From b0a82e98d56f7c437dd2f7fdb4d4884aaca7284b Mon Sep 17 00:00:00 2001
From: Ryan Macnak <rmacnak@google.com>
Date: Wed, 27 May 2026 06:34:31 -0700
Subject: [PATCH] [build, mac] Sign shared libraries and fix incremental build
 for changes to signing script or entitlement files.

TEST=ci
Change-Id: Ied90ee7b81a23de266d6f7dc5e642a820dac9248
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/506341
Reviewed-by: Tess Strickland <sstrickl@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
---
 build/toolchain/mac/mac_toolchain.gni         | 14 ++++++++++++
 runtime/bin/BUILD.gn                          |  9 ++++++++
 .../tools/entitlements/analyze_snapshot.plist |  6 +++++
 samples/embedder/BUILD.gn                     | 22 +++++++++++++++++--
 4 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 runtime/tools/entitlements/analyze_snapshot.plist

diff --git a/build/toolchain/mac/mac_toolchain.gni b/build/toolchain/mac/mac_toolchain.gni
index 9f4b0d8bce8..57f71c0e6ab 100644
--- a/build/toolchain/mac/mac_toolchain.gni
+++ b/build/toolchain/mac/mac_toolchain.gni
@@ -161,6 +161,20 @@ template("mac_toolchain") {
 
       command = "if $does_reexport_command ; then $link_command && $extract_toc_command > $tocname; else $link_command && $extract_toc_command > $temporary_tocname && $replace_command ; fi; fi"
 
+      if (codesigning_identity != "") {
+        # codesign tool performs signing in-place. This does not fit very well
+        # into the overall build: we would have to produce unsigned binary with
+        # some suffix (e.g. dart_unsigned), then copy it to the final location
+        # and sign. To avoid this dance we choose to perform signing here
+        # at the link step. Unfortunately this also comes with some limitations:
+        # executable target can't push arbitrary configuration variables down
+        # to the link step. Which means we can't specify per target
+        # entitlement files - and instead rely on dart_codesign.py script to
+        # match binaries to their entitlement files by name.
+        signing_script = rebase_path("//runtime/tools/dart_codesign.py")
+        command += " && $signing_script --identity $codesigning_identity --binary $dylib"
+      }
+
       rspfile_content = "{{inputs_newline}}"
 
       description = "SOLINK {{output}}"
diff --git a/runtime/bin/BUILD.gn b/runtime/bin/BUILD.gn
index aa9d96d1ca2..3233a5f14e6 100644
--- a/runtime/bin/BUILD.gn
+++ b/runtime/bin/BUILD.gn
@@ -931,6 +931,15 @@ template("dart_executable") {
         "winmm.lib",
       ]
     }
+
+    # Can't be added by tool("link"), but make sure changes to entitlements
+    # trigger re-links.
+    if (is_mac) {
+      inputs = [
+        "../tools/dart_codesign.py",
+        "../tools/entitlements/${target_name}.plist",
+      ]
+    }
   }
 }
 
diff --git a/runtime/tools/entitlements/analyze_snapshot.plist b/runtime/tools/entitlements/analyze_snapshot.plist
new file mode 100644
index 00000000000..e4d040d3c73
--- /dev/null
+++ b/runtime/tools/entitlements/analyze_snapshot.plist
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+    </dict>
+</plist>
\ No newline at end of file
diff --git a/samples/embedder/BUILD.gn b/samples/embedder/BUILD.gn
index 885be5f6ab6..a7c847c6c41 100644
--- a/samples/embedder/BUILD.gn
+++ b/samples/embedder/BUILD.gn
@@ -5,6 +5,8 @@
 import("../../utils/aot_snapshot.gni")
 import("../../utils/application_snapshot.gni")
 
+_dart_root = get_path_info("../..", "abspath")
+
 # All samples.
 group("all") {
   deps = [
@@ -112,6 +114,15 @@ template("sample") {
         deps += [ "${dep}${conf.suffix}" ]
       }
       deps += extra_deps
+
+      # Can't be added by tool("link"), but make sure changes to entitlements
+      # trigger re-links.
+      if (is_mac) {
+        inputs = [
+          "$_dart_root/runtime/tools/dart_codesign.py",
+          "$_dart_root/runtime/tools/entitlements/${target_name}_aot.plist",
+        ]
+      }
     }
 
     executable("${target_name}${conf.suffix}_static") {
@@ -143,6 +154,15 @@ template("sample") {
         deps += [ "${dep}${conf.suffix}_static" ]
       }
       deps += extra_deps
+
+      # Can't be added by tool("link"), but make sure changes to entitlements
+      # trigger re-links.
+      if (is_mac) {
+        inputs = [
+          "$_dart_root/runtime/tools/dart_codesign.py",
+          "$_dart_root/runtime/tools/entitlements/${target_name}_aot_static.plist",
+        ]
+      }
     }
   }
 }
@@ -189,8 +209,6 @@ template("snapshots") {
   }
 }
 
-_dart_root = get_path_info("../..", "abspath")
-
 template("shims") {
   name = target_name
   if (defined(invoker.name)) {