Do not depend on system tools on Darwin #2136
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
236ca50
to
237ecb7
Compare
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
fba3fce
to
9d5fd18
Compare
|
@Mergifyio rebase |
✅ Branch has been successfully rebased |
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
9d5fd18
to
22c032d
Compare
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
2 times, most recently
from
dedc6cd
to
42068b0
Compare
Our cc wrapper was always using the system tools from a fixed location on Darwin, which is not hermetic (and can lead to problems when using nixpkgs) and requires the Xcode command line tools to be installed. Apply the same heuristic as for the otool and install_name tool for the haskell toolchain and assume the tools are available at the same location as the `ar` binary.
... in case the `codesign` binary is not part of the directory where the `ar` tool resides. This might happen when not using a toolchain configured by nixpkgs_cc_configure, but instead using one from a nix-shell. The codesign tool is not part of a nixpkgs stdenv cc toolchain by default.
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
42068b0
to
be50c26
Compare
ylecornec
approved these changes
May 15, 2024
| # Fall back to /usr/bin/codesign if the `CODESIGN` executable is not available | ||
| # (this might happen when using a default cc toolchain from a nix shell on Darwin instead | ||
| # of using a nixpkgs_cc_configure'd toolchain). | ||
| codesign = CODESIGN if os.access(CODESIGN, os.X_OK) else "/usr/bin/codesign" |
There was a problem hiding this comment.
Should we do similar checks for INSTALL_NAME_TOOL and OTOOL ?
| # This is necessary on MacOS Monterey on M1. | ||
| # The moving back and forth is necessary because the OS caches the signature. | ||
| # See this note from nixpkgs for reference: | ||
| # https://github.com/NixOS/nixpkgs/blob/5855ff74f511423e3e2646248598b3ffff229223/pkgs/os-specific/darwin/signing-utils/utils.sh#L1-L6 | ||
| os.rename(output, f"{output}.resign") | ||
| subprocess.check_call([CODESIGN] + ["-f", "-s", "-"] + [f"{output}.resign"]) | ||
| subprocess.check_call([codesign] + ["-f", "-s", "-"] + [f"{output}.resign"], env = {'CODESIGN_ALLOCATE': CODESIGN_ALLOCATE}) |
There was a problem hiding this comment.
Maybe if {:bindir:}/codesign is not available then we should not set the CODESIGN_ALLOCATE ? Since it also points to {:bindir}.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Our cc wrapper was always using the system tools from a fixed location on Darwin, which is not hermetic
(and can lead to problems when using nixpkgs) and requires the Xcode command line tools to be installed.
Apply the same heuristic as for the otool and install_name tool for the haskell toolchain and assume
the tools are available at the same location as the
arbinary.Depends on tweag/rules_nixpkgs#479 and depends on #2119