codesign: do not sign intermediate products when multiplexing

We should only sign the resulting binary during the lipo step.

Change-Id: If4d508bcdf347bf2fc68d345ed8d5913a7457f8d
Reviewed-by: Christian Kandeler <christian.kandeler@qt.io>

3 files changed, 17 insertions, 4 deletions

diff --git a/share/qbs/modules/cpp/DarwinGCC.qbs b/share/qbs/modules/cpp/DarwinGCC.qbs
index 3249b552f..158c3c061 100644
--- a/share/qbs/modules/cpp/DarwinGCC.qbs
+++ b/share/qbs/modules/cpp/DarwinGCC.qbs
@@ -216,7 +216,8 @@ UnixGCC {
         multiplex: true
 
         outputFileTags: ["bundle.input", "application", "primary", "debuginfo_app",
-                         "debuginfo_bundle", "bundle.variant_symlink", "debuginfo_plist"]
+                         "debuginfo_bundle", "bundle.variant_symlink", "debuginfo_plist",
+                         "codesign.signed_artifact"]
         outputArtifacts: Darwin.lipoOutputArtifacts(product, inputs, "application", "app")
 
         prepare: Darwin.prepareLipo.apply(Darwin, arguments)
@@ -228,7 +229,7 @@ UnixGCC {
         multiplex: true
 
         outputFileTags: ["bundle.input", "loadablemodule", "primary", "debuginfo_loadablemodule",
-                         "debuginfo_bundle", "debuginfo_plist"]
+                         "debuginfo_bundle", "debuginfo_plist", "codesign.signed_artifact"]
         outputArtifacts: Darwin.lipoOutputArtifacts(product, inputs, "loadablemodule",
                                                                      "loadablemodule")
 
@@ -242,7 +243,7 @@ UnixGCC {
 
         outputFileTags: ["bundle.input", "dynamiclibrary", "dynamiclibrary_symbols", "primary",
                          "debuginfo_dll","debuginfo_bundle","bundle.variant_symlink",
-                         "debuginfo_plist"]
+                         "debuginfo_plist", "codesign.signed_artifact"]
         outputArtifacts: Darwin.lipoOutputArtifacts(product, inputs, "dynamiclibrary", "dll")
 
         prepare: Darwin.prepareLipo.apply(Darwin, arguments)
@@ -253,7 +254,7 @@ UnixGCC {
         inputsFromDependencies: ["staticlibrary"]
         multiplex: true
 
-        outputFileTags: ["bundle.input", "staticlibrary", "primary"]
+        outputFileTags: ["bundle.input", "staticlibrary", "primary", "codesign.signed_artifact"]
         outputArtifacts: Darwin.lipoOutputArtifacts(product, inputs, "staticlibrary")
 
         prepare: Darwin.prepareLipo.apply(Darwin, arguments)
diff --git a/share/qbs/modules/cpp/GenericGCC.qbs b/share/qbs/modules/cpp/GenericGCC.qbs
index 3b6e5b106..e2d9eeab5 100644
--- a/share/qbs/modules/cpp/GenericGCC.qbs
+++ b/share/qbs/modules/cpp/GenericGCC.qbs
@@ -214,6 +214,8 @@ CppModule {
 
     readonly property bool shouldSignArtifacts: codesign._canSignArtifacts
                                                 && codesign.enableCodeSigning
+                                                // codesigning is done during the lipo step
+                                                && !product.multiplexed
 
     property string internalVersion: {
         if (product.version === undefined)
diff --git a/share/qbs/modules/cpp/darwin.js b/share/qbs/modules/cpp/darwin.js
index 6373b57c4..7f7e9a05d 100644
--- a/share/qbs/modules/cpp/darwin.js
+++ b/share/qbs/modules/cpp/darwin.js
@@ -28,6 +28,7 @@
 **
 ****************************************************************************/
 
+var Codesign = require("../codesign/codesign.js");
 var File = require("qbs.File");
 var FileInfo = require("qbs.FileInfo");
 var Gcc = require("./gcc.js");
@@ -99,6 +100,9 @@ function lipoOutputArtifacts(product, inputs, fileTag, debugSuffix) {
         else
             tags.push(fileTag, "primary");
 
+        if (product.codesign.enableCodeSigning)
+            tags.push("codesign.signed_artifact");
+
         return {
             filePath: FileInfo.joinPaths(product.destinationDirectory,
                                          PathTools.linkerOutputFilePath(fileTag, product,
@@ -188,6 +192,12 @@ function prepareLipo(project, product, inputs, outputs, input, output) {
     commands.push(cmd);
     if (outputs.dynamiclibrary_symbols)
         Array.prototype.push.apply(commands, Gcc.createSymbolCheckingCommands(product, outputs));
+
+    if (product.codesign.enableCodeSigning) {
+        Array.prototype.push.apply(
+                commands, Codesign.prepareSign(project, product, inputs, outputs, input, output));
+    }
+
     return commands;
 }