--- old/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/MacAppImageBuilder.java 2020-03-23 12:55:40.061716800 -0400 +++ new/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/MacAppImageBuilder.java 2020-03-23 12:55:38.232745400 -0400 @@ -85,6 +85,11 @@ private static List keyChains; + private final static String DEFAULT_ENTITLEMENTS = + "Mac.entitlements"; + private final static String DEFAULT_INHERIT_ENTITLEMENTS = + "Mac_Inherit.entitlements"; + public static final BundlerParamInfo MAC_CONFIGURE_LAUNCHER_IN_PLIST = new StandardBundlerParam<>( "mac.configure-launcher-in-plist", @@ -162,6 +167,22 @@ null : Boolean.valueOf(s) ); +/* + public static final StandardBundlerParam MAC_ENTITLEMENTS = + new StandardBundlerParam<>( + Arguments.CLIOptions.MAC_ENTITLEMENTS.getId(), + File.class, + params -> null, + (s, p) -> new File(s)); + + public static final StandardBundlerParam MAC_INHERIT_ENTITLEMENTS = + new StandardBundlerParam<>( + Arguments.CLIOptions.MAC_INHERIT_ENTITLEMENTS.getId(), + File.class, + params -> null, + (s, p) -> new File(s)); +*/ + public MacAppImageBuilder(Map params, Path imageOutDir) throws IOException { super(params, imageOutDir.resolve(APP_NAME.fetchFrom(params) @@ -368,13 +389,42 @@ String signingIdentity = DEVELOPER_ID_APP_SIGNING_KEY.fetchFrom(params); if (signingIdentity != null) { + prepareEntitlements(params); signAppBundle(params, root, signingIdentity, - BUNDLE_ID_SIGNING_PREFIX.fetchFrom(params), null, null); + BUNDLE_ID_SIGNING_PREFIX.fetchFrom(params), + getConfig_Entitlements(params).toString(), + getConfig_Inherit_Entitlements(params).toString()); } restoreKeychainList(params); } } + private File getConfig_Entitlements(Map params) { + return new File(CONFIG_ROOT.fetchFrom(params), + getLauncherName(params) + ".entitlements"); + } + + private File getConfig_Inherit_Entitlements( + Map params) { + return new File(CONFIG_ROOT.fetchFrom(params), + getLauncherName(params) + "_Inherit.entitlements"); + } + + private void prepareEntitlements(Map params) + throws IOException { + createResource(DEFAULT_ENTITLEMENTS, params) + .setCategory(I18N.getString("resource.mac-entitlements")) + // .setExternal(MAC_ENTITLEMENTS.fetchFrom(params)) + .saveToFile(getConfig_Entitlements(params)); + + createResource(DEFAULT_INHERIT_ENTITLEMENTS, params) + .setCategory(I18N.getString( + "resource.mac-inherit-entitlements")) + // .setExternal(MAC_INHERIT_ENTITLEMENTS.fetchFrom(params)) + .saveToFile(getConfig_Inherit_Entitlements(params)); + } + + private String getLauncherName(Map params) { if (APP_NAME.fetchFrom(params) != null) { return APP_NAME.fetchFrom(params); @@ -762,7 +812,8 @@ && !(p.toString().contains("/Contents/MacOS/libjli.dylib") || p.toString().endsWith(appExecutable) || p.toString().contains("/Contents/runtime") - || p.toString().contains("/Contents/Frameworks"))).forEach(p -> { + || p.toString().contains("/Contents/Frameworks")) + ).forEach(p -> { //noinspection ThrowableResultOfMethodCallIgnored if (toThrow.get() != null) return; @@ -778,12 +829,14 @@ return; } } - List args = new ArrayList<>(); args.addAll(Arrays.asList("codesign", - "-s", signingIdentity, // sign with this key + "--timestamp", + "--options", "runtime", + "--deep", + "--force", + "-s", signingIdentity, "--prefix", identifierPrefix, - // use the identifier as a prefix "-vvvv")); if (entitlementsFile != null && (p.toString().endsWith(".jar") @@ -836,6 +889,19 @@ "--prefix", identifierPrefix, // use the identifier as a prefix "-vvvv")); + + if (entitlementsFile != null && + (path.toString().endsWith(".jar") + || path.toString().endsWith(".dylib"))) { + args.add("--entitlements"); + args.add(entitlementsFile); // entitlements + } else if (inheritedEntitlements != null && + Files.isExecutable(path)) { + args.add("--entitlements"); + args.add(inheritedEntitlements); + // inherited entitlements for executable processes + } + if (keyChain != null && !keyChain.isEmpty()) { args.add("--keychain"); args.add(keyChain); @@ -844,11 +910,15 @@ ProcessBuilder pb = new ProcessBuilder(args); IOUtils.exec(pb); + args = new ArrayList<>(); args.addAll(Arrays.asList("codesign", - "-s", signingIdentity, // sign with this key + "--timestamp", + "--options", "runtime", + "--deep", + "--force", + "-s", signingIdentity, "--prefix", identifierPrefix, - // use the identifier as a prefix "-vvvv")); if (keyChain != null && !keyChain.isEmpty()) { args.add("--keychain"); @@ -886,8 +956,12 @@ // sign the app itself List args = new ArrayList<>(); args.addAll(Arrays.asList("codesign", - "-s", signingIdentity, // sign with this key - "-vvvv")); // super verbose output + "--timestamp", + "--options", "runtime", + "--deep", + "--force", + "-s", signingIdentity, + "-vvvv")); if (entitlementsFile != null) { args.add("--entitlements"); args.add(entitlementsFile); // entitlements --- old/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/MacAppStoreBundler.java 2020-03-23 12:55:54.124273000 -0400 +++ new/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/MacAppStoreBundler.java 2020-03-23 12:55:52.332316700 -0400 @@ -41,9 +41,9 @@ private static final String TEMPLATE_BUNDLE_ICON_HIDPI = "java.icns"; private final static String DEFAULT_ENTITLEMENTS = - "MacAppStore.entitlements"; + "Mac.entitlements"; private final static String DEFAULT_INHERIT_ENTITLEMENTS = - "MacAppStore_Inherit.entitlements"; + "Mac_Inherit.entitlements"; public static final BundlerParamInfo MAC_APP_STORE_APP_SIGNING_KEY = new StandardBundlerParam<>( @@ -94,13 +94,22 @@ }, (s, p) -> s); - public static final StandardBundlerParam MAC_APP_STORE_ENTITLEMENTS = +/* + public static final StandardBundlerParam MAC_ENTITLEMENTS = new StandardBundlerParam<>( - Arguments.CLIOptions.MAC_APP_STORE_ENTITLEMENTS.getId(), + Arguments.CLIOptions.MAC_ENTITLEMENTS.getId(), File.class, params -> null, (s, p) -> new File(s)); + public static final StandardBundlerParam MAC_INHERIT_ENTITLEMENTS = + new StandardBundlerParam<>( + Arguments.CLIOptions.MAC_INHERIT_ENTITLEMENTS.getId(), + File.class, + params -> null, + (s, p) -> new File(s)); +*/ + public static final BundlerParamInfo INSTALLER_SUFFIX = new StandardBundlerParam<> ( "mac.app-store.installerName.suffix", @@ -203,14 +212,15 @@ throws IOException { createResource(DEFAULT_ENTITLEMENTS, params) .setCategory( - I18N.getString("resource.mac-app-store-entitlements")) - .setExternal(MAC_APP_STORE_ENTITLEMENTS.fetchFrom(params)) + I18N.getString("resource.mac-entitlements")) + // .setExternal(MAC_ENTITLEMENTS.fetchFrom(params)) .saveToFile(getConfig_Entitlements(params)); createResource(DEFAULT_INHERIT_ENTITLEMENTS, params) .setCategory(I18N.getString( - "resource.mac-app-store-inherit-entitlements")) - .saveToFile(getConfig_Entitlements(params)); + "resource.mac-inherit-entitlements")) + // .setExternal(MAC_INHERIT_ENTITLEMENTS.fetchFrom(params)) + .saveToFile(getConfig_Inherit_Entitlements(params)); } /////////////////////////////////////////////////////////////////////// --- old/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/MacResources.properties 2020-03-23 12:56:07.760838900 -0400 +++ new/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/MacResources.properties 2020-03-23 12:56:05.927001500 -0400 @@ -46,8 +46,8 @@ resource.bundle-config-file=Bundle config file resource.app-info-plist=Application Info.plist resource.runtime-info-plist=Java Runtime Info.plist -resource.mac-app-store-entitlements=Mac App Store Entitlements -resource.mac-app-store-inherit-entitlements=Mac App Store Inherit Entitlements +resource.mac-entitlements=Mac App Store Entitlements +resource.mac-inherit-entitlements=Mac App Store Inherit Entitlements resource.dmg-setup-script=DMG setup script resource.license-setup=License setup resource.dmg-background=dmg background --- old/src/jdk.incubator.jpackage/share/classes/jdk/incubator/jpackage/internal/Arguments.java 2020-03-23 12:56:21.354312800 -0400 +++ new/src/jdk.incubator.jpackage/share/classes/jdk/incubator/jpackage/internal/Arguments.java 2020-03-23 12:56:19.433477500 -0400 @@ -285,9 +285,6 @@ MAC_SIGNING_KEYCHAIN ("mac-signing-keychain", OptionCategories.PLATFORM_MAC), - MAC_APP_STORE_ENTITLEMENTS ("mac-app-store-entitlements", - OptionCategories.PLATFORM_MAC), - WIN_MENU_HINT ("win-menu", OptionCategories.PLATFORM_WIN, () -> { setOptionValue("win-menu", true); }), --- old/src/jdk.incubator.jpackage/share/classes/jdk/incubator/jpackage/internal/ValidOptions.java 2020-03-23 12:56:34.970541400 -0400 +++ new/src/jdk.incubator.jpackage/share/classes/jdk/incubator/jpackage/internal/ValidOptions.java 2020-03-23 12:56:33.095844500 -0400 @@ -109,12 +109,9 @@ options.put(CLIOptions.MAC_SIGN.getId(), USE.ALL); options.put(CLIOptions.MAC_BUNDLE_NAME.getId(), USE.ALL); options.put(CLIOptions.MAC_BUNDLE_IDENTIFIER.getId(), USE.ALL); - options.put(CLIOptions.MAC_BUNDLE_SIGNING_PREFIX.getId(), - USE.ALL); + options.put(CLIOptions.MAC_BUNDLE_SIGNING_PREFIX.getId(), USE.ALL); options.put(CLIOptions.MAC_SIGNING_KEY_NAME.getId(), USE.ALL); options.put(CLIOptions.MAC_SIGNING_KEYCHAIN.getId(), USE.ALL); - options.put(CLIOptions.MAC_APP_STORE_ENTITLEMENTS.getId(), - USE.ALL); } if (Platform.getPlatform() == Platform.LINUX) { --- /dev/null 2020-03-23 12:56:49.000000000 -0400 +++ new/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/Mac.entitlements 2020-03-23 12:56:46.309667300 -0400 @@ -0,0 +1,18 @@ + + + + + com.apple.security.app-sandbox + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.disable-library-validation + + com.apple.security.cs.allow-dyld-environment-variables + + com.apple.security.cs.debugger + + + --- /dev/null 2020-03-23 12:56:59.000000000 -0400 +++ new/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/Mac_Inherit.entitlements 2020-03-23 12:56:56.440386800 -0400 @@ -0,0 +1,20 @@ + + + + + com.apple.security.app-sandbox + + com.apple.security.inherit + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.disable-library-validation + + com.apple.security.cs.allow-dyld-environment-variables + + com.apple.security.cs.debugger + + + --- old/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/MacAppStore.entitlements 2020-03-23 12:57:08.201649500 -0400 +++ /dev/null 2020-03-23 12:57:09.000000000 -0400 @@ -1,8 +0,0 @@ - - - - - com.apple.security.app-sandbox - - - --- old/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/MacAppStore_Inherit.entitlements 2020-03-23 12:57:15.889214400 -0400 +++ /dev/null 2020-03-23 12:57:17.000000000 -0400 @@ -1,10 +0,0 @@ - - - - - com.apple.security.app-sandbox - - com.apple.security.inherit - - -