From b705c5b84c3be0ad8e0c88c33dabdd3a397f9c58 Mon Sep 17 00:00:00 2001 From: James Brunton Date: Wed, 3 Jun 2026 12:55:38 +0100 Subject: [PATCH] Switch to use JPDFium v1.0.2, which signs the Mac binaries (#6521) # Description of Changes Currently, it's not possible to develop the backend on Mac without manually signing the JPDFium binaries yourself since macOS will reject running the unsigned binaries. [We've now updated JPDFium to sign the Mac binaries in v1.0.2](https://github.com/Stirling-Tools/JPDFium/releases/tag/v1.0.2), so update to use that version. --- .github/workflows/multiOSReleases.yml | 4 - .github/workflows/tauri-build.yml | 4 - app/common/build.gradle | 4 +- .../scripts/sign-jpdfium-dylibs-in-bootjar.sh | 111 ------------------ 4 files changed, 2 insertions(+), 121 deletions(-) delete mode 100644 frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml index 9eaad9bb2..438126f90 100644 --- a/.github/workflows/multiOSReleases.yml +++ b/.github/workflows/multiOSReleases.yml @@ -442,10 +442,6 @@ jobs: echo "Generated tauri.windows.conf.json (alias masked):" sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json - - name: Sign JPDFium dylibs inside bootJar (macOS only) - if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != '' - run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh - - name: Import release GPG signing key (Linux) if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') run: | diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml index e7fa110fe..82dc1b63f 100644 --- a/.github/workflows/tauri-build.yml +++ b/.github/workflows/tauri-build.yml @@ -271,10 +271,6 @@ jobs: echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV echo "Certificate imported successfully." - - name: Sign JPDFium dylibs inside bootJar (macOS only) - if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != '' - run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh - - name: Check DMG creation dependencies (macOS only) if: matrix.platform == 'macos-15' run: | diff --git a/app/common/build.gradle b/app/common/build.gradle index 245a16234..170f964af 100644 --- a/app/common/build.gradle +++ b/app/common/build.gradle @@ -60,7 +60,7 @@ dependencies { exclude group: 'com.google.code.gson', module: 'gson' } - api 'com.stirling:jpdfium:1.0.1' + api 'com.stirling:jpdfium:1.0.2' // -PjpdfiumPlatforms=all| def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim() @@ -75,7 +75,7 @@ dependencies { } logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}") jpdfiumPlatforms.each { platform -> - runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1" + runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2" } // Bucket4j (local in-process token bucket for RateLimitStore default impl) diff --git a/frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh b/frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh deleted file mode 100644 index bed635a47..000000000 --- a/frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh +++ /dev/null @@ -1,111 +0,0 @@ -#!/usr/bin/env bash -# Sign every .dylib inside the bootJar's JPDFium native jars. -# Requires APPLE_SIGNING_IDENTITY set to a Developer ID identity in the keychain. -# -# Usage: sign-jpdfium-dylibs-in-bootjar.sh [path/to/stirling-pdf-*.jar] - -set -u - -echo "sign-jpdfium-dylibs-in-bootjar.sh: start ($(uname -s) $(uname -m))" - -case "$(uname -s)" in - Darwin*) ;; - *) echo "Not macOS, skipping"; exit 0;; -esac - -if [ -z "${APPLE_SIGNING_IDENTITY:-}" ]; then - echo "APPLE_SIGNING_IDENTITY not set; skipping" - exit 0 -fi -if ! command -v codesign >/dev/null 2>&1; then - echo "codesign not on PATH; skipping" - exit 0 -fi -if ! command -v jar >/dev/null 2>&1; then - echo "jar not on PATH (need a JDK setup-action earlier); skipping" - exit 0 -fi - -BOOTJARS=() -if [ -n "${1:-}" ]; then - BOOTJARS+=("$1") -else - for cand in app/core/build/libs/stirling-pdf-*.jar \ - frontend/editor/src-tauri/libs/stirling-pdf-*.jar; do - [ -f "$cand" ] || continue - BOOTJARS+=("$cand") - done -fi -if [ "${#BOOTJARS[@]:-0}" = 0 ]; then - echo "bootJar not found (expected app/core/build/libs/stirling-pdf-*.jar" \ - "or frontend/editor/src-tauri/libs/stirling-pdf-*.jar)" - exit 0 -fi - -for BOOTJAR in "${BOOTJARS[@]}"; do - BOOTJAR=$(cd "$(dirname "$BOOTJAR")" && pwd)/$(basename "$BOOTJAR") - echo "" - echo "=== Target bootJar: $BOOTJAR ($(du -h "$BOOTJAR" | cut -f1)) ===" - - WORK=$(mktemp -d) - # shellcheck disable=SC2064 - trap "rm -rf '$WORK'" EXIT - - NATIVE_JAR_PATHS=() - while IFS= read -r line; do - [ -n "$line" ] || continue - NATIVE_JAR_PATHS+=("$line") - done < <(jar tf "$BOOTJAR" \ - | grep -E '^BOOT-INF/lib/jpdfium-natives-darwin-(x64|arm64)-.*\.jar$' || true) - - if [ "${#NATIVE_JAR_PATHS[@]:-0}" = 0 ]; then - echo " No JPDFium darwin natives in this bootJar; skipping" - rm -rf "$WORK" - continue - fi - - ( cd "$WORK" && jar xf "$BOOTJAR" ${NATIVE_JAR_PATHS[@]+"${NATIVE_JAR_PATHS[@]}"} ) \ - || { echo "jar xf failed to extract natives jars" >&2; exit 1; } - - ANY_SIGNED=0 - for nat_jar in "$WORK/BOOT-INF/lib"/jpdfium-natives-darwin-*.jar; do - [ -f "$nat_jar" ] || continue - base=$(basename "$nat_jar") - echo " Processing $base" - - exp_dir="$WORK/${base%.jar}.expanded" - mkdir -p "$exp_dir" - ( cd "$exp_dir" && jar xf "$nat_jar" ) - - signed=0 - while IFS= read -r dylib; do - codesign --force --sign "$APPLE_SIGNING_IDENTITY" \ - --options runtime --timestamp "$dylib" 2>&1 | sed 's/^/ /' - signed=$((signed + 1)) - done < <(find "$exp_dir" -name '*.dylib' -type f) - - if [ "$signed" = 0 ]; then - echo " (no .dylibs found)" - continue - fi - echo " signed $signed dylib(s)" - - rm -f "$nat_jar" - ( cd "$exp_dir" && jar cfM0 "$nat_jar" . ) - ANY_SIGNED=1 - done - - if [ "$ANY_SIGNED" = 0 ]; then - echo " No .dylibs signed; skipping update" - rm -rf "$WORK" - continue - fi - - # `jar uf` always DEFLATEs; Spring Boot's nested-jar loader only reads - # STORED entries. Use `zip -0` to update in place with no compression. - ( cd "$WORK" && zip -q0 "$BOOTJAR" ${NATIVE_JAR_PATHS[@]+"${NATIVE_JAR_PATHS[@]}"} ) \ - || { echo "zip update failed" >&2; exit 1; } - - echo " Updated: $BOOTJAR ($(du -h "$BOOTJAR" | cut -f1))" - rm -rf "$WORK" -done