From e3f5b1745c70b9eb72a07e3ee7339727a096a047 Mon Sep 17 00:00:00 2001
From: Jon Creighton <jcreighton@apple.com>
Date: Fri, 22 Jul 2022 12:26:49 +0100
Subject: [PATCH] Xcode builds require codesigning

---
 build_scripts/apple_utils.py | 73 ++++++++++++++++++++++++++++++++++++
 build_scripts/build_usd.py   | 12 ++++++
 2 files changed, 85 insertions(+)
 create mode 100644 build_scripts/apple_utils.py

diff --git a/build_scripts/apple_utils.py b/build_scripts/apple_utils.py
new file mode 100644
index 0000000000..3479fa1024
--- /dev/null
+++ b/build_scripts/apple_utils.py
@@ -0,0 +1,73 @@
+#!/usr/bin/python
+import sys
+import locale
+import os
+import platform
+import shlex
+import subprocess
+
+def MacOS():
+    return platform.system() == "Darwin"
+
+def GetLocale():
+    return sys.stdout.encoding or locale.getdefaultlocale()[1] or "UTF-8"
+
+def GetCommandOutput(command):
+    """Executes the specified command and returns output or None."""
+    try:
+        return subprocess.check_output(
+            shlex.split(command), 
+            stderr=subprocess.STDOUT).decode(GetLocale(), 'replace').strip()
+    except subprocess.CalledProcessError:
+        pass
+    return None
+
+def GetMacArmArch():
+    return os.environ.get('MACOS_ARM_ARCHITECTURE') or "arm64"
+
+def GetMacArch():
+    macArch = GetCommandOutput('arch').strip()
+    if macArch == "i386" or macArch == "x86_64":
+        macArch = "x86_64"
+    else:
+        macArch = GetMacArmArch()
+    return macArch
+
+devout = open(os.devnull, 'w')
+
+def ExtractFilesRecursive(path, cond):
+    files = []
+    for r, d, f in os.walk(path):
+        for file in f:
+            if cond(os.path.join(r,file)):
+                files.append(os.path.join(r, file))
+    return files
+
+def CodesignFiles(files):
+    SDKVersion  = subprocess.check_output(['xcodebuild', '-version']).strip()[6:10]
+    codeSignIDs = subprocess.check_output(['security', 'find-identity', '-vp', 'codesigning'])
+
+    codeSignID = "-"
+    if os.environ.get('CODE_SIGN_ID'):
+        codeSignID = os.environ.get('CODE_SIGN_ID')
+    elif float(SDKVersion) >= 11.0 and codeSignIDs.find(b'Apple Development') != -1:
+        codeSignID = "Apple Development"
+    elif codeSignIDs.find(b'Mac Developer') != -1:
+        codeSignID = "Mac Developer"
+        
+    for f in files:
+        subprocess.call(['codesign', '-f', '-s', '{codesignid}'
+              .format(codesignid=codeSignID), f],
+              stdout=devout, stderr=devout)
+
+def Codesign(install_path, verbose_output=False):
+    if not MacOS():
+        return False
+    if verbose_output:
+        global devout
+        devout = sys.stdout
+
+    files = ExtractFilesRecursive(install_path, 
+                 (lambda file: '.so' in file or '.dylib' in file))
+    CodesignFiles(files)
+
diff --git a/build_scripts/build_usd.py b/build_scripts/build_usd.py
index 79d5670c5e..6b0819f719 100644
--- a/build_scripts/build_usd.py
+++ b/build_scripts/build_usd.py
@@ -43,6 +43,7 @@
 import sysconfig
 import tarfile
 import zipfile
+import apple_utils
 
 if sys.version_info.major >= 3:
     from urllib.request import urlopen
@@ -1752,6 +1753,10 @@ def InstallUSD(context, force, buildArgs):
 group.add_argument("--toolset", type=str,
                    help=("CMake toolset to use when building libraries with "
                          "cmake"))
+if MacOS():
+    codesignDefault = False if apple_utils.GetMacArch() == "x64_64" else True
+    group.add_argument("--codesign", dest="macos_codesign", default=codesignDefault,
+                       help=("Use codesigning for macOS builds (defaults to enabled on Apple Silicon)"))
 
 if Linux():
     group.add_argument("--use-cxx11-abi", type=int, choices=[0, 1],
@@ -2002,6 +2007,8 @@ def __init__(self, args):
         self.useCXX11ABI = \
             (args.use_cxx11_abi if hasattr(args, "use_cxx11_abi") else None)
         self.safetyFirst = args.safety_first
+        self.macOSCodesign = \
+            (args.macos_codesign if hasattr(args, "macos_codesign") else False)
 
         # Dependencies that are forced to be built
         self.forceBuildAll = args.force_all
@@ -2317,6 +2324,7 @@ def FormatBuildArguments(buildArgs):
                   else "Release w/ Debug Info" if context.buildRelWithDebug
                   else ""),
     buildImaging=("On" if context.buildImaging else "Off"),
+    macOSCodesign=("On" if context.macOSCodesign else "Off"),
     enablePtex=("On" if context.enablePtex else "Off"),
     enableOpenVDB=("On" if context.enableOpenVDB else "Off"),
     buildOIIO=("On" if context.buildOIIO else "Off"),
@@ -2396,6 +2404,10 @@ def FormatBuildArguments(buildArgs):
         os.path.join(context.instDir, "lib")
     ])
 
+if MacOS():
+    if context.macOSCodesign:
+        apple_utils.Codesign(context.usdInstDir, verbosity > 1)
+
 Print("""
 Success! To use USD, please ensure that you have:""")