Skiko Mac signing fix (#320)

* Refactor maybeSign and remoteSignCodesign

* Remove .maybesigned suffix

* Read signed binary from `signed` directory

* Set up correct working directory

skiko/build.gradle.kts

@@ -802,31 +802,49 @@ fun remoteSignCurl(signHost: String, lib: File, out: File) {
     }
 }
 
-fun remoteSignCodesign(signHost: String, lib: File, out: File) {
+fun remoteSignCodesign(fileToSign: File) {
     val user = skiko.signUser ?: error("signUser is null")
     val token = skiko.signToken ?: error("signToken is null")
-    val cmd = """
-        SERVICE_ACCOUNT_TOKEN=$token SERVICE_ACCOUNT_NAME=$user \
-        $projectDir/tools/codesign-client-darwin-x64 ${lib.absolutePath} && \
-        cp ${lib.absolutePath} ${out.absolutePath}
-    """
-    val proc = ProcessBuilder("bash", "-c", cmd)
-        .redirectOutput(ProcessBuilder.Redirect.PIPE)
-        .redirectError(ProcessBuilder.Redirect.PIPE)
-        .start()
+    val cmd = arrayOf(
+        projectDir.resolve("tools/codesign-client-darwin-x64").absolutePath,
+        fileToSign.absolutePath
+    )
+    val procBuilder = ProcessBuilder(*cmd).apply {
+        directory(fileToSign.parentFile)
+        val env = environment()
+        env["SERVICE_ACCOUNT_NAME"] = user
+        env["SERVICE_ACCOUNT_TOKEN"] = token
+        redirectOutput(ProcessBuilder.Redirect.INHERIT)
+        redirectError(ProcessBuilder.Redirect.INHERIT)
+    }
+    logger.info("Starting remote code sign")
+    val proc = procBuilder.start()
     proc.waitFor(5, TimeUnit.MINUTES)
     if (proc.exitValue() != 0) {
-        val out = proc.inputStream.bufferedReader().readText()
-        val err = proc.errorStream.bufferedReader().readText()
-        println(out)
-        println(err)
-        throw GradleException("Cannot sign $lib: $err")
+        throw GradleException("Failed to sign $fileToSign")
     } else {
-        val outSize = out.length()
-        if (outSize < 200 * 1024) {
-            val content = out.readText()
+        val signedDir = fileToSign.parentFile.resolve("signed")
+        val signedFile = signedDir.resolve(fileToSign.name)
+        check(signedFile.exists()) {
+            buildString {
+                appendLine("Signed file does not exist: $signedFile")
+                appendLine("Other files in $signedDir:")
+                signedDir.list()?.let { names ->
+                    names.forEach {
+                        appendLine("  * $it")
+                    }
+                }
+            }
+        }
+        val size = signedFile.length()
+        if (size < 200 * 1024) {
+            val content = signedFile.readText()
             println(content)
-            throw GradleException("Output is too short $outSize: ${content.take(200)}...")
+            throw GradleException("Output is too short $size: ${content.take(200)}...")
+        } else {
+            signedFile.copyTo(fileToSign, overwrite = true)
+            signedFile.delete()
+            logger.info("Successfully signed $fileToSign")
         }
     }
 }
@@ -845,7 +863,7 @@ val maybeSign by project.tasks.registering {
     inputs.files(lib)
 
     val outputDir = project.layout.buildDirectory.dir("maybe-signed")
-    val output = outputDir.map { it.asFile.resolve(lib.get().name + ".maybesigned") }
+    val output = outputDir.map { it.asFile.resolve(lib.get().name) }
     outputs.files(output)
 
     doLast {
@@ -856,15 +874,15 @@ val maybeSign by project.tasks.registering {
 
         val libFile = lib.get()
         val outputFile = output.get()
+        libFile.copyTo(outputFile, overwrite = true)
+
         if (targetOs == OS.Linux) {
             // Linux requires additional sealing to run on wider set of platforms.
             val sealer = "$projectDir/tools/sealer-${hostArch.id}"
-            sealBinary(sealer, libFile)
+            sealBinary(sealer, outputFile)
         }
         if (skiko.signHost != null) {
-            remoteSignCodesign(skiko.signHost!!, libFile, outputFile)
-        } else {
-            libFile.copyTo(outputFile, overwrite = true)
+            remoteSignCodesign(outputFile)
         }
     }
 }
@@ -882,10 +900,6 @@ val skikoJvmRuntimeJar by project.tasks.registering(Jar::class) {
     archiveBaseName.set("skiko-$target")
     from(skikoJvmJar.map { zipTree(it.archiveFile) })
     from(maybeSign.map { it.outputs.files })
-    rename {
-        // Not just suffix, as could be in middle of SHA256.
-        it.replace(".maybesigned", "")
-    }
     if (targetOs.isWindows) {
         from(files(skiaJvmBindingsDir.map { it.resolve("${skiaBinSubdir}/icudtl.dat") }))
     }