Re: [cbi-dev] OS X application signing

[Mikaël Barbero <mikael@xxxxxxxxxxx>]

Hi,

As you can see from your build log:

 --- tycho-p2-director-plugin:0.23.0:archive-products (archive-products) @ org.eclipse.ice.repository ---
[INFO] Building zip: /jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product-linux.gtk.x86.zip
[INFO] Building zip: /jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product-linux.gtk.x86_64.zip
[INFO] Building zip: /jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product-win32.win32.x86.zip
[INFO] Building zip: /jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product-win32.win32.x86_64.zip
[INFO] Building zip: /jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product-macosx.cocoa.x86_64.zip
[INFO] 
[INFO] --- tycho-pack200a-plugin:0.23.0:normalize (pack200-normalize) @ org.eclipse.ice.repository ---
[INFO] 
[INFO] --- eclipse-jarsigner-plugin:1.1.3:sign (sign) @ org.eclipse.ice.repository ---
[INFO] 
[INFO] --- tycho-pack200b-plugin:0.23.0:pack (pack200-pack) @ org.eclipse.ice.repository ---
[INFO] 
[INFO] --- tycho-p2-plugin:0.23.0:p2-metadata (p2-metadata) @ org.eclipse.ice.repository ---
[INFO] 
[INFO] --- eclipse-winsigner-plugin:1.1.3:sign (default) @ org.eclipse.ice.repository ---
[INFO] [Tue Mar 01 14:00:23 EST 2016] Signing Windows executable '/jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product/win32/win32/x86/eclipsec.exe'
[INFO] [Tue Mar 01 14:00:24 EST 2016] Signing Windows executable '/jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product/win32/win32/x86_64/eclipsec.exe'
[INFO] 
[INFO] --- eclipse-macsigner-plugin:1.1.3:sign (default) @ org.eclipse.ice.repository ---
[INFO] [Tue Mar 01 14:00:50 EST 2016] Signing OS X application '/jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product/macosx/cocoa/x86_64/ICE.app'...
[INFO] 

The product archives are being done before the signing. It means that the bits in the zip are not signed and you're signing things in target/products/ice.product but they are not rezipped afterwards. You need to change your pom to be sure the CBI signer plugins are executed *before* the "archive-products" step.

Cheers,

Mikael

Le 1 mars 2016 à 22:59, Greg Watson <greg@watson.earth> a écrit :

Hi, I’m having trouble getting OS X application signing to work.

I added the following to our build:

                  <plugin>
                      <groupId>org.eclipse.cbi.maven.plugins</groupId>
                      <artifactId>eclipse-macsigner-plugin</artifactId>
                      <version>${cbi-plugins.version}</version>
                      <executions>
                          <execution>
                              <goals>
                                  <goal>sign</goal>
                              </goals>
                              <phase>package</phase>
<configuration>
<signFiles>
<signFile>${project.build.directory}/products/ice.product/macosx/cocoa/x86_64/ICE.app</signFile>
</signFiles>
</configuration>
                          </execution>
                      </executions>
                  </plugin>

When the build runs, it says:

[INFO] --- eclipse-macsigner-plugin:1.1.3:sign (default) @ org.eclipse.ice.repository ---
[INFO] [Tue Mar 01 12:42:09 EST 2016] Signing OS X application '/jobs/genie.ice/ice-next/workspace/ice/org.eclipse.ice.repository/target/products/ice.product/macosx/cocoa/x86_64/ICE.app'…

Here is the build output: https://hudson.eclipse.org/ice/job/ice-next/84/console

However, the codesign command says:

$ codesign --verify ICE.app
ICE.app: code object is not signed at all
In architecture: x86_64

Any help or suggestions appreciated.

Greg

_______________________________________________
cbi-dev mailing list
cbi-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/cbi-dev

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail