Gremlinsoft
/
godot
forked from sascha/godot
2
0
Fork 0
Code Pull Requests Activity

[macOS export] Improve code signing/notarization options validation.

4.0
bruvzg 2022-01-10 13:18:59 +07:00
parent d746475708
commit 4e2c6c1444
No known key found for this signature in database
GPG Key ID: 7960FCF39844EC38
3 changed files with 74 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
editor/project_export.cpp
Unescape Escape View File

@ -265,10 +265,25 @@ void ProjectExportDialog::_edit_preset(int p_index) {
export_templates_error->hide();
}
export_warning->hide();
export_button->set_disabled(true);
get_ok_button()->set_disabled(true);
} else {
if (error != String()) {
Vector<String> items = error.split("\n", false);
error = "";
for (int i = 0; i < items.size(); i++) {
if (i > 0) {
error += "\n";
}
error += " - " + items[i];
}
export_warning->set_text(error);
export_warning->show();
} else {
export_warning->hide();
}
export_error->hide();
export_templates_error->hide();
export_button->set_disabled(false);
@ -1247,6 +1262,11 @@ ProjectExportDialog::ProjectExportDialog() {
export_error->hide();
export_error->add_theme_color_override("font_color", EditorNode::get_singleton()->get_gui_base()->get_theme_color(SNAME("error_color"), SNAME("Editor")));
export_warning = memnew(Label);
main_vb->add_child(export_warning);
export_warning->hide();
export_warning->add_theme_color_override("font_color", EditorNode::get_singleton()->get_gui_base()->get_theme_color(SNAME("warning_color"), SNAME("Editor")));
export_templates_error = memnew(HBoxContainer);
main_vb->add_child(export_templates_error);
export_templates_error->hide();

1
editor/project_export.h
Unescape Escape View File

@ -99,6 +99,7 @@ private:
Label *script_key_error;
Label *export_error;
Label *export_warning;
HBoxContainer *export_templates_error;
String default_filename;

64
platform/osx/export/export_plugin.cpp
Unescape Escape View File

@ -381,12 +381,22 @@ Error EditorExportPlatformOSX::_code_sign(const Ref<EditorExportPreset> &p_prese
#ifdef OSX_ENABLED
List<String> args;
bool ad_hoc = (p_preset->get("codesign/identity") == "" || p_preset->get("codesign/identity") == "-");
if (p_preset->get("codesign/timestamp")) {
args.push_back("--timestamp");
if (ad_hoc) {
WARN_PRINT("Timestamping is not compatible with ad-hoc signature, and was disabled!");
} else {
args.push_back("--timestamp");
}
}
if (p_preset->get("codesign/hardened_runtime")) {
args.push_back("--options");
args.push_back("runtime");
if (ad_hoc) {
WARN_PRINT("Hardened Runtime is not compatible with ad-hoc signature, and was disabled!");
} else {
args.push_back("--options");
args.push_back("runtime");
}
}
if (p_path.get_extension() != "dmg") {
@ -403,7 +413,7 @@ Error EditorExportPlatformOSX::_code_sign(const Ref<EditorExportPreset> &p_prese
}
args.push_back("-s");
if (p_preset->get("codesign/identity") == "") {
if (ad_hoc) {
args.push_back("-");
} else {
args.push_back(p_preset->get("codesign/identity"));
@ -1166,10 +1176,9 @@ bool EditorExportPlatformOSX::can_export(const Ref<EditorExportPreset> &p_preset
String err;
bool valid = false;
// Look for export templates (first official, and if defined custom templates).
bool dvalid = exists_export_template("osx.zip", &err);
bool rvalid = dvalid; // Both in the same ZIP.
// Look for export templates (custom templates).
bool dvalid = false;
bool rvalid = false;
if (p_preset->get("custom_template/debug") != "") {
dvalid = FileAccess::exists(p_preset->get("custom_template/debug"));
@ -1184,6 +1193,12 @@ bool EditorExportPlatformOSX::can_export(const Ref<EditorExportPreset> &p_preset
}
}
// Look for export templates (official templates, check only is custom templates are not set).
if (!dvalid || !rvalid) {
dvalid = exists_export_template("osx.zip", &err);
rvalid = dvalid; // Both in the same ZIP.
}
valid = dvalid || rvalid;
r_missing_templates = !valid;
@ -1194,16 +1209,26 @@ bool EditorExportPlatformOSX::can_export(const Ref<EditorExportPreset> &p_preset
valid = false;
}
#ifdef OSX_ENABLED
bool sign_enabled = p_preset->get("codesign/enable");
bool noto_enabled = p_preset->get("notarization/enable");
bool ad_hoc = ((p_preset->get("codesign/identity") == "") || (p_preset->get("codesign/identity") == "-"));
if (noto_enabled) {
if (ad_hoc) {
err += TTR("Notarization: Notarization with the ad-hoc signature is not supported.") + "\n";
valid = false;
}
if (!sign_enabled) {
err += TTR("Notarization: code signing required.") + "\n";
err += TTR("Notarization: Code signing is required for notarization.") + "\n";
valid = false;
}
if (!(bool)p_preset->get("codesign/hardened_runtime")) {
err += TTR("Notarization: Hardened runtime is required for notarization.") + "\n";
valid = false;
}
bool hr_enabled = p_preset->get("codesign/hardened_runtime");
if (!hr_enabled) {
err += TTR("Notarization: hardened runtime required.") + "\n";
if (!(bool)p_preset->get("codesign/timestamp")) {
err += TTR("Notarization: Timestamping is required for notarization.") + "\n";
valid = false;
}
if (p_preset->get("notarization/apple_id_name") == "") {
@ -1214,7 +1239,22 @@ bool EditorExportPlatformOSX::can_export(const Ref<EditorExportPreset> &p_preset
err += TTR("Notarization: Apple ID password not specified.") + "\n";
valid = false;
}
} else {
err += TTR("Notarization is disabled. Exported project will be blocked by Gatekeeper, if it's downloaded from an unknown source.") + "\n";
if (!sign_enabled) {
err += TTR("Code signing is disabled. Exported project will not run on Macs with enabled Gatekeeper and Apple Silicon powered Macs.") + "\n";
} else {
if ((bool)p_preset->get("codesign/hardened_runtime") && ad_hoc) {
err += TTR("Hardened Runtime is not compatible with ad-hoc signature, and will be disabled!") + "\n";
}
if ((bool)p_preset->get("codesign/timestamp") && ad_hoc) {
err += TTR("Timestamping is not compatible with ad-hoc signature, and will be disabled!") + "\n";
}
}
}
#else
err += TTR("macOS code signing and Notarization is not supported on the host OS. Exported project will not run on Macs with enabled Gatekeeper and Apple Silicon powered Macs.") + "\n";
#endif
if (!err.is_empty()) {
r_error = err;