mirror of
https://github.com/arsvendg/Stirling-PDF.git
synced 2026-07-14 10:34:06 +02:00
112 lines
3.4 KiB
Bash
112 lines
3.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Sign every .dylib inside the bootJar's JPDFium native jars.
|
|
# Requires APPLE_SIGNING_IDENTITY set to a Developer ID identity in the keychain.
|
|
#
|
|
# Usage: sign-jpdfium-dylibs-in-bootjar.sh [path/to/stirling-pdf-*.jar]
|
|
|
|
set -u
|
|
|
|
echo "sign-jpdfium-dylibs-in-bootjar.sh: start ($(uname -s) $(uname -m))"
|
|
|
|
case "$(uname -s)" in
|
|
Darwin*) ;;
|
|
*) echo "Not macOS, skipping"; exit 0;;
|
|
esac
|
|
|
|
if [ -z "${APPLE_SIGNING_IDENTITY:-}" ]; then
|
|
echo "APPLE_SIGNING_IDENTITY not set; skipping"
|
|
exit 0
|
|
fi
|
|
if ! command -v codesign >/dev/null 2>&1; then
|
|
echo "codesign not on PATH; skipping"
|
|
exit 0
|
|
fi
|
|
if ! command -v jar >/dev/null 2>&1; then
|
|
echo "jar not on PATH (need a JDK setup-action earlier); skipping"
|
|
exit 0
|
|
fi
|
|
|
|
BOOTJARS=()
|
|
if [ -n "${1:-}" ]; then
|
|
BOOTJARS+=("$1")
|
|
else
|
|
for cand in app/core/build/libs/stirling-pdf-*.jar \
|
|
frontend/src-tauri/libs/stirling-pdf-*.jar; do
|
|
[ -f "$cand" ] || continue
|
|
BOOTJARS+=("$cand")
|
|
done
|
|
fi
|
|
if [ "${#BOOTJARS[@]:-0}" = 0 ]; then
|
|
echo "bootJar not found (expected app/core/build/libs/stirling-pdf-*.jar" \
|
|
"or frontend/src-tauri/libs/stirling-pdf-*.jar)"
|
|
exit 0
|
|
fi
|
|
|
|
for BOOTJAR in "${BOOTJARS[@]}"; do
|
|
BOOTJAR=$(cd "$(dirname "$BOOTJAR")" && pwd)/$(basename "$BOOTJAR")
|
|
echo ""
|
|
echo "=== Target bootJar: $BOOTJAR ($(du -h "$BOOTJAR" | cut -f1)) ==="
|
|
|
|
WORK=$(mktemp -d)
|
|
# shellcheck disable=SC2064
|
|
trap "rm -rf '$WORK'" EXIT
|
|
|
|
NATIVE_JAR_PATHS=()
|
|
while IFS= read -r line; do
|
|
[ -n "$line" ] || continue
|
|
NATIVE_JAR_PATHS+=("$line")
|
|
done < <(jar tf "$BOOTJAR" \
|
|
| grep -E '^BOOT-INF/lib/jpdfium-natives-darwin-(x64|arm64)-.*\.jar$' || true)
|
|
|
|
if [ "${#NATIVE_JAR_PATHS[@]:-0}" = 0 ]; then
|
|
echo " No JPDFium darwin natives in this bootJar; skipping"
|
|
rm -rf "$WORK"
|
|
continue
|
|
fi
|
|
|
|
( cd "$WORK" && jar xf "$BOOTJAR" ${NATIVE_JAR_PATHS[@]+"${NATIVE_JAR_PATHS[@]}"} ) \
|
|
|| { echo "jar xf failed to extract natives jars" >&2; exit 1; }
|
|
|
|
ANY_SIGNED=0
|
|
for nat_jar in "$WORK/BOOT-INF/lib"/jpdfium-natives-darwin-*.jar; do
|
|
[ -f "$nat_jar" ] || continue
|
|
base=$(basename "$nat_jar")
|
|
echo " Processing $base"
|
|
|
|
exp_dir="$WORK/${base%.jar}.expanded"
|
|
mkdir -p "$exp_dir"
|
|
( cd "$exp_dir" && jar xf "$nat_jar" )
|
|
|
|
signed=0
|
|
while IFS= read -r dylib; do
|
|
codesign --force --sign "$APPLE_SIGNING_IDENTITY" \
|
|
--options runtime --timestamp "$dylib" 2>&1 | sed 's/^/ /'
|
|
signed=$((signed + 1))
|
|
done < <(find "$exp_dir" -name '*.dylib' -type f)
|
|
|
|
if [ "$signed" = 0 ]; then
|
|
echo " (no .dylibs found)"
|
|
continue
|
|
fi
|
|
echo " signed $signed dylib(s)"
|
|
|
|
rm -f "$nat_jar"
|
|
( cd "$exp_dir" && jar cfM0 "$nat_jar" . )
|
|
ANY_SIGNED=1
|
|
done
|
|
|
|
if [ "$ANY_SIGNED" = 0 ]; then
|
|
echo " No .dylibs signed; skipping update"
|
|
rm -rf "$WORK"
|
|
continue
|
|
fi
|
|
|
|
# `jar uf` always DEFLATEs; Spring Boot's nested-jar loader only reads
|
|
# STORED entries. Use `zip -0` to update in place with no compression.
|
|
( cd "$WORK" && zip -q0 "$BOOTJAR" ${NATIVE_JAR_PATHS[@]+"${NATIVE_JAR_PATHS[@]}"} ) \
|
|
|| { echo "zip update failed" >&2; exit 1; }
|
|
|
|
echo " Updated: $BOOTJAR ($(du -h "$BOOTJAR" | cut -f1))"
|
|
rm -rf "$WORK"
|
|
done
|