refactor(macos): streamline KDF binary placement; update signing flow #247
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
|
|
@@ -16,26 +16,22 @@ A new Flutter FFI plugin project. | |||||||
| s.dependency 'FlutterMacOS' | ||||||||
|
|
||||||||
| s.resource_bundles = { | ||||||||
| 'kdf_resources' => ['lib/*.dylib'].select { |f| Dir.exist?(File.dirname(f)) } | ||||||||
| } | ||||||||
|
|
||||||||
| # s.preserve_paths = ['bin/kdf'] | ||||||||
|
There was a problem hiding this comment. Bug: Missing
|
||||||||
|
|
||||||||
| s.script_phase = { | ||||||||
| :name => 'Install kdf executable and/or dylib', | ||||||||
| :execution_position => :before_compile, | ||||||||
| :script => <<-SCRIPT | ||||||||
| # Get the application support directory for macOS | ||||||||
| APP_SUPPORT_DIR="${BUILT_PRODUCTS_DIR}/${PRODUCT_NAME}.app/Contents/Library/Application Support" | ||||||||
| FRAMEWORKS_DIR="${BUILT_PRODUCTS_DIR}/${PRODUCT_NAME}.app/Contents/Frameworks" | ||||||||
| HELPERS_DIR="${TARGET_BUILD_DIR}/${CONTENTS_FOLDER_PATH}/Helpers" | ||||||||
|
|
||||||||
| # Create all required directories in one go | ||||||||
| mkdir -p "$APP_SUPPORT_DIR" "$FRAMEWORKS_DIR" "$HELPERS_DIR" | ||||||||
|
|
||||||||
|
Comment on lines
28
to
35
There was a problem hiding this comment.
The macOS script now defines Useful? React with 👍 / 👎. |
||||||||
| # Track if we found at least one of the required files | ||||||||
| FOUND_REQUIRED_FILE=0 | ||||||||
|
|
@@ -61,54 +57,74 @@ A new Flutter FFI plugin project. | |||||||
| fi | ||||||||
|
|
||||||||
| # Prune binary slices to match $ARCHS (preserve universals) in Release builds only | ||||||||
| case "$CONFIGURATION" in | ||||||||
| Release*) | ||||||||
|
Comment on lines
+60
to
+61
There was a problem hiding this comment. The case statement is missing a pattern terminator (;;). Shell case syntax requires ';;' after the commands for the Release* branch; without it the script will error at 'esac'. Add ';;' after the last command inside the Release* section before line 101. |
||||||||
| TARGET_ARCHS="${ARCHS:-$(arch)}" | ||||||||
|
|
||||||||
| thin_binary_to_archs() { | ||||||||
| file="$1" | ||||||||
| keep_archs="$2" | ||||||||
|
|
||||||||
| [ -f "$file" ] || return 0 | ||||||||
|
|
||||||||
| # Only act on fat files (multi-arch) | ||||||||
| if ! lipo -info "$file" | grep -q 'Architectures in the fat file'; then | ||||||||
| return 0 | ||||||||
| fi | ||||||||
|
|
||||||||
| bin_archs="$(lipo -archs "$file" 2>/dev/null || true)" | ||||||||
| [ -n "$bin_archs" ] || return 0 | ||||||||
|
|
||||||||
| dir="$(dirname "$file")" | ||||||||
| base="$(basename "$file")" | ||||||||
| work="$file" | ||||||||
|
|
||||||||
| for arch in $bin_archs; do | ||||||||
| echo "$keep_archs" | tr ' ' '\n' | grep -qx "$arch" && continue | ||||||||
| echo "Removing architecture $arch from $base" | ||||||||
| next="$(mktemp "$dir/.${base}.XXXXXX")" | ||||||||
| lipo "$work" -remove "$arch" -output "$next" | ||||||||
| [ "$work" != "$file" ] && rm -f "$work" | ||||||||
| work="$next" | ||||||||
| done | ||||||||
|
|
||||||||
| if [ "$work" != "$file" ]; then | ||||||||
| mv -f "$work" "$file" | ||||||||
| fi | ||||||||
| } | ||||||||
|
|
||||||||
| thin_binary_to_archs "$APP_SUPPORT_DIR/kdf" "$TARGET_ARCHS" | ||||||||
| if [ -f "$APP_SUPPORT_DIR/kdf" ]; then chmod +x "$APP_SUPPORT_DIR/kdf"; fi | ||||||||
|
|
||||||||
| thin_binary_to_archs "$FRAMEWORKS_DIR/libkdflib.dylib" "$TARGET_ARCHS" | ||||||||
| if [ -f "$FRAMEWORKS_DIR/libkdflib.dylib" ]; then install_name_tool -id "@rpath/libkdflib.dylib" "$FRAMEWORKS_DIR/libkdflib.dylib"; fi | ||||||||
|
There was a problem hiding this comment. The case statement is missing a pattern terminator (;;). Shell case syntax requires ';;' after the commands for the Release* branch; without it the script will error at 'esac'. Add ';;' after the last command inside the Release* section before line 101.
Suggested change
|
||||||||
| esac | ||||||||
|
|
||||||||
| # Signs a framework with the provided identity | ||||||||
| code_sign_if_enabled() { | ||||||||
| if [ -n "${EXPANDED_CODE_SIGN_IDENTITY:-}" -a "${CODE_SIGNING_REQUIRED:-}" != "NO" -a "${CODE_SIGNING_ALLOWED}" != "NO" ]; then | ||||||||
| # Use the current code_sign_identity | ||||||||
| echo "Code Signing $1 with Identity ${EXPANDED_CODE_SIGN_IDENTITY_NAME}" | ||||||||
| local code_sign_cmd="/usr/bin/codesign --force --sign ${EXPANDED_CODE_SIGN_IDENTITY} ${OTHER_CODE_SIGN_FLAGS:-} --preserve-metadata=identifier,entitlements '$1'" | ||||||||
|
|
||||||||
| if [ "${COCOAPODS_PARALLEL_CODE_SIGN}" == "true" ]; then | ||||||||
| code_sign_cmd="$code_sign_cmd &" | ||||||||
| fi | ||||||||
| echo "$code_sign_cmd" | ||||||||
| eval "$code_sign_cmd" | ||||||||
| else | ||||||||
| echo "Code Signing DISABLED. Is this correct for your configuration?" | ||||||||
| fi | ||||||||
| } | ||||||||
|
|
||||||||
| # Resign the code if required by the build settings to avoid unstable apps | ||||||||
| code_sign_if_enabled "$APP_SUPPORT_DIR/kdf" || true | ||||||||
| # Helpers in komodo_defi_framework is now the ONLY place where KdfExecutableFinder.findExecutable() | ||||||||
| # will look for the kdf binary on macOS. The APP_SUPPORT_DIR copy is redundant but kept for | ||||||||
| # backward compatibility with older builds. | ||||||||
| if [ -f "$APP_SUPPORT_DIR/kdf" ]; then cp "$APP_SUPPORT_DIR/kdf" "$HELPERS_DIR/kdf"; fi | ||||||||
|
There was a problem hiding this comment. The kdf binary is signed before being copied into Helpers, but the copy placed in Helpers (the only lookup location) is never re-signed. This can leave the executed binary unsigned, triggering Gatekeeper or runtime issues. Invoke code_sign_if_enabled on '$HELPERS_DIR/kdf' after the copy (or copy first, then sign both locations if backward compatibility is needed).
Suggested change
|
||||||||
| code_sign_if_enabled "$FRAMEWORKS_DIR/libkdflib.dylib" || true | ||||||||
|
|
||||||||
| # Fail if neither file was found | ||||||||
| if [ $FOUND_REQUIRED_FILE -eq 0 ]; then | ||||||||
| echo "Error: Neither kdf executable nor libkdflib.dylib was found. At least one is required." | ||||||||
|
|
||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Bug: Dart Code Mismatch with Podspec Path
The Dart code expects the
kdfbinary within the framework atVersions/Current/Helpers/kdf, but the podspec copies it toContents/Helpers/kdf. This path mismatch prevents the executable finder from locating the binary at runtime.Additional Locations (1)
packages/komodo_defi_framework/macos/komodo_defi_framework.podspec#L30-L34