Add option to skip signing of JDK runtime on macOS (#138)

README.md

@@ -79,6 +79,12 @@ native binaries and JAR files with native binaries can be adapted if necessary.
 The built package should then pass the Apple notarization process (submission and
 stapling must be done manually).
 
+By default the bundled JDK runtime is also re-signed. This can be disabled by
+setting `package.macos.codesign-runtime` to `false`, so that the runtime's
+existing signatures are kept unchanged. This is useful where re-signing is
+unnecessary and causes problems, such as `jlink` reporting a modified runtime,
+but note it may affect notarization in some cases.
+
 ### `--type windows-innosetup`
 
 Create a Windows [Inno Setup][innosetup] installer. Requires download of the

src/main/java/org/apache/netbeans/nbpackage/macos/AppBundleTask.java

@@ -284,6 +284,14 @@ private void setupSigningConfiguration(Path image, Path bundle) throws IOExcepti
                 StandardOpenOption.CREATE_NEW);
         List<Path> nativeBinaries = FileUtils.find(bundle,
                 context().getValue(MacOS.SIGNING_FILES).orElseThrow());
+        if (!context().getValue(MacOS.CODESIGN_RUNTIME).orElse(Boolean.TRUE)) {
+            Path runtime = bundle.resolve("Contents").resolve("Home");
+            nativeBinaries = nativeBinaries.stream()
+                    .filter(path -> !path.startsWith(runtime))
+                    .toList();
+            context().infoHandler().accept(
+                    MacOS.MESSAGES.getString("message.skippingruntime"));
+        }
         Files.writeString(image.resolve(NATIVE_BIN_FILENAME),
                 nativeBinaries.stream()
                         .map(path -> image.relativize(path))

src/main/java/org/apache/netbeans/nbpackage/macos/MacOS.java

@@ -118,6 +118,15 @@ class MacOS {
             = Option.ofString("package.macos.codesign-jars", DEFAULT_JAR_BIN_GLOB,
                     MESSAGES.getString("option.codesign_jars.help"));
 
+    /**
+     * Whether to code sign the bundled JDK runtime. When {@code false}, the
+     * runtime's existing signatures are left untouched.
+     */
+    static final Option<Boolean> CODESIGN_RUNTIME
+            = Option.of("package.macos.codesign-runtime", Boolean.class, "true",
+                    Boolean::parseBoolean,
+                    MESSAGES.getString("option.codesign_runtime.help"));
+
     /**
      * Codesign ID for signing binaries and app bundle.
      */

src/main/java/org/apache/netbeans/nbpackage/macos/PkgPackager.java

@@ -39,6 +39,7 @@ public class PkgPackager implements Packager {
             MacOS.ENTITLEMENTS_TEMPLATE_PATH,
             MacOS.SIGNING_FILES,
             MacOS.SIGNING_JARS,
+            MacOS.CODESIGN_RUNTIME,
             MacOS.CODESIGN_ID,
             MacOS.PKGBUILD_ID);
 

src/main/resources/org/apache/netbeans/nbpackage/macos/Messages.properties

@@ -24,12 +24,14 @@ option.launcher_template.help=Optional path to launcher (main.swift) template.
 option.entitlements_template.help=Optional path to codesign entitlements template.
 option.codesign_files.help=Search pattern for native binaries that need to be code signed.
 option.codesign_jars.help=Search pattern for JARs that bundle native binaries that need to be code signed.
+option.codesign_runtime.help=Whether to code sign the bundled JDK runtime (default true). Set to false to keep the runtime's existing signatures, eg. to avoid jlink "modified runtime" errors. May affect notarization.
 option.codesign_id.help=Code signing identity as passed to Codesign.
 option.pkgbuild_id.help=Installer signing identity as passed to Pkgbuild.
 
 # Messages
 message.validatingtools=Validating required tools - {0}
 message.missingtool=Cannot find required tool - {0}
 message.nocodesignid=No codesign ID has been configured. App bundle will be unsigned.
+message.skippingruntime=Skipping code signing of bundled JDK runtime. Existing signatures will be kept.
 message.nopkgbuildid=No pkgbuild ID has been configured. Installer will be unsigned.
 message.unknownarch=Architecture is not recognised, defaulting to universal.

src/test/java/org/apache/netbeans/nbpackage/macos/PkgPackagerTest.java

@@ -88,6 +88,37 @@ public void testImageWithX86_64Runtime() throws Exception {
         assertTrue(Files.exists(resolve(app, "Contents", "Home", "bin", "java")));
         assertTrue(Files.exists(resolve(app, "Contents", "Resources", "app.icns")));
         assertTrue(Files.exists(resolve(app, "Contents", "Resources", "app", "bin", "app")));
+        // runtime binaries are included in the signing list by default
+        assertTrue(Files.readString(resolve(image, "nativeBinaries"))
+                .replace('\\', '/')
+                .contains("Contents/Home/bin/java"));
+    }
+
+    @Test
+    public void testImageSkippingRuntimeSigning() throws Exception {
+        Path input = tmpDir.resolve("App-1.0-b1.zip");
+        FileUtils.createZipArchive(
+                buildFakeApp(tmpDir, "App-1.0-b1", "app"),
+                input);
+        String runtimeName = "OpenJDK24U-jdk_aarch64_mac_hotspot_24.0.1_9";
+        Path runtime = tmpDir.resolve(runtimeName + ".zip");
+        FileUtils.createZipArchive(
+                buildFakeJDK(tmpDir, runtimeName, false),
+                runtime);
+        Configuration config = Configuration.builder()
+                .set(NBPackage.PACKAGE_NAME, "App")
+                .set(NBPackage.PACKAGE_VERSION, "1.0-b1")
+                .set(NBPackage.PACKAGE_RUNTIME, runtime.toString())
+                .set(MacOS.CODESIGN_RUNTIME, "false")
+                .build();
+        Path image = buildImage(new PkgPackager(), input, config, tmpDir);
+        Path app = resolve(image, "App.app");
+        // runtime is still bundled, but excluded from the signing list
+        assertTrue(Files.exists(resolve(app, "Contents", "Home", "bin", "java")));
+        assertTrue(Files.exists(resolve(image, "nativeBinaries")));
+        assertFalse(Files.readString(resolve(image, "nativeBinaries"))
+                .replace('\\', '/')
+                .contains("Contents/Home"));
     }
 
 }