Bug 419272 - Apps that put folders with dots in /Frameworks/ folder will fail to sign
Summary: Apps that put folders with dots in /Frameworks/ folder will fail to sign
Status: REPORTED
Alias: None
Product: Craft
Classification: Developer tools
Component: Core (show other bugs)
Version: unspecified
Platform: Other macOS
: NOR normal
Target Milestone: ---
Assignee: Hannah von Reth
URL:
Keywords:
Depends on: 420351
Blocks:
  Show dependency treegraph
 
Reported: 2020-03-26 15:35 UTC by Dawid Wróbel
Modified: 2020-04-21 16:38 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dawid Wróbel 2020-03-26 15:35:06 UTC
SUMMARY
codesign will refuse to sign the KMyMoney.app due to "tcl8.6" and "grantlee/5.2" in Framework/ folder. 

The reasoning behind this is explained here: https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG201

More discussion:
https://stackoverflow.com/questions/37737829/codesign-osx-app-bundle-with-periods-in-macos-directory-names

Proposed solution for QT-specific apps:
https://github.com/pyinstaller/pyinstaller/wiki/Recipe-OSX-Code-Signing-Qt

This is essentially an upstream QT issue, but still requires a workaround for craft to work properly.

STEPS TO REPRODUCE
1. 
2. 
3. 

OBSERVED RESULT


EXPECTED RESULT


SOFTWARE/OS VERSIONS
Windows: 
macOS: 
Linux/KDE Plasma: 
(available in About System)
KDE Plasma Version: 
KDE Frameworks Version: 
Qt Version: 

ADDITIONAL INFORMATION
Comment 1 Dawid Wróbel 2020-04-20 19:09:30 UTC
* tcl8.6 issue fixed by blacklisting it after having confirmed it is a build dependency only
* grantlee issue reported upstream
Comment 2 Hannah von Reth 2020-04-20 20:34:05 UTC
Then I'd recommend marking it as build dep instead of blacklisting it.
Comment 3 Dawid Wróbel 2020-04-21 16:38:48 UTC
Well, tcl was in fact being included as a side effect of it being sqlcipher's build dependency. Adding tcl to buildDependencies of the lastter, however, doesn't do anything, presumably because of the extensive configure() and install() manual processing its blueprint does to make it work alongside sqlite3. Looking at its blueprint I can't immediately figure out if and how to make it not include tcl* libs without messing anything up, so I resorted to blacklisting them in kmymoney, since it is the only package that uses its very non-standard installation anyway.

Long term solution is to rewrite sql support in kmymoney to replace sqlite3 with sqlcipher altogether, since it can function as a stand-in transparent replacement for the former and the presence of both in kmymoney code is a pure redundancy. All the configure() and install() magic would then also become obsolete and the blueprint would essentially be a copy of sqlite3's own.