airsdk / Adobe-Runtime-Support

Report, track and discuss issues in Adobe AIR. Monitored by Adobe - and HARMAN - and maintained by the AIR community.
206 stars 11 forks source link

[AIR SDK 51.1.2.2][macOS] macOS application with ANE packaging broken #3562

Open itlancer opened 5 days ago

itlancer commented 5 days ago

Problem Description

macOS application which use ANE packaging broken with AIR SDK 51.1.2.2.

Tested with AIR SDK 51.1.2.2 with different macOS devices with applications which use multiple ANEs (some of them with frameworks). Native extensions built using AIR 51.1.1.5. Tested with and without UseNativeCodesign=true. There is no such issue if application didn't use ANE. There is no such issue using AIR SDK 51.1.2.1 or below.

Related issues: https://github.com/airsdk/Adobe-Runtime-Support/issues/3390 https://github.com/airsdk/Adobe-Runtime-Support/discussions/2088 https://github.com/airsdk/Adobe-Runtime-Support/issues/2083 https://github.com/airsdk/Adobe-Runtime-Support/issues/1090

Steps to Reproduce

Try to package AIR application for macOS which uses ANEs with AIR SDK 51.1.2.2. Call adt -package ... command.

Actual Result: Packaging error:

Failure (1) in codesign request.
/Users/username/builds/build/adt15380117071026662038.tmp/temp: replacing existing signature
/Users/username/builds/build/adt15380117071026662038.tmp/temp: code object is not signed at all
In subcomponent: /Users/username/builds/build/adt15380117071026662038.tmp/temp/Contents/Frameworks/MyANE2.framework

In adt.log you can see:

Called by: /Users/username/Documents/AIR_SDK/lib/adt.jar
ADT 51.1.2.2 called with: -package -storetype pkcs12 -keystore /Users/username/Documents/cert.p12 -storepass xxxxxx -keypass xxxxxx -target bundle -storetype KeychainStore -alias Developer ID Application: Company Name (ID) MyApp.app descriptor.xml -extdir /Users/username/builds/libs -extdir /Users/username/builds/ane-all -extdir /Users/username/builds/ane-full MyApp.swf
Creating temporary AIR package at /Users/username/builds/build/air2401025436446791822.tmp
Converting AIR file:  /Users/username/Documents/AIR_SDK/lib/nai/bin/naip -convert /Users/username/builds/build/air2401025436446791822.tmp /Users/username/builds/build/adt3172276520321907400.tmp/temp
Renaming ANE framework (MyANE1.framework) = successRenaming ANE framework (MyANE2.framework) = successCodesign request: find /Users/username/builds/build/adt3172276520321907400.tmp/temp -name "*.framework" -exec codesign -s 'Developer ID Application: Company Name (ID)' -f -o runtime --strict --timestamp -v {} ;
Codesign request: find /Users/username/builds/build/adt3172276520321907400.tmp/temp -name "*.plugin" -exec codesign -s 'Developer ID Application: Company Name (ID)' -f -o runtime --strict --timestamp -v {} ;
Codesign request: find /Users/username/builds/build/adt3172276520321907400.tmp/temp -name "*.dylib" -exec codesign -s 'Developer ID Application: Company Name (ID)' -f -o runtime --strict --timestamp -v {} ;
Codesign request: find /Users/username/builds/build/adt3172276520321907400.tmp/temp -name "A2712Enabler" -exec codesign --entitlements /var/folders/2w/4v61661n3yv3w94_gft9_h5w0000gq/T/entitlement1610265318186720629.tmp -s 'Developer ID Application: Company Name (ID)' -f -o runtime --strict --timestamp -v {} ;
Codesign request: codesign --entitlements /var/folders/2w/4v61661n3yv3w94_gft9_h5w0000gq/T/entitlement1610265318186720629.tmp -s Developer ID Application: Company Name (ID) -f -o runtime --strict --timestamp -v /Users/username/builds/build/adt3172276520321907400.tmp/temp
/Users/username/builds/build/adt3172276520321907400.tmp/temp: replacing existing signature
/Users/username/builds/build/adt3172276520321907400.tmp/temp: code object is not signed at all
In subcomponent: /Users/username/builds/build/adt3172276520321907400.tmp/temp/Contents/Frameworks/MyANE2.framework
Process response code = 1

Expected Result: Application packaged without errors.

Known Workarounds

none *use AIR SDK 51.1.2.1 or below

ajwfrost commented 4 days ago

Curiously - the change here was to fix things for builds that were intended for App Store, and built on older macOS versions, where we were including entitlements into the frameworks (but that's not allowed for App Store apps.. not sure why it worked for DevID apps..). But revising it then exposed an issue which then makes it dependent upon the actual ANEs - and whether their frameworks are already signed.

We've got a fix for this, will be isolated to just adt.jar so fairly straightforward, will get it released shortly,.

thanks