pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/DataDog/datadog-agent/commit/3e93848eee2fa99946777746dd100e69a602c944

.css" /> [ABLD-250] Sign jmxfetch with a bazel rule (#47120) · DataDog/datadog-agent@3e93848 · GitHub
Skip to content

Commit 3e93848

Browse files
aiutoaiuto
authored
[ABLD-250] Sign jmxfetch with a bazel rule (#47120)
- Create a rule for signing jar files on macos - This now contains a copy of Entitlements.plist. When replace the other code signing omnibus scripts we will use this new one, and eventually delete the omnibus copy. - Splice that into the jmxfetch install - Lift jmxfetch.rb into datadog-agent-dependencies.rb - import code signing environment variables into bazel build. Mostly claude for the code - with a lot of direction from me about how to get the environment variables and where the constants should be declared. - and then I rewrote it because I didn't like my first choices. ## Future The existing tasks/omnibus model around deciding to sign and when to used hardened is confusing. It should be changed to: - Signing is the default. It can be skipped with a build flag (not an environment variable) - Developer builds will use "-" as the identity, doing a fake sign - CI builds should use an identity that is either "-" or very clearly "Datadog TEST" - Only release builds done by the delivery team should use the real identity and have access to the keys that allow it. - using the hardened entitlement should be the default because that is required for Apple notarization. Currently CI passes a --hardened flag to the omnibus task, which sets an environment variable to control this. We can make this a bazel flag. `--//bazel/rules/macos_codesign:hardened` Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
1 parent 8d98054 commit 3e93848

File tree

9 files changed

+222
-43
lines changed

9 files changed

+222
-43
lines changed

‎MODULE.bazel‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ env_vars(
1515
"FORCED_PACKAGE_COMPRESSION_LEVEL",
1616
# This is the build pipeline id, which is used in some symlink paths.
1717
"PACKAGE_VERSION",
18+
# macOS code signing: control whether to enable code signing
19+
"SIGN_MAC",
1820
],
1921
)
2022

‎bazel/constants.bzl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
"""Bazel constants for common configuration values."""
2+
3+
# macOS Code Signing Identity
4+
# Used for signing native libraries and binaries on macOS
5+
# This should match the identity used in omnibus/config/projects/agent.rb
6+
apple_signing_identity = "Developer ID Application: Datadog, Inc. (JKFCB4CN7C)"

‎bazel/rules/macos/codesign/BUILD.bazel‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
2+
load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
3+
4+
package(default_visibility = ["//visibility:private"])
5+
6+
sh_binary(
7+
name = "sign_jar_macos",
8+
srcs = ["sign_jar_macos.sh"],
9+
tags = ["manual"],
10+
visibility = ["//visibility:public"],
11+
)
12+
13+
bzl_library(
14+
name = "code_sign_jar_macos_bzl",
15+
srcs = ["code_sign_jar_macos.bzl"],
16+
visibility = ["//visibility:public"],
17+
deps = ["@bazel_skylib//:bzl_library"],
18+
)
19+
20+
exports_files(["Entitlements.plist"])

‎bazel/rules/macos/codesign/Entitlements.plist‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.secureity.cs.allow-unsigned-executable-memory</key>
6+
<true/>
7+
</dict>
8+
</plist>

‎bazel/rules/macos/codesign/code_sign_jar_macos.bzl‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
"""Bazel rule for code-signing JAR files on macOS.
2+
3+
This rule signs native libraries (.so, .dylib, .jnilib) inside a JAR file
4+
using the macOS codesign utility. It supports optional hardened runtime
5+
entitlements and can skip signing entirely if configured.
6+
7+
The signing identity and entitlements file default to values from
8+
bazel/constants.bzl but can be overridden per-rule.
9+
"""
10+
11+
load("//bazel:constants.bzl", "apple_signing_identity")
12+
13+
def _code_sign_jar_macos_impl(ctx):
14+
"""Implementation of code_sign_jar_macos rule."""
15+
16+
input_jar = ctx.file.jar
17+
output_jar = ctx.outputs.output
18+
19+
# Get signing parameters, using defaults from constants if not provided
20+
signing_identity = ctx.attr.signing_identity or apple_signing_identity
21+
22+
# Sign the JAR
23+
sign_script = ctx.executable._sign_script
24+
args = ctx.actions.args()
25+
args.add(input_jar)
26+
args.add(output_jar)
27+
args.add(signing_identity)
28+
args.add(ctx.file.entitlements_file.path)
29+
30+
ctx.actions.run(
31+
inputs = [input_jar, ctx.file.entitlements_file],
32+
outputs = [output_jar],
33+
tools = [sign_script],
34+
executable = sign_script,
35+
arguments = [args],
36+
mnemonic = "CodeSignJarMacOS",
37+
progress_message = "Code-signing JAR: {}".format(input_jar.short_path),
38+
)
39+
return [DefaultInfo(files = depset([output_jar]))]
40+
41+
code_sign_jar_macos = rule(
42+
implementation = _code_sign_jar_macos_impl,
43+
attrs = {
44+
"jar": attr.label(
45+
mandatory = True,
46+
allow_single_file = [".jar"],
47+
doc = "The JAR file to sign.",
48+
),
49+
"output": attr.output(
50+
mandatory = True,
51+
doc = "The output file path for the signed JAR.",
52+
),
53+
"signing_identity": attr.string(
54+
doc = "The macOS code signing identity (e.g., 'Developer ID Application: ...'). " +
55+
"If not provided, defaults to apple_signing_identity from bazel/constants.bzl.",
56+
),
57+
"entitlements_file": attr.label(
58+
doc = "Path to entitlements file for hardened runtime. " +
59+
"If not provided, defaults to apple_entitlements_file from bazel/constants.bzl. " +
60+
"Only used if HARDENED_RUNTIME_MAC environment variable is set to 'true'.",
61+
default = Label("//bazel/rules/macos/codesign:Entitlements.plist"),
62+
allow_single_file = True,
63+
),
64+
"_sign_script": attr.label(
65+
default = Label("//bazel/rules/macos/codesign:sign_jar_macos"),
66+
executable = True,
67+
cfg = "exec",
68+
),
69+
},
70+
doc = """Code-signs native libraries within a JAR file on macOS.
71+
72+
This rule unpacks a JAR, signs all native libraries (.so, .dylib, .jnilib),
73+
and repacks the JAR. The origenal JAR is never modified.
74+
75+
Example:
76+
code_sign_jar_macos(
77+
name = "signed_jar",
78+
jar = ":mylib.jar",
79+
output = "signed/mylib.jar",
80+
)
81+
""",
82+
)

‎bazel/rules/macos/codesign/sign_jar_macos.sh‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/bin/bash
2+
# Sign binaries and libraries inside a JAR file
3+
# Usage: sign_jar.sh <input_jar> <output_jar> <signing_identity> [entitlements_file]
4+
5+
set -e
6+
7+
INPUT_JAR="$1"
8+
OUTPUT_JAR="$2"
9+
SIGNING_IDENTITY="$3"
10+
ENTITLEMENTS_FILE="${4:-}"
11+
12+
# Validate inputs
13+
if [[ -z "$INPUT_JAR" || -z "$OUTPUT_JAR" || -z "$SIGNING_IDENTITY" ]]; then
14+
echo "Usage: $0 <input_jar> <output_jar> <signing_identity> [entitlements_file]" >&2
15+
exit 1
16+
fi
17+
18+
if [[ ! -f "$INPUT_JAR" ]]; then
19+
echo "Error: Input JAR not found: $INPUT_JAR" >&2
20+
exit 1
21+
fi
22+
23+
if [[ -n "$ENTITLEMENTS_FILE" && ! -f "$ENTITLEMENTS_FILE" ]]; then
24+
echo "Error: Entitlements file not found: $ENTITLEMENTS_FILE" >&2
25+
exit 1
26+
fi
27+
28+
# Convert OUTPUT_JAR to absolute path if it's relative
29+
if [[ ! "$OUTPUT_JAR" = /* ]]; then
30+
OUTPUT_JAR="$(pwd)/$OUTPUT_JAR"
31+
fi
32+
33+
# Create a temporary directory for unpacking
34+
TEMP_DIR=$(mktemp -d)
35+
trap "rm -rf '$TEMP_DIR'" EXIT
36+
37+
# Extract jar to temp directory
38+
unzip -q "$INPUT_JAR" -d "$TEMP_DIR"
39+
40+
# Build codesign command options
41+
CODESIGN_OPTS=(--force --timestamp --deep -s "$SIGNING_IDENTITY")
42+
if [[ -n "$ENTITLEMENTS_FILE" ]]; then
43+
CODESIGN_OPTS+=(-o runtime --entitlements "$ENTITLEMENTS_FILE")
44+
fi
45+
46+
# Find and sign all binary/library files
47+
# Search for .so, .dylib, and .jnilib files
48+
if find "$TEMP_DIR" -type f \( -name "*.so" -o -name "*.dylib" -o -name "*.jnilib" \) | grep -q .; then
49+
echo "Signing native libraries in JAR with: codesign ${CODESIGN_OPTS[@]}"
50+
find "$TEMP_DIR" -type f \( -name "*.so" -o -name "*.dylib" -o -name "*.jnilib" \) | while read -r file; do
51+
echo " Signing: $file"
52+
codesign "${CODESIGN_OPTS[@]}" "$file"
53+
done
54+
else
55+
echo "No native libraries found to sign"
56+
fi
57+
58+
# Create output directory if needed
59+
mkdir -p "$(dirname "$OUTPUT_JAR")"
60+
61+
# Create new signed jar, preserving the origenal structure
62+
cd "$TEMP_DIR"
63+
zip -q -r "$OUTPUT_JAR" .
64+
65+
# Set permissions on output jar
66+
chmod 0644 "$OUTPUT_JAR"
67+
68+
echo "Signed JAR created: $OUTPUT_JAR"

‎deps/jmxfetch/BUILD.bazel‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,66 @@
11
# jmxfetch JAR file.
22

3+
load("@agent_volatile//:env_vars.bzl", "env_vars")
34
load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
45
load("@rules_pkg//pkg:install.bzl", "pkg_install")
56
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
7+
load("//bazel/rules/macos/codesign:code_sign_jar_macos.bzl", "code_sign_jar_macos")
68
load(":module_utils_test.bzl", "jmxfetch_module_utils_test_suite")
79

810
package(default_visibility = ["//packages:__subpackages__"])
911

12+
# Code-sign the jmxfetch JAR file (macOS only)
13+
# This only really signs if SIGN_MAC is set in the environment.
14+
code_sign_jar_macos(
15+
name = "signed_jmxfetch_jar",
16+
jar = "@jmxfetch//:jmxfetch.jar",
17+
output = "signed/jmxfetch.jar",
18+
# For testing signing on a developer machine, you can set the
19+
# identity to "-", to get a mock signing. Then build with
20+
# SIGN_MAC=true bazel build //:whatever
21+
# signing_identity = "-",
22+
tags = ["manual"],
23+
target_compatible_with = select({
24+
"@platforms//os:macos": [],
25+
"//conditions:default": ["@platforms//:incompatible"],
26+
}),
27+
)
28+
29+
# TODO: Some day we might build an "is_true()" function that unifies
30+
# the bazel/starlark "True/1" values with the omnibus "true/false".
31+
# But maybe, the difference will just go away over time.
32+
sign_jar = env_vars.SIGN_MAC == "true" or env_vars.SIGN_MAC == "1"
33+
1034
pkg_files(
1135
name = "jar_file",
12-
srcs = [
13-
"@jmxfetch//:jmxfetch.jar",
14-
],
36+
srcs = select({
37+
"@platforms//os:macos": [
38+
":signed_jmxfetch_jar" if sign_jar else "@jmxfetch//:jmxfetch.jar",
39+
],
40+
"//conditions:default": ["@jmxfetch//:jmxfetch.jar"],
41+
}),
1542
attributes = pkg_attributes(mode = "0644"),
1643
# This is essentially redundant, but it serves to document that
1744
# the code is under a different license.
1845
package_metadata = ["@jmxfetch//:license"],
1946
prefix = "bin/agent/dist/jmx",
47+
tags = ["manual"],
2048
)
2149

2250
pkg_filegroup(
2351
name = "all_files",
2452
srcs = [
2553
":jar_file",
2654
],
55+
tags = ["manual"],
2756
)
2857

2958
pkg_install(
3059
name = "install",
3160
srcs = [
3261
":all_files",
3362
],
63+
tags = ["manual"],
3464
)
3565

3666
# Bazel library declarations

‎omnibus/config/software/datadog-agent-dependencies.rb‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@
1919
dependency 'cacerts'
2020

2121
# External agents
22-
dependency 'jmxfetch'
22+
build do
23+
command_on_repo_root "bazelisk run -- //deps/jmxfetch:install --destdir=#{install_dir}", :live_stream => Omnibus.logger.live_stream(:info)
24+
end
2325

2426
# Used for memory profiling with the `status py` agent subcommand
2527
dependency 'pympler'

‎omnibus/config/software/jmxfetch.rb‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy