From 9797782682c66c2c48265485e5ccd950042e8eb6 Mon Sep 17 00:00:00 2001 From: Jocelyn Turcotte Date: Mon, 22 Jun 2015 13:53:05 +0200 Subject: [PATCH] shell_i: Build the extension with the '-' identity by default This allows developers to build and run the extension by default. Official packages bundles will be re-signed after the build, we The SocketApi prefix can be set at configure time through cmake and should match the key that will be used to sign the whole .app bundle (including the embedded FindexSync .appex bundle). --- CMakeLists.txt | 4 ++++ config.h.in | 2 +- shell_integration/MacOSX/CMakeLists.txt | 9 ++++++--- .../MacOSX/OwnCloudFinder/ContentManager.m | 6 +++--- .../MacOSX/OwnCloudFinder/FinderHook.m | 4 ++-- .../MacOSX/OwnCloudFinder/Info.plist | 2 ++ .../MacOSX/OwnCloudFinder/MenuManager.m | 4 ++-- .../OwnCloudFinder.xcodeproj/project.pbxproj | 4 ++++ .../MacOSX/OwnCloudFinder/RequestManager.h | 4 ++-- .../MacOSX/OwnCloudFinder/RequestManager.m | 17 ++++++++++------- .../FinderSyncExt/FinderSync.m | 16 ++++++++++++---- .../FinderSyncExt/FinderSyncExt.entitlements | 2 +- .../OwnCloudFinderSync/FinderSyncExt/Info.plist | 4 ++-- .../project.pbxproj | 14 ++++++-------- src/gui/socketapi.cpp | 10 +++++----- 15 files changed, 62 insertions(+), 40 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index b4ea5569f9..7d7ac5ac96 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -118,6 +118,10 @@ if(OWNCLOUD_5XX_NO_BLACKLIST) add_definitions(-DOWNCLOUD_5XX_NO_BLACKLIST=1) endif() +if(APPLE) + set( SOCKETAPI_TEAM_IDENTIFIER_PREFIX "" CACHE STRING "SocketApi prefix (including a following dot) that must match the codesigh key's TeamIdentifier/Organizational Unit" ) +endif() + #### find libs #find_package(Qt4 4.7.0 COMPONENTS QtCore QtGui QtXml QtNetwork QtTest QtWebkit REQUIRED ) #if( UNIX AND NOT APPLE ) # Fdo notifications diff --git a/config.h.in b/config.h.in index 1f2e145ef1..a3e04ed759 100644 --- a/config.h.in +++ b/config.h.in @@ -5,7 +5,7 @@ #cmakedefine WITH_QTKEYCHAIN 1 #cmakedefine WITH_CRASHREPORTER #cmakedefine CRASHREPORTER_EXECUTABLE "@CRASHREPORTER_EXECUTABLE@" - +#define SOCKETAPI_TEAM_IDENTIFIER_PREFIX "@SOCKETAPI_TEAM_IDENTIFIER_PREFIX@" #cmakedefine APPLICATION_DOMAIN @APPLICATION_DOMAIN@ #cmakedefine THEME_CLASS @THEME_CLASS@ diff --git a/shell_integration/MacOSX/CMakeLists.txt b/shell_integration/MacOSX/CMakeLists.txt index d36647fbf1..b7d602ad33 100644 --- a/shell_integration/MacOSX/CMakeLists.txt +++ b/shell_integration/MacOSX/CMakeLists.txt @@ -1,9 +1,11 @@ if(APPLE) add_custom_target( legacy_mac_overlayplugin ALL - xcodebuild -workspace ${CMAKE_SOURCE_DIR}/shell_integration/MacOSX/OwnCloud.xcworkspace - -scheme SyncStateFinder.osax -configuration Release SYMROOT=${CMAKE_CURRENT_BINARY_DIR} - COMMENT building Legacy Mac Overlay icons) + xcodebuild -workspace ${CMAKE_SOURCE_DIR}/shell_integration/MacOSX/OwnCloud.xcworkspace + -scheme SyncStateFinder.osax -configuration Release SYMROOT=${CMAKE_CURRENT_BINARY_DIR} + OC_APPLICATION_REV_DOMAIN=${APPLICATION_REV_DOMAIN} + OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX=${SOCKETAPI_TEAM_IDENTIFIER_PREFIX} + COMMENT building Legacy Mac Overlay icons) # The bundle identifier and application group need to have compatible values with the client # to be able to open a Mach port across the extension's sandbox boundary. @@ -14,6 +16,7 @@ add_custom_target( mac_overlayplugin ALL -target FinderSyncExt -configuration Release SYMROOT=${CMAKE_CURRENT_BINARY_DIR} OC_APPLICATION_NAME=${APPLICATION_NAME} OC_APPLICATION_REV_DOMAIN=${APPLICATION_REV_DOMAIN} + OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX=${SOCKETAPI_TEAM_IDENTIFIER_PREFIX} COMMENT building Mac Overlay icons) INSTALL( DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/Release/SyncStateFinder.osax/Contents diff --git a/shell_integration/MacOSX/OwnCloudFinder/ContentManager.m b/shell_integration/MacOSX/OwnCloudFinder/ContentManager.m index 73f017bebb..e6bbc450ea 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/ContentManager.m +++ b/shell_integration/MacOSX/OwnCloudFinder/ContentManager.m @@ -142,7 +142,7 @@ static OwnCloudFinderContentManager* sharedInstance = nil; } NSString* normalizedPath = [path decomposedStringWithCanonicalMapping]; - if (![[RequestManager sharedInstance] isRegisteredPath:normalizedPath isDirectory:isDir]) { + if (![[OwnCloudFinderRequestManager sharedInstance] isRegisteredPath:normalizedPath isDirectory:isDir]) { return [NSNumber numberWithInt:0]; } @@ -154,7 +154,7 @@ static OwnCloudFinderContentManager* sharedInstance = nil; // Set 0 into the cache, meaning "don't have an icon, but already requested it" [_fileNamesCache setObject:result forKey:normalizedPath]; // start the async call - [[RequestManager sharedInstance] askForIcon:normalizedPath isDirectory:isDir]; + [[OwnCloudFinderRequestManager sharedInstance] askForIcon:normalizedPath isDirectory:isDir]; } if ([result intValue] == 0) { // Show the old state while we wait for the new one @@ -223,7 +223,7 @@ static OwnCloudFinderContentManager* sharedInstance = nil; } MenuManager* menuManager = [MenuManager sharedInstance]; - RequestManager* requestManager = [RequestManager sharedInstance]; + OwnCloudFinderRequestManager* requestManager = [OwnCloudFinderRequestManager sharedInstance]; if ([[window className] isEqualToString:@"TBrowserWindow"]) { diff --git a/shell_integration/MacOSX/OwnCloudFinder/FinderHook.m b/shell_integration/MacOSX/OwnCloudFinder/FinderHook.m index 788c16e864..dfb6197e64 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/FinderHook.m +++ b/shell_integration/MacOSX/OwnCloudFinder/FinderHook.m @@ -51,7 +51,7 @@ static BOOL installed = NO; // NSLog(@"SyncStateFinder: installing SyncState Shell extension"); - [RequestManager sharedInstance]; + [OwnCloudFinderRequestManager sharedInstance]; // Icons [self hookMethod:@selector(drawImage:) inClass:@"IKImageBrowserCell" toCallToTheNewMethod:@selector(OCIconOverlayHandlers_IKImageBrowserCell_drawImage:)]; // 10.7 & 10.8 & 10.9 (Icon View arrange by name) @@ -99,7 +99,7 @@ static BOOL installed = NO; [[IconCache sharedInstance] dealloc]; - [[RequestManager sharedInstance] dealloc]; + [[OwnCloudFinderRequestManager sharedInstance] dealloc]; // Icons [self hookMethod:@selector(OCIconOverlayHandlers_drawImage:) inClass:@"TIconViewCell" toCallToTheNewMethod:@selector(drawImage:)]; // 10.7 & 10.8 & 10.9 diff --git a/shell_integration/MacOSX/OwnCloudFinder/Info.plist b/shell_integration/MacOSX/OwnCloudFinder/Info.plist index a274600e15..f64f59a8ce 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/Info.plist +++ b/shell_integration/MacOSX/OwnCloudFinder/Info.plist @@ -2,6 +2,8 @@ + SocketApiPrefix + $(OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX)$(OC_APPLICATION_REV_DOMAIN) CFBundleDevelopmentRegion English CFBundleExecutable diff --git a/shell_integration/MacOSX/OwnCloudFinder/MenuManager.m b/shell_integration/MacOSX/OwnCloudFinder/MenuManager.m index 740b34e294..1fd9e0a53b 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/MenuManager.m +++ b/shell_integration/MacOSX/OwnCloudFinder/MenuManager.m @@ -73,7 +73,7 @@ static MenuManager* sharedInstance = nil; - (void)addItemsToMenu:(TContextMenu*)menu forFiles:(NSArray*)files { - RequestManager *requestManager = [RequestManager sharedInstance]; + OwnCloudFinderRequestManager *requestManager = [OwnCloudFinderRequestManager sharedInstance]; NSString *shareItemTitle = [requestManager shareItemTitle]; if (!shareItemTitle || shareItemTitle.length == 0) { return; @@ -157,7 +157,7 @@ static MenuManager* sharedInstance = nil; - (void)menuItemClicked:(id)param { - [[RequestManager sharedInstance] menuItemClicked:[param representedObject]]; + [[OwnCloudFinderRequestManager sharedInstance] menuItemClicked:[param representedObject]]; } - (NSArray*)pathsForNodes:(const struct TFENodeVector*)nodes diff --git a/shell_integration/MacOSX/OwnCloudFinder/OwnCloudFinder.xcodeproj/project.pbxproj b/shell_integration/MacOSX/OwnCloudFinder/OwnCloudFinder.xcodeproj/project.pbxproj index d23f229712..1ef53506d9 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/OwnCloudFinder.xcodeproj/project.pbxproj +++ b/shell_integration/MacOSX/OwnCloudFinder/OwnCloudFinder.xcodeproj/project.pbxproj @@ -285,6 +285,8 @@ GCC_OPTIMIZATION_LEVEL = 0; INFOPLIST_FILE = Info.plist; INSTALL_PATH = "$(HOME)/Library/Bundles"; + OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient; + OC_TEAM_IDENTIFIER_PREFIX = ""; PRODUCT_NAME = SyncStateFinder; WRAPPER_EXTENSION = bundle; }; @@ -302,6 +304,8 @@ GCC_MODEL_TUNING = G5; INFOPLIST_FILE = Info.plist; INSTALL_PATH = "$(HOME)/Library/Bundles"; + OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient; + OC_TEAM_IDENTIFIER_PREFIX = ""; PRODUCT_NAME = SyncStateFinder; WRAPPER_EXTENSION = bundle; }; diff --git a/shell_integration/MacOSX/OwnCloudFinder/RequestManager.h b/shell_integration/MacOSX/OwnCloudFinder/RequestManager.h index 136e4fd266..f3924fac60 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/RequestManager.h +++ b/shell_integration/MacOSX/OwnCloudFinder/RequestManager.h @@ -16,7 +16,7 @@ #import "RequestManager.h" #import "SyncClientProxy.h" -@interface RequestManager : NSObject +@interface OwnCloudFinderRequestManager : NSObject { SyncClientProxy *_syncClientProxy; @@ -29,7 +29,7 @@ @property (nonatomic, retain) NSString* filterFolder; -+ (RequestManager*)sharedInstance; ++ (OwnCloudFinderRequestManager*)sharedInstance; - (BOOL)isRegisteredPath:(NSString*)path isDirectory:(BOOL)isDir; - (void)askForIcon:(NSString*)path isDirectory:(BOOL)isDir; diff --git a/shell_integration/MacOSX/OwnCloudFinder/RequestManager.m b/shell_integration/MacOSX/OwnCloudFinder/RequestManager.m index ba450f4237..79be861cfb 100644 --- a/shell_integration/MacOSX/OwnCloudFinder/RequestManager.m +++ b/shell_integration/MacOSX/OwnCloudFinder/RequestManager.m @@ -16,19 +16,22 @@ #import "IconCache.h" #import "RequestManager.h" -#define READ_TAG 2422 +static OwnCloudFinderRequestManager* sharedInstance = nil; -static RequestManager* sharedInstance = nil; - -@implementation RequestManager +@implementation OwnCloudFinderRequestManager - (id)init { if ((self = [super init])) { // For the sake of allowing both the legacy and the FinderSync extensions to work with the same - // client build, use the same server name including the Team ID even though we won't be signing the bundle. - NSString *serverName = @"9B5WD74GWJ.com.owncloud.desktopclient.socketApi"; + // client build, use the same server name including the Team ID even though we won't be sandboxed. + NSBundle *extBundle = [NSBundle bundleForClass:[self class]]; + // This was added to the bundle's Info.plist to get it from the build system + NSString *socketApiPrefix = [extBundle objectForInfoDictionaryKey:@"SocketApiPrefix"]; + NSString *serverName = [socketApiPrefix stringByAppendingString:@".socketApi"]; + // NSLog(@"OwnCloudFinderRequestManager serverName %@", serverName); + _syncClientProxy = [[SyncClientProxy alloc] initWithDelegate:self serverName:serverName]; _registeredPathes = [[NSMutableDictionary alloc] init]; @@ -53,7 +56,7 @@ static RequestManager* sharedInstance = nil; [super dealloc]; } -+ (RequestManager*)sharedInstance ++ (OwnCloudFinderRequestManager*)sharedInstance { @synchronized(self) { diff --git a/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSync.m b/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSync.m index 0ffc7c5502..689cf750b5 100644 --- a/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSync.m +++ b/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSync.m @@ -25,7 +25,7 @@ FIFinderSyncController *syncController = [FIFinderSyncController defaultController]; NSBundle *extBundle = [NSBundle bundleForClass:[self class]]; // This was added to the bundle's Info.plist to get it from the build system - NSString *teamIdentifierPrefix = [extBundle objectForInfoDictionaryKey:@"TeamIdentifierPrefix"]; + NSString *socketApiPrefix = [extBundle objectForInfoDictionaryKey:@"SocketApiPrefix"]; NSImage *ok = [extBundle imageForResource:@"ok.icns"]; NSImage *ok_swm = [extBundle imageForResource:@"ok_swm.icns"]; @@ -44,10 +44,18 @@ [syncController setBadgeImage:warning label:@"Ignored" forBadgeIdentifier:@"IGNORE+SWM"]; [syncController setBadgeImage:error label:@"Error" forBadgeIdentifier:@"ERROR+SWM"]; - // The Mach port name needs to be prefixed with the code signing Team ID + // The Mach port name needs to: + // - Be prefixed with the code signing Team ID + // - Then infixed with the sandbox App Group + // - The App Group itself must be a prefix of (or equal to) the application bundle identifier + // We end up in the official signed client with: 9B5WD74GWJ.com.owncloud.desktopclient.socketApi + // With ad-hoc signing (the '-' signing identity) we must drop the Team ID. + // When the code isn't sandboxed (e.g. the OC client or the legacy overlay icon extension) + // the OS doesn't seem to put any restriction on the port name, so we just follow what + // the sandboxed App Extension needs. // https://developer.apple.com/library/mac/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW24 - NSString *serverName = [[teamIdentifierPrefix stringByAppendingString:[extBundle bundleIdentifier]] - stringByReplacingOccurrencesOfString:@".FinderSyncExt" withString:@".socketApi"]; + NSString *serverName = [socketApiPrefix stringByAppendingString:@".socketApi"]; + // NSLog(@"FinderSync serverName %@", serverName); _syncClientProxy = [[SyncClientProxy alloc] initWithDelegate:self serverName:serverName]; _registeredDirectories = [[NSMutableSet alloc] init]; diff --git a/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSyncExt.entitlements b/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSyncExt.entitlements index 20605791ae..5d2a36d31b 100644 --- a/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSyncExt.entitlements +++ b/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSyncExt.entitlements @@ -6,7 +6,7 @@ com.apple.security.application-groups - $(TeamIdentifierPrefix)$(OC_APPLICATION_REV_DOMAIN) + $(OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX)$(OC_APPLICATION_REV_DOMAIN) diff --git a/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/Info.plist b/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/Info.plist index 36fe63e7c8..88bb87e916 100644 --- a/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/Info.plist +++ b/shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/Info.plist @@ -2,8 +2,8 @@ - TeamIdentifierPrefix - $(TeamIdentifierPrefix) + SocketApiPrefix + $(OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX)$(OC_APPLICATION_REV_DOMAIN) CFBundleDevelopmentRegion en CFBundleDisplayName diff --git a/shell_integration/MacOSX/OwnCloudFinderSync/OwnCloudFinderSync.xcodeproj/project.pbxproj b/shell_integration/MacOSX/OwnCloudFinderSync/OwnCloudFinderSync.xcodeproj/project.pbxproj index 80ac3abf7b..7092986372 100644 --- a/shell_integration/MacOSX/OwnCloudFinderSync/OwnCloudFinderSync.xcodeproj/project.pbxproj +++ b/shell_integration/MacOSX/OwnCloudFinderSync/OwnCloudFinderSync.xcodeproj/project.pbxproj @@ -312,8 +312,7 @@ CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; CLANG_WARN_UNREACHABLE_CODE = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; - CODE_SIGN_IDENTITY = "Developer ID Application"; - "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer"; + CODE_SIGN_IDENTITY = "-"; COMBINE_HIDPI_IMAGES = YES; COPY_PHASE_STRIP = NO; DEBUG_INFORMATION_FORMAT = dwarf; @@ -362,8 +361,7 @@ CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; CLANG_WARN_UNREACHABLE_CODE = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; - CODE_SIGN_IDENTITY = "Developer ID Application"; - "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer"; + CODE_SIGN_IDENTITY = "-"; COMBINE_HIDPI_IMAGES = YES; COPY_PHASE_STRIP = NO; DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; @@ -405,8 +403,7 @@ CLANG_WARN_UNREACHABLE_CODE = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; CODE_SIGN_ENTITLEMENTS = FinderSyncExt/FinderSyncExt.entitlements; - CODE_SIGN_IDENTITY = "Developer ID Application"; - "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer"; + CODE_SIGN_IDENTITY = "-"; COMBINE_HIDPI_IMAGES = YES; COPY_PHASE_STRIP = NO; DEBUG_INFORMATION_FORMAT = dwarf; @@ -432,6 +429,7 @@ MTL_ENABLE_DEBUG_INFO = YES; OC_APPLICATION_NAME = ownCloud; OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient; + OC_TEAM_IDENTIFIER_PREFIX = ""; ONLY_ACTIVE_ARCH = YES; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE = ""; @@ -458,8 +456,7 @@ CLANG_WARN_UNREACHABLE_CODE = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; CODE_SIGN_ENTITLEMENTS = FinderSyncExt/FinderSyncExt.entitlements; - CODE_SIGN_IDENTITY = "Developer ID Application"; - "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer"; + CODE_SIGN_IDENTITY = "-"; COMBINE_HIDPI_IMAGES = YES; COPY_PHASE_STRIP = NO; DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; @@ -479,6 +476,7 @@ MTL_ENABLE_DEBUG_INFO = NO; OC_APPLICATION_NAME = ownCloud; OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient; + OC_TEAM_IDENTIFIER_PREFIX = ""; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE = ""; SDKROOT = macosx; diff --git a/src/gui/socketapi.cpp b/src/gui/socketapi.cpp index 41c5069118..411458ee80 100644 --- a/src/gui/socketapi.cpp +++ b/src/gui/socketapi.cpp @@ -16,6 +16,7 @@ #include "socketapi.h" +#include "config.h" #include "configfile.h" #include "folderman.h" #include "folder.h" @@ -84,11 +85,10 @@ SocketApi::SocketApi(QObject* parent) // See issue #2388 // + Theme::instance()->appName(); } else if (Utility::isMac()) { - // This much match the code signing Team setting of the extension - // FIXME: Hardcoded for now, but if we want to allow builds to be - // signed by third party Apple Developer accounts, we'll have to - // allow changing this through the build system. - socketPath = "9B5WD74GWJ." APPLICATION_REV_DOMAIN ".socketApi"; + // This must match the code signing Team setting of the extension + // Example for developer builds (with ad-hoc signing identity): "" "com.owncloud.desktopclient" ".socketApi" + // Example for official signed packages: "9B5WD74GWJ." "com.owncloud.desktopclient" ".socketApi" + socketPath = SOCKETAPI_TEAM_IDENTIFIER_PREFIX APPLICATION_REV_DOMAIN ".socketApi"; } else if( Utility::isLinux() || Utility::isBSD() ) { QString runtimeDir; #if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)