diff --git a/packages/flutter_tools/bin/macos_assemble.sh b/packages/flutter_tools/bin/macos_assemble.sh index 78467193681..89a00a735e6 100755 --- a/packages/flutter_tools/bin/macos_assemble.sh +++ b/packages/flutter_tools/bin/macos_assemble.sh @@ -191,6 +191,12 @@ EmbedFrameworks() { local native_assets_path="${project_path}/${FLUTTER_BUILD_DIR}/native_assets/macos/" if [[ -d "$native_assets_path" ]]; then RunCommand rsync -av --filter "- .DS_Store" --filter "- native_assets.yaml" "${native_assets_path}" "${xcode_frameworks_dir}" + + # Iterate through all .frameworks in native assets directory. + for native_asset in "${native_assets_path}"*.framework; do + # Codesign the framework inside the app bundle. + RunCommand codesign --force --verbose --sign "${EXPANDED_CODE_SIGN_IDENTITY}" -- "${xcode_frameworks_dir}/$(basename "$native_asset")" + done fi } diff --git a/packages/flutter_tools/lib/src/isolated/native_assets/macos/native_assets.dart b/packages/flutter_tools/lib/src/isolated/native_assets/macos/native_assets.dart index d3428b8f732..54677a63887 100644 --- a/packages/flutter_tools/lib/src/isolated/native_assets/macos/native_assets.dart +++ b/packages/flutter_tools/lib/src/isolated/native_assets/macos/native_assets.dart @@ -304,7 +304,12 @@ Future _copyNativeAssetsMacOS( )); await setInstallNameDylib(dylibFile); await createInfoPlist(name, resourcesDir); - await codesignDylib(codesignIdentity, buildMode, frameworkDir); + // Do not code-sign the libraries here with identity. Code-signing + // for bundled dylibs is done in `macos_assemble.sh embed` because the + // "Flutter Assemble" target does not have access to the signing identity. + if (codesignIdentity != null) { + await codesignDylib(codesignIdentity, buildMode, frameworkDir); + } } globals.logger.printTrace('Copying native assets done.'); } diff --git a/packages/flutter_tools/test/integration.shard/isolated/native_assets_test.dart b/packages/flutter_tools/test/integration.shard/isolated/native_assets_test.dart index 1551663e0f5..ca79c2473a1 100644 --- a/packages/flutter_tools/test/integration.shard/isolated/native_assets_test.dart +++ b/packages/flutter_tools/test/integration.shard/isolated/native_assets_test.dart @@ -207,6 +207,7 @@ void main() { switch (buildSubcommand) { case 'macos': expectDylibIsBundledMacOS(exampleDirectory, buildMode); + expectDylibIsCodeSignedMacOS(exampleDirectory, buildMode); case 'ios': expectDylibIsBundledIos(exampleDirectory, buildMode); case 'linux': @@ -290,6 +291,24 @@ void main() { } } +void expectDylibIsCodeSignedMacOS(Directory appDirectory, String buildMode) { + final Directory appBundle = appDirectory.childDirectory('build/$hostOs/Build/Products/${buildMode.upperCaseFirst()}/$exampleAppName.app'); + final Directory frameworksFolder = appBundle.childDirectory('Contents/Frameworks'); + expect(frameworksFolder, exists); + const String frameworkName = packageName; + final Directory frameworkDir = frameworksFolder.childDirectory('$frameworkName.framework'); + final ProcessResult codesign = + processManager.runSync(['codesign', '-dv', frameworkDir.absolute.path]); + expect(codesign.exitCode, 0); + + // Expect adhoc signature, but not linker-signed (which would mean no code-signing happened after linking). + final List lines = codesign.stderr.toString().split('\n'); + final bool isLinkerSigned = lines.any((String line) => line.contains('linker-signed')); + final bool isAdhoc = lines.any((String line) => line.contains('Signature=adhoc')); + expect(isAdhoc, isTrue); + expect(isLinkerSigned, isFalse); +} + /// For `flutter build` we can't easily test whether running the app works. /// Check that we have the dylibs in the app. void expectDylibIsBundledMacOS(Directory appDirectory, String buildMode) {