Do not depend on system tools on Darwin #2136
Conversation
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
236ca50
to
237ecb7
Compare
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
fba3fce
to
9d5fd18
Compare
|
@Mergifyio rebase |
✅ Branch has been successfully rebased |
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
9d5fd18
to
22c032d
Compare
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
2 times, most recently
from
dedc6cd
to
42068b0
Compare
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
42068b0
to
be50c26
Compare
| # Fall back to /usr/bin/codesign if the `CODESIGN` executable is not available | ||
| # (this might happen when using a default cc toolchain from a nix shell on Darwin instead | ||
| # of using a nixpkgs_cc_configure'd toolchain). | ||
| codesign = CODESIGN if os.access(CODESIGN, os.X_OK) else "/usr/bin/codesign" |
There was a problem hiding this comment.
Should we do similar checks for INSTALL_NAME_TOOL and OTOOL ?
There was a problem hiding this comment.
I think these tools really should be available from the same place as the ar tool. Otherwise mixing tools from different toolchains is just calling for trouble (as we've seen previously: tweag/rules_nixpkgs#479).
Also, the difference between the codesign and any of these tools from /usr/bin is that codesign does not need an installation of the Xcode command line tools, the latter do.
So I'd like to only do the fallback for codesign until there is a real problem that we need to solve.
haskell/private/cc_wrapper.py.tpl
Outdated
| # This is necessary on MacOS Monterey on M1. | ||
| # The moving back and forth is necessary because the OS caches the signature. | ||
| # See this note from nixpkgs for reference: | ||
| # https://github.com/NixOS/nixpkgs/blob/5855ff74f511423e3e2646248598b3ffff229223/pkgs/os-specific/darwin/signing-utils/utils.sh#L1-L6 | ||
| os.rename(output, f"{output}.resign") | ||
| subprocess.check_call([CODESIGN] + ["-f", "-s", "-"] + [f"{output}.resign"]) | ||
| subprocess.check_call([codesign] + ["-f", "-s", "-"] + [f"{output}.resign"], env = {'CODESIGN_ALLOCATE': CODESIGN_ALLOCATE}) |
There was a problem hiding this comment.
Maybe if {:bindir:}/codesign is not available then we should not set the CODESIGN_ALLOCATE ? Since it also points to {:bindir}.
There was a problem hiding this comment.
I think we need to set CODESIGN_ALLOCATE for codesign to work. But I applied the same fallback for codesign_allocate now. It also does not need a Xcode installation and should work in tandem with codesign.
Our cc wrapper was always using the system tools from a fixed location on Darwin, which is not hermetic (and can lead to problems when using nixpkgs) and requires the Xcode command line tools to be installed. Apply the same heuristic as for the otool and install_name tool for the haskell toolchain and assume the tools are available at the same location as the `ar` binary.
... in case the `codesign` binary is not part of the directory where the `ar` tool resides. This might happen when not using a toolchain configured by nixpkgs_cc_configure, but instead using one from a nix-shell. The codesign tool is not part of a nixpkgs stdenv cc toolchain by default.
avdv
force-pushed
the
darwin-dont-use-system-tools
branch
from
be50c26
to
ac40163
Compare
Our cc wrapper was always using the system tools from a fixed location on Darwin, which is not hermetic
(and can lead to problems when using nixpkgs) and requires the Xcode command line tools to be installed.
Apply the same heuristic as for the otool and install_name tool for the haskell toolchain and assume
the tools are available at the same location as the
arbinary.Depends on tweag/rules_nixpkgs#479 and depends on #2119