bug#49271: 28.0.50: native-comp: Signing macOS self-contained .app bundle fails due to new *.eln location

[Jim Myhrberg]

> On 1 Jul 2021, at 21:13, Alan Third <alan@idiocy.org> wrote:
> 
> I'm curious what you're actually doing. We have some code that runs on
> ARM based Macs only that does this
> 
>    codesign -s - -f $@.tmp
> 
> where I think $@.tmp is... something... executable?
> 
> I'm wondering if we should just install everything into the app bundle
> and sign the whole damn thing.
> 
> I don't really understand this whole codesigning thing. It seems to
> make no difference here, but I'm not trying to run the app on another
> Mac or on an ARM Mac, so I think it's normal that I shouldn't see any
> difference.

I can't say I know what the `$@.tmp` thing is either, or really understand
codesign for that matter. I've managed to make it work through trial and
error... lol

To explain a bit more of what I'm doing though; I basically got bored of making
my laptop sound like a jet engine for 25 minutes every other day as I made new
builds from the master branch, so I set out to make nightly builds using GitHub
Actions which I could just download and/or install/upgrade via brew cask:
https://github.com/jimeh/emacs-builds

With the heavy lifting done by my custom build script:
https://github.com/jimeh/build-emacs-for-macos

The signing and notarizing stuff also lives in the build script repo, but as
part of a new (and somewhat hacky) "emacs-builder" CLI tool written in Go, which
is designed to automated a bunch of the steps.

Because of this, you can see the full build process I'm doing on GitHub Actions:
https://github.com/jimeh/emacs-builds/runs/2957583013?check_suite_focus=true

As for the *.eln file, previously when they were in Contents/Resources I had to
sign each one individually before signing the bundle as a whole. But I didn't
check if that was still needed after they were moved to Contents/MacOS a few
days ago.

But I have checked it with them under Contents/Frameworks, and signing the *.eln
files is no longer needed as codesign finds them when signing the .app bundle
itself..

As for exactly what I'm doing, this is essentially the main command which signs
the .app bundle:

    codesign --sign <cert-id> --deep --timestamp --force --verbose \
             --options runtime --entitlements <path-to-entitlements.plist> \
             /path/to/Emacs.app

And the entitlements I use are:

- com.apple.security.automation.apple-events
- com.apple.security.cs.allow-jit
- com.apple.security.cs.disable-library-validation
- com.apple.security.network.client

Which seem to be enough for everything I do with Emacs to work correctly.

I do also sign a custom little "emacs" shell-script in Contents/MacOS/bin, which
I add to make it easy to expose a "emacs" CLI tool, all it does is correctly
resolve the path to the .app bundle, and execute the main MacOS/Emacs binary
from its absolute real path so it can find everything it depends on within the
app bundle even when symlinked to somewhere else.

I'm happy to answer any questions you might have :)