[build, mac] Sign shared libraries and fix incremental build for changes to signing script or entitlement files.

TEST=ci
Change-Id: Ied90ee7b81a23de266d6f7dc5e642a820dac9248
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/506341
Reviewed-by: Tess Strickland <sstrickl@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>

build/toolchain/mac/mac_toolchain.gni

@@ -161,6 +161,20 @@ template("mac_toolchain") {
 
       command = "if $does_reexport_command ; then $link_command && $extract_toc_command > $tocname; else $link_command && $extract_toc_command > $temporary_tocname && $replace_command ; fi; fi"
 
+      if (codesigning_identity != "") {
+        # codesign tool performs signing in-place. This does not fit very well
+        # into the overall build: we would have to produce unsigned binary with
+        # some suffix (e.g. dart_unsigned), then copy it to the final location
+        # and sign. To avoid this dance we choose to perform signing here
+        # at the link step. Unfortunately this also comes with some limitations:
+        # executable target can't push arbitrary configuration variables down
+        # to the link step. Which means we can't specify per target
+        # entitlement files - and instead rely on dart_codesign.py script to
+        # match binaries to their entitlement files by name.
+        signing_script = rebase_path("//runtime/tools/dart_codesign.py")
+        command += " && $signing_script --identity $codesigning_identity --binary $dylib"
+      }
+
       rspfile_content = "{{inputs_newline}}"
 
       description = "SOLINK {{output}}"