[Makefile] Fix codesign of libjulia when installing it on macOS

[giordano]

Probably it isn't the cleanest solution possible, but it does the job for me 🙂

Fix #44502

% prefix=$(mktemp -d)
% make install prefix=$prefix
# ...
% $prefix/bin/julia
               _
   _       _ _(_)_     |  Documentation: https://docs.julialang.org
  (_)     | (_) (_)    |
   _ _   _| |_  __ _   |  Type "?" for help, "]?" for Pkg help.
  | | | | | | |/ _` |  |
  | | |_| | | | (_| |  |  Version 1.9.0-DEV.154 (2022-03-08)
 _/ |\__'_|_|_|\__'_|  |  mg/macos-codesign-install/31c7573f8f (fork: 1 commits, 0 days)
|__/                   |

julia>

[staticfloat]

We don't want to use ldid, we want to use codesign, as we only use ldid in BB because we're on linux and codesign doesn't exist. :P

We have the invocation here, we basically want to do this after make install as well (on the buildbots we do make binary-dist which does make install, but then immediately re-signs again). We should probably make this a shell script that gets invoked by the makefiles, rather than a bunch of makefile rules.

EDIT: Ah, and in the case that you're building locally and don't need to redistribute (e.g. you have no codesigning key) you can still use codesign, but you need to set $(MACOS_CODESIGN_IDENTITY) to - to force ad-hoc signing.

[giordano]

Sad for not being able to use a JLL, but I added a shell script based on what codesigning currently does in Makefile.

[giordano]

make binary-dist worked fine in CI, yay! But I wish posix shells supported arrays, leaving ${ENTITLEMENTS} unquoted makes me uncomfortable 😞

[fxcoudert]

This was only included for 1.9, and it still fails for released 1.8.0: #44502 (comment)

Could the patch be backported?

[DilumAluthge]

Do we also need to backport this to 1.6?

[fxcoudert]

Do we also need to backport this to 1.6?

I don't think so. Julia 1.6 did not support macOS ARM (aka Apple Silicon), and on macOS Intel the binaries produced by the system compiler are not signed by default (unlike ARM, where they systematically have an ad hoc signature). So on Intel, the binary is still valid after stringreplace is run, because it's unsigned.