Merge 2.3 into masterHEADmaster

Change-Id: Ibcc502f9af2acce8b1b5949aa1ee7e33577a8ed3

12 files changed, 193 insertions, 138 deletions

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 20e936d8d..71c1ae4ac 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -34,15 +34,11 @@ jobs:
     - uses: actions/checkout@v1
     - name: Create .ccache dir
       run: mkdir -p ~/.ccache
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/.ccache
-        key: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache-
+        key: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache
     - name: Pull the Docker Image
       run: docker-compose pull ${{ matrix.config.image }}
     - name: Print ccache stats
@@ -52,7 +48,7 @@ jobs:
     - name: Print ccache stats
       run: docker-compose run ${{ matrix.config.image }} ccache -s
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-${{ matrix.config.suffix }}-${{ github.run_id }}.tar.gz
         path: release/qbs-${{ matrix.config.suffix }}-${{ github.run_id }}.tar.gz
@@ -114,15 +110,11 @@ jobs:
     - uses: actions/checkout@v1
     - name: Create .ccache dir
       run: mkdir -p ~/.ccache
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/.ccache
-        key: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache-
+        key: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache
     - name: Pull the Docker Image
       run: docker-compose pull ${{ matrix.config.image }}
     - name: Print ccache stats
@@ -165,15 +157,11 @@ jobs:
     - uses: actions/checkout@v1
     - name: Create .ccache dir
       run: mkdir -p ~/.ccache
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/.ccache
-        key: ${{ runner.os }}-ccache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-ccache-
+        key: ${{ runner.os }}-ccache
     - name: Install required packages
       run: |
         brew install ccache p7zip
@@ -198,7 +186,7 @@ jobs:
     - name: Print ccache stats
       run: ccache -s
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-macos-${{ github.run_id }}.tar.gz
         path: release/qbs-macos-${{ github.run_id }}.tar.gz
@@ -219,18 +207,13 @@ jobs:
       QT_ASSUME_STDERR_HAS_CONSOLE: 1
     steps:
     - uses: actions/checkout@v1
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-      shell: bash
     - name: clcache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/clcache
-        key: ${{ runner.os }}-msvc-clcache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-msvc-clcache-
+        key: ${{ runner.os }}-msvc-clcache
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: 3.8
     - name: Install required packages
@@ -260,7 +243,7 @@ jobs:
     - name: Print clcache stats
       run: clcache -s
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-windows-${{ github.run_id }}.zip
         path: release/qbs-windows-${{ github.run_id }}.zip
@@ -281,18 +264,13 @@ jobs:
       CCACHE_DIR: ${{ github.workspace }}\ccache
     steps:
     - uses: actions/checkout@v1
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-      shell: bash
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ${{ github.workspace }}/ccache
-        key: ${{ runner.os }}-mingw-ccache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-mingw-ccache-
+        key: ${{ runner.os }}-mingw-ccache
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: 3.8
     - name: Install required packages
@@ -324,7 +302,7 @@ jobs:
     - name: Print ccache stats
       run: ccache -s
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-windows-mingw-${{ github.run_id }}.zip
         path: release/qbs-windows-mingw-${{ github.run_id }}.zip
@@ -423,7 +401,7 @@ jobs:
     steps:
     - uses: actions/checkout@v1
     - name: Download artifact
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-${{ matrix.config.suffix }}-${{ github.run_id }}.tar.gz
         path: ./
@@ -444,7 +422,7 @@ jobs:
     steps:
     - uses: actions/checkout@v1
     - name: Download artifact
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-linux-jammy-${{ github.run_id }}.tar.gz
         path: ./
@@ -483,7 +461,7 @@ jobs:
     steps:
     - uses: actions/checkout@v1
     - name: Download artifact
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-windows-${{ github.run_id }}.zip
         path: ./
@@ -707,7 +685,7 @@ jobs:
     steps:
     - uses: actions/checkout@v1
     - name: Download artifact
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-macos-${{ github.run_id }}.tar.gz
         path: ./
@@ -810,7 +788,7 @@ jobs:
     steps:
     - uses: actions/checkout@v1
     - name: Download artifact
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-windows-${{ github.run_id }}.zip
         path: ./
@@ -913,7 +891,7 @@ jobs:
     steps:
     - uses: actions/checkout@v1
     - name: Download artifact
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-windows-${{ github.run_id }}.zip
         path: ./
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 664af4768..1b65762e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,28 +37,24 @@ jobs:
       run: mkdir -p ~/.ccache
     - name: test
       run: echo ${{ github.ref }}
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/.ccache
-        key: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache-
-    - name: Pull the Focal Image
-      run: docker-compose pull focal
+        key: ${{ runner.os }}-${{ matrix.config.cacheid }}-ccache
+    - name: Pull the Docker Image
+      run: docker-compose pull jammy-qt6
     - name: Print ccache stats
-      run: docker-compose run focal ccache -s
+      run: docker-compose run jammy-qt6 ccache -s
     - name: Build Qbs
-      run: docker-compose run focal ${{ matrix.config.script }}
+      run: docker-compose run jammy-qt6 ${{ matrix.config.script }}
     - name: Print ccache stats
-      run: docker-compose run focal ccache -s
+      run: docker-compose run jammy-qt6 ccache -s
     - name: Get archive name
       id: get-archive-name
-      run: echo ::set-output name=archive-name::$(git describe)
+      run: echo "archive-name=$(git describe)" >> $GITHUB_OUTPUT
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-linux-${{ github.run_id }}.tar.gz
         path: release/qbs-linux-${{ github.run_id }}.tar.gz
@@ -81,15 +77,11 @@ jobs:
     - uses: actions/checkout@v1
     - name: Create .ccache dir
       run: mkdir -p ~/.ccache
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/.ccache
-        key: ${{ runner.os }}-release-ccache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-release-ccache-
+        key: ${{ runner.os }}-release-ccache
     - name: Install required packages
       run: |
         brew install ccache p7zip
@@ -114,7 +106,7 @@ jobs:
     - name: Print ccache stats
       run: ccache -s
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-macos-${{ github.run_id }}.tar.gz
         path: release/qbs-macos-${{ github.run_id }}.tar.gz
@@ -132,16 +124,11 @@ jobs:
     - name: Create .ccache dir
       run: mkdir -p ~/.ccache
       shell: bash
-    - name: prepare timestamp
-      id: get-timestamp
-      run: echo ::set-output name=timestamp::$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-      shell: bash
     - name: clcache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ~/.ccache
-        key: ${{ runner.os }}-release-msvc-docker-clcache-${{ steps.get-timestamp.outputs.timestamp }}
-        restore-keys: ${{ runner.os }}-release-msvc-docker-clcache-
+        key: ${{ runner.os }}-release-msvc-docker-clcache
     - name: Pull the Windows Image
       run: docker-compose pull windows
     - name: Print clcache stats
@@ -162,10 +149,9 @@ jobs:
       run: docker-compose run --rm windows clcache -s
     - name: Get archive name
       id: get-archive-name
-      run: echo ::set-output name=archive-name::$(git describe)
-      shell: bash
+      run: echo "archive-name=$(git describe)" >> $GITHUB_OUTPUT
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-windows-${{ github.run_id }}
         path: |
@@ -182,7 +168,7 @@ jobs:
         submodules: true
     - name: Get version name
       id: get-version-name
-      run: echo ::set-output name=version-name::$(cat VERSION)
+      run: echo "version-name=$(cat VERSION)" >> $GITHUB_OUTPUT
     - name: Create directories
       run: |
         mkdir release
@@ -198,7 +184,7 @@ jobs:
         cd tmp/
         tar czf ../release/qbs-src-${{ steps.get-version-name.outputs.version-name }}.tar.gz qbs-src-${{ steps.get-version-name.outputs.version-name }}
     - name: Download Linux artifacts
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-linux-${{ github.run_id }}.tar.gz
         path: ./tmp
@@ -209,7 +195,7 @@ jobs:
         cd tmp/
         tar czf ../release/qbs-linux-x86_64-${{ steps.get-version-name.outputs.version-name }}.tar.gz qbs-linux-x86_64-${{ steps.get-version-name.outputs.version-name }}
     - name: Download Windows artifacts
-      uses: actions/download-artifact@v1
+      uses: actions/download-artifact@v4
       with:
         name: qbs-windows-${{ github.run_id }}
         path: ./tmp/release
@@ -226,9 +212,9 @@ jobs:
         find . -type f -printf '%f\n' | grep -v .txt | xargs sha256sum > sha256sums.txt
     - name: Get archive name
       id: get-archive-name
-      run: echo ::set-output name=archive-name::$(git describe)
+      run: echo "archive-name=$(git describe)" >> $GITHUB_OUTPUT
     - name: Upload artifacts
-      uses: 'actions/upload-artifact@v2'
+      uses: 'actions/upload-artifact@v4'
       with:
         name: qbs-release-${{ steps.get-archive-name.outputs.archive-name }}
         path: |
diff --git a/VERSION b/VERSION
index 276cbf9e2..197c4d5c2 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.3.0
+2.4.0
diff --git a/changelogs/changes-2.3.0.md b/changelogs/changes-2.3.0.md
new file mode 100644
index 000000000..9062b27ff
--- /dev/null
+++ b/changelogs/changes-2.3.0.md
@@ -0,0 +1,37 @@
+# General
+* Added an LSP language server that provides support for following symbols and completion
+  in IDEs (QBS-395).
+* Module properties are now directly available within groups in modules (QBS-1770).
+* Added possibility to export products to CMake via the new Exporter.cmake module.
+* Deprecated the pkgconfig-based fallback module provider.
+* If a project needs to be re-resolved, we now print the reason.
+* Added some tutorials.
+* Wildards handling was rewritten to track changes more accurate.
+* Module 'validate' scripts are no longer run for erroneous product in IDE mode.
+* Add example how to use Exporters.
+
+# C/C++ Support
+* Private dependencies of products are not traversed more than once anymore (QBS-1714).
+
+# Language
+* Module properties are now accessible for groups in modules (QBS-1770).
+* Fixed pathList properties in Probes (QBS-1785).
+* The qbspkgconfig.mergeDependencies property was removed.
+* ModuleProviders now support the 'allowedValues' property of the PropertyDeclaration item
+  (QBS-1748).
+
+# Apple
+* Adapted darwin support to Xcode 15.3.
+
+# CI
+* Changed Linux Docker images from Focal to Jammy.
+* Updated compilers and linters to recent versions.
+* Added clang-format job to check code style.
+* The project.withExamples property was removed.
+
+# Contributors
+* Christian Kandeler
+* Dmitrii Meshkov
+* Ivan Komissarov
+* Raphael Cotty
+* Richard Weickelt
diff --git a/changelogs/changes-2.3.1.md b/changelogs/changes-2.3.1.md
new file mode 100644
index 000000000..598c6748f
--- /dev/null
+++ b/changelogs/changes-2.3.1.md
@@ -0,0 +1,12 @@
+# Language
+* Fixed look-up of qbs properties in module providers via probes (QBS-1742).
+
+# Apple support
+* Fixed codesing module when multiplexing over build variants (QBS-1775).
+
+# CI
+* Fixed release jobs.
+
+# Contributors
+* Christian Kandeler
+* Ivan Komissarov
diff --git a/doc/howtos.qdoc b/doc/howtos.qdoc
index b3b385feb..9a81318ee 100644
--- a/doc/howtos.qdoc
+++ b/doc/howtos.qdoc
@@ -25,7 +25,7 @@
 **
 ****************************************************************************/
 /*!
-    \previouspage custom-modules.html
+    \previouspage tutorial-8.html
     \nextpage reference.html
     \page howtos.html
 
diff --git a/doc/tutorial.qdoc b/doc/tutorial.qdoc
index 59aed2888..da3dc33db 100644
--- a/doc/tutorial.qdoc
+++ b/doc/tutorial.qdoc
@@ -28,7 +28,7 @@
 /*!
     \previouspage module-providers.html
     \page tutorial.html
-    \nextpage howtos.html
+    \nextpage tutorial-1.html
 
     \title Tutorial
 
diff --git a/share/qbs/modules/codesign/codesign.js b/share/qbs/modules/codesign/codesign.js
index 903d16f80..482225ea2 100644
--- a/share/qbs/modules/codesign/codesign.js
+++ b/share/qbs/modules/codesign/codesign.js
@@ -280,20 +280,21 @@ function prepareSign(project, product, inputs, outputs, input, output) {
         return cmds;
 
     var isBundle = "bundle.content" in outputs;
-    var outputFilePath = isBundle
-            ? FileInfo.joinPaths(product.destinationDirectory, product.bundle.bundleName)
-            : outputs["codesign.signed_artifact"][0].filePath;
-    var outputFileName = isBundle
-            ? product.bundle.bundleName
-            : outputs["codesign.signed_artifact"][0].fileName;
-    var isProductBundle = product.bundle && product.bundle.isBundle;
 
-    // If the product is a bundle, just sign the bundle
-    // instead of signing the bundle and executable separately
+    var artifacts = [];
+    if (isBundle) {
+        artifacts = [{
+            filePath: FileInfo.joinPaths(product.destinationDirectory, product.bundle.bundleName),
+            fileName: product.bundle.bundleName
+        }];
+    } else {
+        artifacts = outputs["codesign.signed_artifact"];
+    }
+    var isProductBundle = product.bundle && product.bundle.isBundle;
     var shouldSignArtifact = !isProductBundle || isBundle;
 
     var enableCodeSigning = product.codesign.enableCodeSigning;
-    if (enableCodeSigning && shouldSignArtifact) {
+    if (enableCodeSigning) {
         var actualSigningIdentity = product.codesign._actualSigningIdentity;
         if (!actualSigningIdentity) {
             throw "No codesigning identities (i.e. certificate and private key pairs) matching “"
@@ -310,36 +311,53 @@ function prepareSign(project, product, inputs, outputs, input, output) {
             }
         }
 
-        var args = ["--force", "--sign", actualSigningIdentity.SHA1];
-
-        // If signingTimestamp is undefined or empty, do not specify the flag at all -
-        // this uses the system-specific default behavior
-        var signingTimestamp = product.codesign.signingTimestamp;
-        if (signingTimestamp) {
-            // If signingTimestamp is an empty string, specify the flag but do
-            // not specify a value - this uses a default Apple-provided server
-            var flag = "--timestamp";
-            if (signingTimestamp)
-                flag += "=" + signingTimestamp;
-            args.push(flag);
+        // The codesign tool behaves weirdly. It can sign a bundle with a single artifact, but if
+        // say debug build variant is present, it starts complaining that it is not signed.
+        // We could always sign everything, but again, in case of a framework (but not in case of
+        // app or loadable bundle), codesign produces a warning that artifact is already signed.
+        // So, we skip signing the release artifact and only sign if other build variants present.
+        if (!shouldSignArtifact && artifacts.length == 1) {
+            artifacts = [];
         }
+        for (var i = 0; i < artifacts.length; ++i) {
+            if (!shouldSignArtifact
+                && artifacts[i].qbs && artifacts[i].qbs.buildVariant === "release") {
+                continue;
+            }
+            var outputFilePath = artifacts[i].filePath;
+            var outputFileName = artifacts[i].fileName;
+
+            var args = ["--force", "--sign", actualSigningIdentity.SHA1];
+
+            // If signingTimestamp is undefined or empty, do not specify the flag at all -
+            // this uses the system-specific default behavior
+            var signingTimestamp = product.codesign.signingTimestamp;
+            if (signingTimestamp) {
+                // If signingTimestamp is an empty string, specify the flag but do
+                // not specify a value - this uses a default Apple-provided server
+                var flag = "--timestamp";
+                if (signingTimestamp)
+                    flag += "=" + signingTimestamp;
+                args.push(flag);
+            }
 
-        for (var j in inputs["codesign.xcent"]) {
-            args.push("--entitlements", inputs["codesign.xcent"][j].filePath);
-            break; // there should only be one
-        }
+            for (var j in inputs["codesign.xcent"]) {
+                args.push("--entitlements", inputs["codesign.xcent"][j].filePath);
+                break; // there should only be one
+            }
 
-        args = args.concat(product.codesign.codesignFlags || []);
+            args = args.concat(product.codesign.codesignFlags || []);
 
-        args.push(outputFilePath + subpath);
-        cmd = new Command(product.codesign.codesignPath, args);
-        cmd.description = "codesign " + outputFileName
-                + " (" + actualSigningIdentity.subjectInfo.CN + ")";
-        cmd.outputFilePath = outputFilePath;
-        cmd.stderrFilterFunction = function(stderr) {
-            return stderr.replace(outputFilePath + ": replacing existing signature\n", "");
-        };
-        cmds.push(cmd);
+            args.push(outputFilePath + subpath);
+            cmd = new Command(product.codesign.codesignPath, args);
+            cmd.description = "codesign " + outputFileName
+                    + " (" + actualSigningIdentity.subjectInfo.CN + ")";
+            cmd.outputFilePath = outputFilePath;
+            cmd.stderrFilterFunction = function(stderr) {
+                return stderr.replace(outputFilePath + ": replacing existing signature\n", "");
+            };
+            cmds.push(cmd);
+        }
     }
 
     if (isBundle) {
diff --git a/src/lib/corelib/loader/moduleproviderloader.cpp b/src/lib/corelib/loader/moduleproviderloader.cpp
index 086448955..d0789facd 100644
--- a/src/lib/corelib/loader/moduleproviderloader.cpp
+++ b/src/lib/corelib/loader/moduleproviderloader.cpp
@@ -362,7 +362,9 @@ ModuleProviderLoader::EvaluationResult ModuleProviderLoader::evaluateModuleProvi
                  BuiltinDeclarations::instance().nameForType(ItemType::ModuleProvider)));
     }
 
-    providerItem->setScope(createProviderScope(product, qbsModule));
+    Item * const scope = createProviderScope(product, qbsModule);
+    for (auto it = providerItem->properties().begin(); it != providerItem->properties().end(); ++it)
+        it.value()->setScope(scope, {});
     providerItem->setProperty(
         StringConstants::nameProperty(),
         VariantValue::create(name.toString()));
diff --git a/tests/auto/blackbox/testdata-apple/codesign/codesign.qbs b/tests/auto/blackbox/testdata-apple/codesign/codesign.qbs
index 08c8f730b..c1fc0502a 100644
--- a/tests/auto/blackbox/testdata-apple/codesign/codesign.qbs
+++ b/tests/auto/blackbox/testdata-apple/codesign/codesign.qbs
@@ -2,10 +2,13 @@ import "../multiarch-helpers.js" as Helpers
 
 Project {
     name: "p"
+    // we do not have the access to xcode version in qbs.architectures so we need to pass it here
     property string xcodeVersion
 
     property bool isBundle: true
     property bool enableSigning: true
+    property bool multiArch: false
+    property bool multiVariant: false
 
     CppApplication {
         name: "A"
@@ -18,7 +21,8 @@ Project {
         installDir: ""
 
         qbs.architectures:
-            project.xcodeVersion ? Helpers.getArchitectures(qbs, project.xcodeVersion) : []
+            multiArch ? Helpers.getArchitectures(qbs, project.xcodeVersion) : []
+        qbs.buildVariants: project.multiVariant ? ["debug", "release"] : []
     }
 
     DynamicLibrary {
@@ -32,7 +36,8 @@ Project {
         install: true
         installDir: ""
         qbs.architectures:
-            project.xcodeVersion ? Helpers.getArchitectures(qbs, project.xcodeVersion) : []
+            multiArch ? Helpers.getArchitectures(qbs, project.xcodeVersion) : []
+        qbs.buildVariants: project.multiVariant ? ["debug", "release"] : []
     }
 
     LoadableModule {
@@ -46,6 +51,7 @@ Project {
         install: true
         installDir: ""
         qbs.architectures:
-            project.xcodeVersion ? Helpers.getArchitectures(qbs, project.xcodeVersion) : []
+            multiArch ? Helpers.getArchitectures(qbs, project.xcodeVersion) : []
+        qbs.buildVariants: project.multiVariant ? ["debug", "release"] : []
     }
 }
diff --git a/tests/auto/blackbox/testdata-providers/probe-in-module-provider/module-providers/provider_a.qbs b/tests/auto/blackbox/testdata-providers/probe-in-module-provider/module-providers/provider_a.qbs
index a1228b19c..476a83143 100644
--- a/tests/auto/blackbox/testdata-providers/probe-in-module-provider/module-providers/provider_a.qbs
+++ b/tests/auto/blackbox/testdata-providers/probe-in-module-provider/module-providers/provider_a.qbs
@@ -1,11 +1,13 @@
 import "../../qbs-module-providers-helpers.js" as Helpers
 
 ModuleProvider {
+    property string sysroot: qbs.sysroot
     Probe {
         id: theProbe
         property string theValue: "value"
+        property string dummy: sysroot
         configure: {
-            console.info("Running probe");
+            console.info("Running probe with irrelevant value '" + dummy + "'");
             found = true;
         }
     }
@@ -14,6 +16,8 @@ ModuleProvider {
     property string theValue: theProbe.theValue
     relativeSearchPaths: {
         Helpers.writeModule(outputBaseDir, "qbsmetatestmodule", theValue, undefined, found);
+        if (sysroot !== qbs.sysroot)
+            throw "this is unexpected";
         return "";
     }
 }
diff --git a/tests/auto/blackbox/tst_blackboxapple.cpp b/tests/auto/blackbox/tst_blackboxapple.cpp
index 02b56f603..30e20a1c9 100644
--- a/tests/auto/blackbox/tst_blackboxapple.cpp
+++ b/tests/auto/blackbox/tst_blackboxapple.cpp
@@ -712,9 +712,11 @@ void TestBlackboxApple::byteArrayInfoPlist()
 
 void TestBlackboxApple::codesign()
 {
+    QFETCH(int, expectedCount);
     QFETCH(bool, isBundle);
     QFETCH(bool, enableSigning);
     QFETCH(bool, multiArch);
+    QFETCH(bool, multiVariant);
 
     const auto xcodeVersion = findXcodeVersion();
 
@@ -723,20 +725,21 @@ void TestBlackboxApple::codesign()
 
     QDir::setCurrent(testDataDir + "/codesign");
     QbsRunParameters params(QStringList{"qbs.installPrefix:''"});
-    params.arguments
-            << QStringLiteral("project.isBundle:%1").arg(isBundle ? "true" : "false");
-    params.arguments
-            << QStringLiteral("project.enableSigning:%1").arg(enableSigning ? "true" : "false");
-    if (multiArch)
-        params.arguments << QStringLiteral("project.xcodeVersion:") + xcodeVersion->toString();
+    // the test can't use xcode module to determine version itself
+    params.arguments << QStringLiteral("project.xcodeVersion:") + xcodeVersion->toString();
+    params.arguments << QStringLiteral("project.isBundle:%1").arg(isBundle ? "true" : "false");
+    params.arguments << QStringLiteral("project.enableSigning:%1")
+                            .arg(enableSigning ? "true" : "false");
+    params.arguments << QStringLiteral("project.multiArch:%1").arg(multiArch ? "true" : "false");
+    params.arguments << QStringLiteral("project.multiVariant:%1")
+                            .arg(multiVariant ? "true" : "false");
 
     rmDirR(relativeBuildDir());
     QCOMPARE(runQbs(params), 0);
 
     const int codeSignCount =
             QString::fromUtf8(m_qbsStdout).count(QStringLiteral("codesign"));
-    // We have 3 products, we have to sign each exactly once, even in the multiplexed case
-    QCOMPARE(codeSignCount, enableSigning ? 3 : 0);
+    QCOMPARE(codeSignCount, expectedCount);
 
     const auto appName = isBundle ? QStringLiteral("A.app") : QStringLiteral("A");
     const auto appPath = defaultInstallRoot + "/" + appName;
@@ -781,16 +784,25 @@ void TestBlackboxApple::codesign()
 
 void TestBlackboxApple::codesign_data()
 {
+    QTest::addColumn<int>("expectedCount");
     QTest::addColumn<bool>("isBundle");
     QTest::addColumn<bool>("enableSigning");
     QTest::addColumn<bool>("multiArch");
-
-    QTest::newRow("bundle, unsigned") << true << false << false;
-    QTest::newRow("standalone, unsigned") << false << false << false;
-    QTest::newRow("bundle, signed") << true << true << false;
-    QTest::newRow("standalone, signed") << false << true << false;
-    QTest::newRow("bundle, signed, multiarch") << true << true << true;
-    QTest::newRow("standalone, signed, multiarch") << false << true << true;
+    QTest::addColumn<bool>("multiVariant");
+
+    QTest::newRow("standalone, unsigned") << 0 << false << false << false << false;
+    QTest::newRow("bundle, unsigned") << 0 << true << false << false << false;
+    QTest::newRow("standalone, signed") << 3 << false << true << false << false;
+    QTest::newRow("bundle, signed") << 3 << true << true << false << false;
+    // here we only sign the resulting lipo artifact
+    QTest::newRow("standalone, signed, multiarch") << 3 << false << true << true << false;
+    QTest::newRow("bundle, signed, multiarch") << 3 << true << true << true << false;
+    // here we sign all artifacts
+    QTest::newRow("standalone, signed, multivariant") << 15 << false << true << false << true;
+    QTest::newRow("bundle, signed, multivariant") << 15 << true << true << false << true;
+    QTest::newRow("standalone, signed, multiarch, multivariant")
+        << 15 << false << true << true << true;
+    QTest::newRow("bundle, signed, multiarch, multivariant") << 15 << true << true << true << true;
 }
 
 void TestBlackboxApple::deploymentTarget()