Set entitlements in non-release in $(INSTROOTBASE) and .dmg package

Also, when building a .dmg for macOS, skip codesigning for non-release
builds, both with and without the macOS sandbox, if there is no identity
set but set entitlements to allow Xcode's Instruments application to
connect to the application.

Lastly, add entitlements when building soffice in $(INSTROOTBASE) if
this is a non-release build.

Change-Id: I764bf5bd5d44e878669c4287906e6efd6aac593f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152655
Tested-by: Jenkins
Reviewed-by: Patrick Luby <plubius@neooffice.org>

config_host.mk.in

@@ -760,6 +760,7 @@ export ZLIB_CFLAGS=$(gb_SPACE)@ZLIB_CFLAGS@
 export ZLIB_LIBS=$(gb_SPACE)@ZLIB_LIBS@
 export ZMF_CFLAGS=$(gb_SPACE)@ZMF_CFLAGS@
 export ZMF_LIBS=$(gb_SPACE)@ZMF_LIBS@
+export GET_TASK_ALLOW_ENTITLEMENT=@GET_TASK_ALLOW_ENTITLEMENT@
 
 # lang-related stuff
 include $(BUILDDIR)/config_$(gb_Side)_lang.mk

configure.ac

@@ -2852,14 +2852,13 @@ AC_MSG_CHECKING([whether build target is Release Build])
 if test "$enable_release_build" = "" -o "$enable_release_build" = "no"; then
     AC_MSG_RESULT([no])
     ENABLE_RELEASE_BUILD=
-    GET_TASK_ALLOW_ENTITLEMENT='
-        <!-- We want to be able to debug a hardened process when not building for release -->
-        <key>com.apple.security.get-task-allow</key>
-        <true/>'
+    dnl Pu the value on one line as make (at least on macOS) seems to ignore
+    dnl the newlines and then complains about spaces.
+    GET_TASK_ALLOW_ENTITLEMENT='<!-- We want to be able to debug a hardened process when not building for release --><key>com.apple.security.get-task-allow</key><true/>'
 else
     AC_MSG_RESULT([yes])
     ENABLE_RELEASE_BUILD=TRUE
-    GET_TASK_ALLOW_ENTITLEMENT=''
+    GET_TASK_ALLOW_ENTITLEMENT=
 fi
 AC_SUBST(ENABLE_RELEASE_BUILD)
 AC_SUBST(GET_TASK_ALLOW_ENTITLEMENT)

desktop/CustomTarget_soffice.mk

@@ -9,6 +9,23 @@
 
 $(eval $(call gb_CustomTarget_CustomTarget,desktop/soffice))
 
+ifeq ($(OS), MACOSX)
+
+ifeq (,$(ENABLE_RELEASE_BUILD))
+
+# Add entitlements if this is a non-release build. Just to be safe,
+# this target will always be run and MACOSX_CODESIGNING_IDENTITY is
+# set to empty as we don't want to sign $(INSTROOTBASE). Ignore
+# failures as it appears that setting only entitlements can fail
+# with certain macOS SDKs.
+$(call gb_CustomTarget_get_target,desktop/soffice) : \
+	$(INSTROOT)/$(LIBO_BIN_FOLDER)/soffice
+	-MACOSX_CODESIGNING_IDENTITY= $(SRCDIR)/solenv/bin/macosx-codesign-app-bundle $(INSTROOTBASE)
+
+endif
+
+else
+
 $(call gb_CustomTarget_get_target,desktop/soffice) : \
 	$(call gb_CustomTarget_get_workdir,desktop/soffice)/soffice.sh
 
@@ -25,4 +42,6 @@ else
 endif
 	$(call gb_Trace_EndRange,$(subst $(WORKDIR)/,,$@),SED)
 
+endif
+
 # vim:set shiftwidth=4 tabstop=4 noexpandtab:

desktop/Module_desktop.mk

@@ -46,7 +46,7 @@ $(eval $(call gb_Module_add_targets,desktop,\
         Pagein_impress \
         Pagein_writer \
     ) \
-    $(if $(filter-out MACOSX WNT,$(OS)),CustomTarget_soffice) \
+    $(if $(filter-out WNT,$(OS)),CustomTarget_soffice) \
 ))
 
 ifeq ($(USING_X11),TRUE)

lo.xcent.in

@@ -23,5 +23,6 @@
         <true/>
 @SDREMOTE_ENTITLEMENT@
 @MACOSX_PROVISIONING_INFO@
+@GET_TASK_ALLOW_ENTITLEMENT@
 </dict>
 </plist>

solenv/bin/macosx-codesign-app-bundle

@@ -15,8 +15,7 @@ test $# = 1 || { echo Usage: $0 app-bundle; exit 1; }
 
 for V in \
     BUILDDIR \
-    MACOSX_BUNDLE_IDENTIFIER \
-    MACOSX_CODESIGNING_IDENTITY; do
+    MACOSX_BUNDLE_IDENTIFIER; do
     if test -z "$(eval echo '$'$V)"; then
        echo No '$'$V "environment variable! This should be run in a build only"
        exit 1
@@ -46,6 +45,19 @@ else
  -or -name '*.applescript' -or -name '*.odt'"
 fi
 
+if test -z "$MACOSX_CODESIGNING_IDENTITY"; then
+    if test -n "$ENABLE_RELEASE_BUILD"; then
+        echo "This is a release build! This should be run in a non-release build only"
+        exit 1
+    fi
+
+    # Skip codesigning for non-release builds if there is no identity set but
+    # set entitlements to allow Xcode's Instruments application to connect to
+    # the application
+    codesign --force --identifier="${MACOSX_BUNDLE_IDENTIFIER}" --sign - $entitlements "$APP_BUNDLE" || exit 1
+    exit 0
+fi
+
 # Sign jnilibs first as workaround for signing issue on old baseline
 # order matters/screws things up otherwise
 find -d "$APP_BUNDLE" \( -name '*.jnilib' \) ! -type l |

solenv/bin/modules/installer/simplepackage.pm

@@ -409,7 +409,10 @@ sub create_package
         {
             my $subdir = "$tempdir/$packagename/$volume_name_classic_app.app/Contents/Resources";
             if ( ! -d $subdir ) { installer::systemactions::create_directory($subdir); }
-            if ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} )
+            # For non-release builds where no identity is, set entitlements
+            # to allow Xcode's Instruments application to connect to the
+            # application
+            if ( $ENV{'MACOSX_CODESIGNING_IDENTITY'} || !$ENV{'ENABLE_RELEASE_BUILD'} )
             {
                 $systemcall = "$ENV{'SRCDIR'}/solenv/bin/macosx-codesign-app-bundle $localtempdir/$folder/$volume_name_classic_app.app";
                 print "... $systemcall ...\n";