Bug 481815: makefile hooks required for signing executable files, installer packages, and mars. r=ted

--HG--
extra : rebase_source : 7b696910865fdbc9191cb7511f558879a9b9e05d
This commit is contained in:
Chris AtLee 2011-12-07 17:06:52 -05:00
parent 256dd6e1b3
commit 8d01aa9835
8 changed files with 156 additions and 22 deletions

View File

@ -80,6 +80,9 @@ package:
package-compare:
@$(MAKE) -C browser/installer package-compare
stage-package:
@$(MAKE) -C browser/installer stage-package
install::
@$(MAKE) -C browser/installer install

View File

@ -114,6 +114,7 @@ endif
GENERATE_CACHE = 1
include $(topsrcdir)/toolkit/mozapps/installer/signing.mk
include $(topsrcdir)/toolkit/mozapps/installer/packager.mk
ifeq (bundle, $(MOZ_FS_LAYOUT))

View File

@ -210,7 +210,7 @@ endif
profiledbuild::
$(MAKE) -f $(TOPSRCDIR)/client.mk realbuild MOZ_PROFILE_GENERATE=1
$(MAKE) -C $(PGO_OBJDIR) package
$(MAKE) -C $(PGO_OBJDIR) stage-package
OBJDIR=${PGO_OBJDIR} JARLOG_DIR=${PGO_OBJDIR}/jarlog/en-US $(PROFILE_GEN_SCRIPT)
$(MAKE) -f $(TOPSRCDIR)/client.mk maybe_clobber_profiledbuild
$(MAKE) -f $(TOPSRCDIR)/client.mk realbuild MOZ_PROFILE_USE=1

View File

@ -96,8 +96,6 @@ clobber-%:
PACKAGER_NO_LIBS = 1
include $(MOZILLA_DIR)/toolkit/mozapps/installer/packager.mk
ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT))
STAGEDIST = $(_ABS_DIST)/l10n-stage/$(MOZ_PKG_DIR)/$(_APPNAME)/Contents/MacOS
@ -105,6 +103,9 @@ else
STAGEDIST = $(_ABS_DIST)/l10n-stage/$(MOZ_PKG_DIR)
endif
include $(topsrcdir)/toolkit/mozapps/installer/signing.mk
include $(MOZILLA_DIR)/toolkit/mozapps/installer/packager.mk
$(STAGEDIST): AB_CD:=en-US
$(STAGEDIST): UNPACKAGE=$(call ESCAPE_SPACE,$(ZIP_IN))
$(STAGEDIST): $(call ESCAPE_SPACE,$(ZIP_IN))
@ -175,6 +176,7 @@ endif
$(MAKE) clobber-zip AB_CD=$(AB_CD)
$(NSINSTALL) -D $(DIST)/$(PKG_PATH)
mv -f "$(DIST)/l10n-stage/$(PACKAGE)" "$(ZIP_OUT)"
if test -f "$(DIST)/l10n-stage/$(PACKAGE).asc"; then mv -f "$(DIST)/l10n-stage/$(PACKAGE).asc" "$(ZIP_OUT).asc"; fi
repackage-zip-%: $(STAGEDIST)
@$(MAKE) repackage-zip AB_CD=$* ZIP_IN="$(ZIP_IN)"

View File

@ -117,7 +117,7 @@ endif # MOZ_NATIVE_NSPR
MAKE_JSSHELL = $(ZIP) -9j $(PKG_JSSHELL) $(JSSHELL_BINS)
endif # LIBXUL_SDK
MAKE_PACKAGE = $(error What is a $(MOZ_PKG_FORMAT) package format?);
PREPARE_PACKAGE = $(error What is a $(MOZ_PKG_FORMAT) package format?);
_ABS_DIST = $(call core_abspath,$(DIST))
JARLOG_DIR = $(call core_abspath,$(DEPTH)/jarlog/)
JARLOG_DIR_AB_CD = $(JARLOG_DIR)/$(AB_CD)
@ -145,6 +145,10 @@ INNER_UNMAKE_PACKAGE = bunzip2 -c $(UNPACKAGE) | $(UNPACK_TAR)
MAKE_SDK = $(CREATE_FINAL_TAR) - $(MOZ_APP_NAME)-sdk | bzip2 -vf > $(SDK)
endif
ifeq ($(MOZ_PKG_FORMAT),ZIP)
ifdef MOZ_EXTERNAL_SIGNING_FORMAT
# We can't use signcode on zip files
MOZ_EXTERNAL_SIGNING_FORMAT := $(filter-out signcode,$(MOZ_EXTERNAL_SIGNING_FORMAT))
endif
PKG_SUFFIX = .zip
INNER_MAKE_PACKAGE = $(ZIP) -r9D $(PACKAGE) $(MOZ_PKG_DIR)
INNER_UNMAKE_PACKAGE = $(UNZIP) $(UNPACKAGE)
@ -506,19 +510,42 @@ UNPACK_OMNIJAR = \
mv tmp.manifest $$m; \
done
MAKE_PACKAGE = (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(PACK_OMNIJAR)) && \
(cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(CREATE_PRECOMPLETE_CMD)) && $(INNER_MAKE_PACKAGE)
PREPARE_PACKAGE = (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(PACK_OMNIJAR)) && \
(cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(CREATE_PRECOMPLETE_CMD))
UNMAKE_PACKAGE = $(INNER_UNMAKE_PACKAGE) && (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(UNPACK_OMNIJAR))
else
MAKE_PACKAGE = (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(CREATE_PRECOMPLETE_CMD)) && $(INNER_MAKE_PACKAGE)
PREPARE_PACKAGE = (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(CREATE_PRECOMPLETE_CMD))
UNMAKE_PACKAGE = $(INNER_UNMAKE_PACKAGE)
endif
ifdef MOZ_INTERNAL_SIGNING_FORMAT
MOZ_SIGN_PREPARED_PACKAGE_CMD=$(MOZ_SIGN_CMD) $(foreach f,$(MOZ_INTERNAL_SIGNING_FORMAT),-f $(f)) $(foreach i,$(SIGN_INCLUDES),-i $(i)) $(foreach x,$(SIGN_EXCLUDES),-x $(x)) --nsscmd "$(SIGN_CMD)"
endif
# For final GPG / authenticode signing / dmg signing if required
ifdef MOZ_EXTERNAL_SIGNING_FORMAT
MOZ_SIGN_PACKAGE_CMD=$(MOZ_SIGN_CMD) $(foreach f,$(MOZ_EXTERNAL_SIGNING_FORMAT),-f $(f))
ifeq (gpg,$(findstring gpg,$(MOZ_EXTERNAL_SIGNING_FORMAT)))
UPLOAD_EXTRA_FILES += $(PACKAGE).asc
endif
endif
ifdef MOZ_SIGN_PREPARED_PACKAGE_CMD
MAKE_PACKAGE = $(PREPARE_PACKAGE) && $(MOZ_SIGN_PREPARED_PACKAGE_CMD) \
$(MOZ_PKG_DIR) && $(INNER_MAKE_PACKAGE)
else
MAKE_PACKAGE = $(PREPARE_PACKAGE) && $(INNER_MAKE_PACKAGE)
endif
ifdef MOZ_SIGN_PACKAGE_CMD
MAKE_PACKAGE += && $(MOZ_SIGN_PACKAGE_CMD) "$(PACKAGE)"
endif
# dummy macro if we don't have PSM built
SIGN_NSS =
ifdef MOZ_CAN_RUN_PROGRAMS
ifdef MOZ_PSM
SIGN_NSS = @echo signing nss libraries;
SIGN_NSS = echo signing nss libraries;
NSS_DLL_SUFFIX = $(DLL_SUFFIX)
ifdef UNIVERSAL_BINARY
@ -531,7 +558,7 @@ ifeq ($(OS_ARCH),OS2)
NSS_DLL_SUFFIX = .DLL
SIGN_CMD = $(MOZILLA_DIR)/toolkit/mozapps/installer/os2/sign.cmd $(DIST)
else
SIGN_CMD = $(RUN_TEST_PROGRAM) $(DIST)/bin/shlibsign$(BIN_SUFFIX) -v -i
SIGN_CMD = $(RUN_TEST_PROGRAM) $(_ABS_DIST)/bin/shlibsign$(BIN_SUFFIX) -v -i
endif
endif
@ -544,14 +571,15 @@ FREEBL_32INT64 = $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH)/$(DLL_PREFIX)free
FREEBL_64FPU = $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH)/$(DLL_PREFIX)freebl_64fpu_3$(DLL_SUFFIX)
FREEBL_64INT = $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH)/$(DLL_PREFIX)freebl_64int_3$(DLL_SUFFIX)
SIGN_NSS += $(SIGN_CMD) $(SOFTOKN); \
$(SIGN_CMD) $(NSSDBM); \
if test -f $(FREEBL); then $(SIGN_CMD) $(FREEBL); fi; \
if test -f $(FREEBL_32FPU); then $(SIGN_CMD) $(FREEBL_32FPU); fi; \
if test -f $(FREEBL_32INT); then $(SIGN_CMD) $(FREEBL_32INT); fi; \
if test -f $(FREEBL_32INT64); then $(SIGN_CMD) $(FREEBL_32INT64); fi; \
if test -f $(FREEBL_64FPU); then $(SIGN_CMD) $(FREEBL_64FPU); fi; \
if test -f $(FREEBL_64INT); then $(SIGN_CMD) $(FREEBL_64INT); fi;
SIGN_NSS += \
$(SIGN_CMD) $(SOFTOKN) && \
$(SIGN_CMD) $(NSSDBM) && \
if test -f $(FREEBL); then $(SIGN_CMD) $(FREEBL); fi && \
if test -f $(FREEBL_32FPU); then $(SIGN_CMD) $(FREEBL_32FPU); fi && \
if test -f $(FREEBL_32INT); then $(SIGN_CMD) $(FREEBL_32INT); fi && \
if test -f $(FREEBL_32INT64); then $(SIGN_CMD) $(FREEBL_32INT64); fi && \
if test -f $(FREEBL_64FPU); then $(SIGN_CMD) $(FREEBL_64FPU); fi && \
if test -f $(FREEBL_64INT); then $(SIGN_CMD) $(FREEBL_64INT); fi;
endif # MOZ_PSM
endif # !CROSS_COMPILE
@ -663,6 +691,9 @@ ifdef MOZ_OPTIONAL_PKG_LIST
cd $(DEPTH)/installer-stage/optional/distribution/extensions/; find -maxdepth 1 -mindepth 1 -exec rm -r ../../../core/distribution/extensions/{} \; ; \
fi
endif
ifdef MOZ_SIGN_PREPARED_PACKAGE_CMD
$(MOZ_SIGN_PREPARED_PACKAGE_CMD) $(DEPTH)/installer-stage
endif
elfhack:
ifdef USE_ELF_HACK
@ -752,7 +783,7 @@ ifndef PKG_SKIP_STRIP
endif
endif # PKG_SKIP_STRIP
# We always sign nss because we don't do it from security/manager anymore
$(SIGN_NSS)
@$(SIGN_NSS)
@echo "Removing unpackaged files..."
ifdef NO_PKG_FILES
cd $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH); rm -rf $(NO_PKG_FILES)
@ -868,6 +899,7 @@ CHECKSUM_ALGORITHM = 'sha512'
# This variable defines where the checksum file will be located
CHECKSUM_FILE = "$(DIST)/$(PKG_PATH)/$(PKG_BASENAME).checksums"
CHECKSUM_FILES = $(CHECKSUM_FILE)
UPLOAD_FILES= \
$(call QUOTED_WILDCARD,$(DIST)/$(PACKAGE)) \
@ -882,6 +914,20 @@ UPLOAD_FILES= \
$(call QUOTED_WILDCARD,$(PKG_JSSHELL)) \
$(if $(UPLOAD_EXTRA_FILES), $(foreach f, $(UPLOAD_EXTRA_FILES), $(wildcard $(DIST)/$(f))))
SIGN_CHECKSUM_CMD=
ifdef MOZ_SIGN_CMD
ifeq (gpg,$(filter gpg,$(MOZ_EXTERNAL_SIGNING_FORMAT)))
# If we're signing with gpg, we'll have a bunch of extra detached signatures to
# upload. We also want to sign our checksums file
SIGN_CHECKSUM_CMD=$(MOZ_SIGN_CMD) -f gpg $(CHECKSUM_FILE)
CHECKSUM_FILES += $(CHECKSUM_FILE).asc
UPLOAD_FILES += $(call QUOTED_WILDCARD,$(DIST)/$(COMPLETE_MAR).asc)
UPLOAD_FILES += $(call QUOTED_WILDCARD,$(wildcard $(DIST)/$(PARTIAL_MAR).asc))
UPLOAD_FILES += $(call QUOTED_WILDCARD,$(INSTALLER_PACKAGE).asc)
endif
endif
checksum:
mkdir -p `dirname $(CHECKSUM_FILE)`
@$(PYTHON) $(MOZILLA_DIR)/build/checksums.py \
@ -892,12 +938,13 @@ checksum:
@echo "CHECKSUM FILE START"
@cat $(CHECKSUM_FILE)
@echo "CHECKSUM FILE END"
$(SIGN_CHECKSUM_CMD)
upload: checksum
$(PYTHON) $(MOZILLA_DIR)/build/upload.py --base-path $(DIST) \
$(UPLOAD_FILES) \
$(CHECKSUM_FILE)
$(CHECKSUM_FILES)
ifeq (WINNT,$(OS_TARGET))
CODESIGHS_PACKAGE = $(INSTALLER_PACKAGE)

View File

@ -0,0 +1,60 @@
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# Contributor(s):
# Chris AtLee <catlee@mozilla.com>
#
# Alternatively, the contents of this file may be used under the terms of
# either of the GNU General Public License Version 2 or later (the "GPL"),
# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****
# We shouldn't sign the first pass of a PGO build
ifndef MOZ_PROFILE_GENERATE
# Signing support
ifdef MOZ_SIGN_CMD
ifeq (WINNT,$(OS_ARCH))
MOZ_INTERNAL_SIGNING_FORMAT := signcode
MOZ_EXTERNAL_SIGNING_FORMAT := signcode gpg
SIGN_INCLUDES := \
'*.dll' \
'*.exe' \
$(NULL)
SIGN_EXCLUDES := \
'D3DCompiler*.dll' \
'd3dx9*.dll' \
'msvc*.dll' \
$(NULL)
endif # Windows
ifeq (Darwin, $(OS_ARCH))
MOZ_EXTERNAL_SIGNING_FORMAT := gpg
endif # Darwin
ifeq (linux-gnu,$(TARGET_OS))
MOZ_EXTERNAL_SIGNING_FORMAT := gpg
endif # Linux
endif # MOZ_SIGN_CMD
endif # MOZ_PROFILE_GENERATE

View File

@ -41,6 +41,8 @@ ifndef CONFIG_DIR
$(error CONFIG_DIR must be set before including makensis.mk)
endif
include $(topsrcdir)/toolkit/mozapps/installer/signing.mk
ABS_CONFIG_DIR := $(shell pwd)/$(CONFIG_DIR)
SFX_MODULE ?= $(error SFX_MODULE is not defined)
@ -71,6 +73,9 @@ $(CONFIG_DIR)/setup.exe::
ifeq ($(CONFIG_DIR),l10ngen)
cd $(CONFIG_DIR) && $(MAKENSISU) uninstaller.nsi
endif
ifdef MOZ_EXTERNAL_SIGNING_FORMAT
$(MOZ_SIGN_CMD) $(foreach f,$(MOZ_EXTERNAL_SIGNING_FORMAT),-f $(f)) "$@"
endif
$(CONFIG_DIR)/7zSD.sfx:
$(CYGWIN_WRAPPER) upx --best -o $(CONFIG_DIR)/7zSD.sfx $(SFX_MODULE)
@ -82,6 +87,9 @@ installer::
$(NSINSTALL) -D $(DIST)/$(PKG_INST_PATH)
cat $(CONFIG_DIR)/7zSD.sfx $(CONFIG_DIR)/app.tag $(CONFIG_DIR)/app.7z > "$(DIST)/$(PKG_INST_PATH)$(PKG_INST_BASENAME).exe"
chmod 0755 "$(DIST)/$(PKG_INST_PATH)$(PKG_INST_BASENAME).exe"
ifdef MOZ_EXTERNAL_SIGNING_FORMAT
$(MOZ_SIGN_CMD) $(foreach f,$(MOZ_EXTERNAL_SIGNING_FORMAT),-f $(f)) "$(DIST)/$(PKG_INST_PATH)$(PKG_INST_BASENAME).exe"
endif
# For building the uninstaller during the application build so it can be
# included for mar file generation.

View File

@ -78,6 +78,16 @@ UNPACKAGE = "$(PACKAGE_BASE_DIR)/$(PACKAGE)"
endif
endif
include $(topsrcdir)/config/rules.mk
include $(topsrcdir)/toolkit/mozapps/installer/signing.mk
include $(topsrcdir)/toolkit/mozapps/installer/packager.mk
ifdef MOZ_EXTERNAL_SIGNING_FORMAT
# We can't use signcode on mar files
MOZ_EXTERNAL_SIGNING_FORMAT := $(filter-out signcode,$(MOZ_EXTERNAL_SIGNING_FORMAT))
MOZ_EXTERNAL_SIGNING_FORMAT := mar $(MOZ_EXTERNAL_SIGNING_FORMAT)
endif
complete-patch::
ifeq ($(OS_TARGET), WINNT)
test -f $(UNPACKAGE)
@ -89,6 +99,9 @@ endif
$(srcdir)/make_full_update.sh \
"$(STAGE_DIR)/$(PKG_UPDATE_BASENAME).complete.mar" \
"$(PACKAGE_DIR)"
ifdef MOZ_SIGN_PACKAGE_CMD
$(MOZ_SIGN_PACKAGE_CMD) "$(STAGE_DIR)/$(PKG_UPDATE_BASENAME).complete.mar"
endif
partial-patch::
mkdir -p $(STAGE_DIR)
@ -98,6 +111,6 @@ partial-patch::
"$(STAGE_DIR)/$(PKG_UPDATE_BASENAME).partial.$(SRC_BUILD_ID)-$(DST_BUILD_ID).mar" \
"$(SRC_BUILD)" \
"$(DST_BUILD)"
include $(topsrcdir)/config/rules.mk
include $(topsrcdir)/toolkit/mozapps/installer/packager.mk
ifdef MOZ_SIGN_PACKAGE_CMD
$(MOZ_SIGN_PACKAGE_CMD) "$(STAGE_DIR)/$(PKG_UPDATE_BASENAME).partial.$(SRC_BUILD_ID)-$(DST_BUILD_ID).mar"
endif