diff --git a/Source/Platforms/Mac/Default.entitlements b/Source/Platforms/Mac/Default.entitlements new file mode 100644 index 000000000..1918049d1 --- /dev/null +++ b/Source/Platforms/Mac/Default.entitlements @@ -0,0 +1,16 @@ + + + + + com.apple.security.cs.allow-dyld-environment-variables + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.disable-executable-page-protection + + com.apple.security.cs.disable-library-validation + + + diff --git a/Source/Tools/Flax.Build/Configuration.cs b/Source/Tools/Flax.Build/Configuration.cs index 8fa17a235..9094f7b9e 100644 --- a/Source/Tools/Flax.Build/Configuration.cs +++ b/Source/Tools/Flax.Build/Configuration.cs @@ -39,12 +39,6 @@ namespace Flax.Build [CommandLine("deploy", "Runs the deploy tool.")] public static bool Deploy = false; - /// - /// Compresses deployed files. - /// - [CommandLine("deployDontCompress", "Skips compressing deployed files, and keeps files.")] - public static bool DontCompress = false; - /// /// Builds the targets. Builds all the targets, use to select a custom set of targets for the build. /// diff --git a/Source/Tools/Flax.Build/Deploy/Deployer.cs b/Source/Tools/Flax.Build/Deploy/Deployer.cs index f05fda788..5882bd366 100644 --- a/Source/Tools/Flax.Build/Deploy/Deployer.cs +++ b/Source/Tools/Flax.Build/Deploy/Deployer.cs @@ -9,6 +9,12 @@ namespace Flax.Build { public static partial class Configuration { + /// + /// Compresses deployed files. + /// + [CommandLine("deployDontCompress", "Skips compressing deployed files, and keeps files.")] + public static bool DontCompress = false; + /// /// Package deployment output path. /// @@ -28,9 +34,9 @@ namespace Flax.Build public static bool DeployPlatforms; /// - /// Certificate file path for binaries signing. + /// Certificate file path for binaries signing. Or sign identity for Apple platforms. /// - [CommandLine("deployCert", "Certificate file path for binaries signing.")] + [CommandLine("deployCert", "Certificate file path for binaries signing. Or sign identity for Apple platforms.")] public static string DeployCert; /// diff --git a/Source/Tools/Flax.Build/Deploy/Deployment.Editor.cs b/Source/Tools/Flax.Build/Deploy/Deployment.Editor.cs index 95eb1f331..981c15a55 100644 --- a/Source/Tools/Flax.Build/Deploy/Deployment.Editor.cs +++ b/Source/Tools/Flax.Build/Deploy/Deployment.Editor.cs @@ -17,11 +17,15 @@ namespace Flax.Deploy { if (string.IsNullOrEmpty(Configuration.DeployCert)) return; + Log.Info("Code signing file: " + file); switch (Platform.BuildTargetPlatform) { case TargetPlatform.Windows: VCEnvironment.CodeSign(file, Configuration.DeployCert, Configuration.DeployCertPass); break; + case TargetPlatform.Mac: + MacPlatform.CodeSign(file, Configuration.DeployCert); + break; } } @@ -254,6 +258,10 @@ namespace Flax.Deploy Utilities.Run("strip", "FlaxEditor", null, dst, Utilities.RunOptions.None); Utilities.Run("strip", "FlaxEditor.dylib", null, dst, Utilities.RunOptions.None); Utilities.Run("strip", "libMoltenVK.dylib", null, dst, Utilities.RunOptions.None); + + CodeSign(Path.Combine(dst, "FlaxEditor")); + CodeSign(Path.Combine(dst, "FlaxEditor.dylib")); + CodeSign(Path.Combine(dst, "libMoltenVK.dylib")); } } } diff --git a/Source/Tools/Flax.Build/Platforms/Mac/MacPlatform.cs b/Source/Tools/Flax.Build/Platforms/Mac/MacPlatform.cs index ef89c8b4e..3be0beb76 100644 --- a/Source/Tools/Flax.Build/Platforms/Mac/MacPlatform.cs +++ b/Source/Tools/Flax.Build/Platforms/Mac/MacPlatform.cs @@ -1,5 +1,7 @@ // Copyright (c) 2012-2023 Wojciech Figat. All rights reserved. +using System; +using System.IO; using System.Runtime.InteropServices; namespace Flax.Build.Platforms @@ -44,6 +46,24 @@ namespace Flax.Build.Platforms } } + /// + /// Runs codesign tool on macOS to sign the code with a given identity from local keychain. + /// + /// Path to file to codesign. + /// App code signing idenity name (from local Mac keychain). Use 'security find-identity -v -p codesigning' to list possible options. + public static void CodeSign(string file, string signIdenity) + { + if (!File.Exists(file)) + throw new FileNotFoundException("Missing file to sign.", file); + string cmdLine = string.Format("--force --timestamp -s \"{0}\" \"{1}\"", signIdenity, file); + if (string.IsNullOrEmpty(Path.GetExtension(file))) + { + // Add entitlements file with some settings for the app execution + cmdLine += string.Format(" --entitlements \"{0}\"", Path.Combine(Globals.EngineRoot, "Source/Platforms/Mac/Default.entitlements")); + } + Utilities.Run("codesign", cmdLine, null, null, Utilities.RunOptions.Default | Utilities.RunOptions.ThrowExceptionOnError); + } + /// /// Returns true if running an x64 binary an arm64 host machine. ///