdentity"
14+
exit 1
15+
fi
16+
17+
rm -rf ${TEMPDIR} ${TEMPLIST}
18+
mkdir -p ${TEMPDIR}
19+
20+
${CODESIGN} -f --file-list ${TEMPLIST} "$@" "${BUNDLE}"
21+
22+
for i in `grep -v CodeResources ${TEMPLIST}`; do
23+
TARGETFILE="${BUNDLE}/`echo ${i} | sed "s|.*${BUNDLE}/||"`"
24+
SIZE=`pagestuff $i -p | tail -2 | grep size | sed 's/[^0-9]*//g'`
25+
OFFSET=`pagestuff $i -p | tail -2 | grep offset | sed 's/[^0-9]*//g'`
26+
SIGNFILE="${TEMPDIR}/${TARGETFILE}.sign"
27+
DIRNAME="`dirname ${SIGNFILE}`"
28+
mkdir -p "${DIRNAME}"
29+
echo "Adding detached signature for: ${TARGETFILE}. Size: ${SIZE}. Offset: ${OFFSET}"
30+
dd if=$i of=${SIGNFILE} bs=1 skip=${OFFSET} count=${SIZE} 2>/dev/null
31+
done
32+
33+
for i in `grep CodeResources ${TEMPLIST}`; do
34+
TARGETFILE="${BUNDLE}/`echo ${i} | sed "s|.*${BUNDLE}/||"`"
35+
RESOURCE="${TEMPDIR}/${TARGETFILE}"
36+
DIRNAME="`dirname "${RESOURCE}"`"
37+
mkdir -p "${DIRNAME}"
38+
echo "Adding resource for: "${TARGETFILE}""
39+
cp "${i}" "${RESOURCE}"
40+
done
41+
42+
rm ${TEMPLIST}
43+
44+
tar -C ${TEMPDIR} -czf ${OUT} .
45+
rm -rf ${TEMPDIR}
46+
echo "Created ${OUT}"

0 commit comments

Comments
 (0)