omnibus 6.0.25 → 7.0.12

data/lib/omnibus/packagers/makeself.rb

@@ -81,8 +81,7 @@ module Omnibus
         destination: makeselfinst_staging_path,
         variables: {
           install_dir: project.install_dir,
-        }
-      )
+        })
       FileUtils.chmod(0755, makeselfinst_staging_path)
     end
 

data/lib/omnibus/packagers/msi.rb

@@ -181,10 +181,12 @@ module Omnibus
       unless val.is_a?(TrueClass) || val.is_a?(FalseClass)
         raise InvalidValue.new(:iwix_light_delay_validation, "be TrueClass or FalseClass")
       end
+
       @delay_validation ||= val
       unless @delay_validation
         return ""
       end
+
       "-sval"
     end
     expose :wix_light_delay_validation
@@ -225,6 +227,7 @@ module Omnibus
       unless val.is_a?(TrueClass) || val.is_a?(FalseClass)
         raise InvalidValue.new(:bundle_msi, "be TrueClass or FalseClass")
       end
+
       @bundle_msi ||= val
     end
     expose :bundle_msi
@@ -244,6 +247,7 @@ module Omnibus
       unless val.is_a?(TrueClass) || val.is_a?(FalseClass)
         raise InvalidValue.new(:fast_msi, "be TrueClass or FalseClass")
       end
+
       @fast_msi ||= val
     end
     expose :fast_msi
@@ -298,6 +302,7 @@ module Omnibus
 
       raise "Could not find `#{search_pattern}'!" if file_paths.none?
       raise "Multiple possible matches of `#{search_pattern}'! : #{file_paths}" if file_paths.count > 1
+
       file_paths.first.relative_path_from(install_path).to_s
     end
     expose :gem_path
@@ -340,8 +345,7 @@ module Omnibus
           name: project.package_name,
           friendly_name: project.friendly_name,
           maintainer: project.maintainer,
-        }
-      )
+        })
     end
 
     #
@@ -360,8 +364,7 @@ module Omnibus
           parameters: parameters,
           version: windows_package_version,
           display_version: msi_display_version,
-        }
-      )
+        })
     end
 
     #
@@ -408,8 +411,7 @@ module Omnibus
           hierarchy: hierarchy,
           fastmsi: fast_msi,
           wix_install_dir: wix_install_dir,
-        }
-      )
+        })
     end
 
     #
@@ -429,8 +431,7 @@ module Omnibus
           version: windows_package_version,
           display_version: msi_display_version,
           msi: windows_safe_path(Config.package_dir, msi_name),
-        }
-      )
+        })
     end
 
     #
@@ -487,7 +488,7 @@ module Omnibus
           -ext WixBalExtension
           #{wix_extension_switches(wix_candle_extensions)}
           -dOmnibusCacheDir="#{windows_safe_path(File.expand_path(Config.cache_dir))}"
-          "#{windows_safe_path(staging_dir, 'bundle.wxs')}"
+          "#{windows_safe_path(staging_dir, "bundle.wxs")}"
         EOH
       else
         <<-EOH.split.join(" ").squeeze(" ").strip
@@ -496,7 +497,7 @@ module Omnibus
             #{wix_candle_flags}
             #{wix_extension_switches(wix_candle_extensions)}
             -dProjectSourceDir="#{windows_safe_path(project.install_dir)}" "project-files.wxs"
-            "#{windows_safe_path(staging_dir, 'source.wxs')}"
+            "#{windows_safe_path(staging_dir, "source.wxs")}"
         EOH
       end
     end
@@ -588,7 +589,7 @@ module Omnibus
     # @return [String]
     #
     def wix_extension_switches(arr)
-      "#{arr.map { |e| "-ext '#{e}'" }.join(' ')}"
+      "#{arr.map { |e| "-ext '#{e}'" }.join(" ")}"
     end
   end
 end

data/lib/omnibus/packagers/pkg.rb

@@ -44,8 +44,7 @@ module Omnibus
           maintainer: project.maintainer,
           build_version: project.build_version,
           package_name: project.package_name,
-        }
-      )
+        })
 
       # Render the welcome template
       render_template(resource_path("welcome.html.erb"),
@@ -56,8 +55,7 @@ module Omnibus
           maintainer: project.maintainer,
           build_version: project.build_version,
           package_name: project.package_name,
-        }
-      )
+        })
 
       # "Render" the assets
       copy_file(resource_path("background.png"), "#{resources_dir}/background.png")
@@ -66,6 +64,8 @@ module Omnibus
     build do
       write_scripts
 
+      sign_software_libs_and_bins
+
       build_component_pkg
 
       write_distribution_file
@@ -179,6 +179,67 @@ module Omnibus
       end
     end
 
+    def sign_software_libs_and_bins
+      if signing_identity
+        log.info(log_key) { "Finding libraries and binaries that require signing." }
+
+        bin_dirs = Set[]
+        lib_dirs = Set[]
+        binaries = Set[]
+        libraries = Set[]
+
+        # Capture lib_dirs and bin_dirs from each software
+        project.softwares.each do |software|
+          lib_dirs.merge(software.lib_dirs)
+          bin_dirs.merge(software.bin_dirs)
+        end
+
+        # Find all binaries in each bind_dir
+        bin_dirs.each do |dir|
+          binaries.merge Dir["#{dir}/*"]
+        end
+        # Filter out symlinks, non-files, and non-executables
+        log.debug(log_key) { "  Filtering non-binary files:" }
+        binaries.select! { |bin| is_binary?(bin) }
+
+        # Use otool to find all libries that are used by our binaries
+        binaries.each do |bin|
+          libraries.merge find_linked_libs bin
+        end
+
+        # Find all libraries in each lib_dir and add any we missed with otool
+        lib_dirs.each do |dir|
+          libraries.merge Dir["#{dir}/*"]
+        end
+
+        # Filter Mach-O libraries and bundles
+        log.debug(log_key) { "  Filtering non-library files:" }
+        libraries.select! { |lib| is_macho?(lib) }
+
+        # Use otool to find all libries that are used by our libraries
+        otool_libs = Set[]
+        libraries.each do |lib|
+          otool_libs.merge find_linked_libs lib
+        end
+
+        # Filter Mach-O libraries and bundles
+        otool_libs.select! { |lib| is_macho?(lib) }
+        libraries.merge otool_libs
+
+        log.info(log_key) { "  Signing libraries:" } unless libraries.empty?
+        libraries.each do |library|
+          log.debug(log_key) { "    Signing: #{library}" }
+          sign_library(library)
+        end
+
+        log.info(log_key) { "  Signing binaries:" } unless binaries.empty?
+        binaries.each do |binary|
+          log.debug(log_key) { "    Signing: #{binary}" }
+          sign_binary(binary, true)
+        end
+      end
+    end
+
     #
     # Construct the intermediate build product. It can be installed with the
     # Installer.app, but doesn't contain the data needed to customize the
@@ -187,16 +248,20 @@ module Omnibus
     # @return [void]
     #
     def build_component_pkg
-      command = <<-EOH.gsub(/^ {8}/, "")
+      command = <<~EOH
         pkgbuild \\
           --identifier "#{safe_identifier}" \\
           --version "#{safe_version}" \\
           --scripts "#{scripts_dir}" \\
           --root "#{project.install_dir}" \\
           --install-location "#{project.install_dir}" \\
-          "#{component_pkg}"
+          --preserve-xattr \\
       EOH
 
+      command << %Q{  --sign "#{signing_identity}" \\\n} if signing_identity
+      command << %Q{  "#{component_pkg}"}
+      command << %Q{\n}
+
       Dir.chdir(staging_dir) do
         shellout!(command)
       end
@@ -221,8 +286,7 @@ module Omnibus
           identifier: safe_identifier,
           version: safe_version,
           component_pkg: component_pkg,
-        }
-      )
+        })
     end
 
     #
@@ -232,7 +296,7 @@ module Omnibus
     # @return [void]
     #
     def build_product_pkg
-      command = <<-EOH.gsub(/^ {8}/, "")
+      command = <<~EOH
         productbuild \\
           --distribution "#{staging_dir}/Distribution" \\
           --resources "#{resources_dir}" \\
@@ -323,5 +387,57 @@ module Omnibus
         converted
       end
     end
+
+    #
+    # Given a file path return any linked libraries.
+    #
+    # @param [String] file_path
+    #    The path to a file
+    # @return [Array<String>]
+    #    The linked libs
+    #
+    def find_linked_libs(file_path)
+      # Find all libaries for each bin
+      command = "otool -L #{file_path}"
+
+      stdout = shellout!(command).stdout
+      stdout.slice!(file_path)
+      stdout.scan(/#{install_dir}\S*/)
+    end
+
+    def sign_library(lib)
+      sign_binary(lib)
+    end
+
+    def sign_binary(bin, hardened_runtime = false)
+      command = "codesign -s '#{signing_identity}' '#{bin}'"
+      command << %q{ --options=runtime} if hardened_runtime
+      command << %Q{ --entitlements #{resource_path("entitlements.plist")}} if File.exist?(resource_path("entitlements.plist")) && hardened_runtime
+      ## Force re-signing to deal with binaries that have the same sha.
+      command << %q{ --force}
+      command << %Q{\n}
+
+      shellout!(command)
+    end
+
+    def is_binary?(bin)
+      is_binary = File.file?(bin) &&
+        File.executable?(bin) &&
+        !File.symlink?(bin)
+      log.debug(log_key) { "    removing from signing: #{bin}" } unless is_binary
+      is_binary
+    end
+
+    def is_macho?(lib)
+      is_macho = false
+      if is_binary?(lib)
+        command = "file #{lib}"
+
+        stdout = shellout!(command).stdout
+        is_macho = stdout.match?(/Mach-O.*library/) || stdout.match?(/Mach-O.*bundle/)
+      end
+      log.debug(log_key) { "    removing from signing: #{lib}" } unless is_macho
+      is_macho
+    end
   end
 end

data/lib/omnibus/packagers/rpm.rb

@@ -243,7 +243,7 @@ module Omnibus
       if null?(val)
         @compression_type || :gzip
       else
-        unless val.is_a?(Symbol) && [:gzip, :bzip2, :xz].member?(val)
+        unless val.is_a?(Symbol) && %i{gzip bzip2 xz}.member?(val)
           raise InvalidValue.new(:compression_type, "be a Symbol (:gzip, :bzip2, or :xz)")
         end
 
@@ -317,7 +317,7 @@ module Omnibus
     # @return [Array]
     #
     def filesystem_directories
-      @filesystem_directories ||= IO.readlines(resource_path("filesystem_list")).map { |f| f.chomp }
+      @filesystem_directories ||= IO.readlines(resource_path("filesystem_list")).map(&:chomp)
     end
 
     #
@@ -356,7 +356,7 @@ module Omnibus
 
       # Get a list of all files
       files = FileSyncer.glob("#{build_dir}/**/*")
-                .map { |path| build_filepath(path) }
+        .map { |path| build_filepath(path) }
 
       render_template(resource_path("spec.erb"),
         destination: spec_file,
@@ -383,8 +383,7 @@ module Omnibus
           build_dir: build_dir,
           platform_family: Ohai["platform_family"],
           compression: compression,
-        }
-      )
+        })
     end
 
     #
@@ -422,8 +421,8 @@ module Omnibus
       if signing_passphrase
         log.info(log_key) { "Signing enabled for .rpm file" }
 
-        if File.exist?("#{ENV['HOME']}/.rpmmacros")
-          log.info(log_key) { "Detected .rpmmacros file at `#{ENV['HOME']}'" }
+        if File.exist?("#{ENV["HOME"]}/.rpmmacros")
+          log.info(log_key) { "Detected .rpmmacros file at `#{ENV["HOME"]}'" }
           home = ENV["HOME"]
         else
           log.info(log_key) { "Using default .rpmmacros file from Omnibus" }
@@ -435,9 +434,8 @@ module Omnibus
             destination: "#{home}/.rpmmacros",
             variables: {
               gpg_name: project.maintainer,
-              gpg_path: "#{ENV['HOME']}/.gnupg", # TODO: Make this configurable
-            }
-          )
+              gpg_path: "#{ENV["HOME"]}/.gnupg", # TODO: Make this configurable
+            })
         end
 
         command << " --sign"
@@ -466,11 +464,13 @@ module Omnibus
     def build_filepath(path)
       filepath = rpm_safe("/" + path.gsub("#{build_dir}/", ""))
       return if config_files.include?(filepath)
+
       full_path = build_dir + filepath.gsub("[%]", "%")
       # FileSyncer.glob quotes pathnames that contain spaces, which is a problem on el7
       full_path.delete!('"')
       # Mark directories with the %dir directive to prevent rpmbuild from counting their contents twice.
       return mark_filesystem_directories(filepath) if !File.symlink?(full_path) && File.directory?(full_path)
+
       filepath
     end
 
@@ -502,8 +502,7 @@ module Omnibus
         mode: 0700,
         variables: {
           passphrase: signing_passphrase,
-        }
-      )
+        })
 
       # Yield the destination to the block
       yield(destination)
@@ -630,6 +629,8 @@ module Omnibus
       case Ohai["kernel"]["machine"]
       when "i686"
         "i386"
+      when "armv7l" # raspberry pi 3 CentOS
+        "armv7hl"
       when "armv6l"
         if Ohai["platform"] == "pidora"
           "armv6hl"

data/lib/omnibus/packagers/solaris.rb

@@ -76,7 +76,7 @@ module Omnibus
     # Generate a Prototype file for solaris build
     #
     def write_prototype_file
-      shellout! "cd #{install_dirname} && find #{install_basename} -print > #{staging_dir_path('files')}"
+      shellout! "cd #{install_dirname} && find #{install_basename} -print > #{staging_dir_path("files")}"
 
       File.open staging_dir_path("files.clean"), "w+" do |fout|
         File.open staging_dir_path("files") do |fin|
@@ -100,10 +100,10 @@ module Omnibus
       end
 
       # generate the prototype's file list
-      shellout! "cd #{install_dirname} && pkgproto < #{staging_dir_path('files.clean')} > #{staging_dir_path('Prototype.files')}"
+      shellout! "cd #{install_dirname} && pkgproto < #{staging_dir_path("files.clean")} > #{staging_dir_path("Prototype.files")}"
 
       # fix up the user and group in the file list to root
-      shellout! "awk '{ $5 = \"root\"; $6 = \"root\"; print }' < #{staging_dir_path('Prototype.files')} >> #{staging_dir_path('Prototype')}"
+      shellout! "awk '{ $5 = \"root\"; $6 = \"root\"; print }' < #{staging_dir_path("Prototype.files")} >> #{staging_dir_path("Prototype")}"
     end
 
     #
@@ -139,7 +139,7 @@ module Omnibus
     # @return [void]
     #
     def create_solaris_file
-      shellout! "pkgmk -o -r #{install_dirname} -d #{staging_dir} -f #{staging_dir_path('Prototype')}"
+      shellout! "pkgmk -o -r #{install_dirname} -d #{staging_dir} -f #{staging_dir_path("Prototype")}"
       shellout! "pkgchk -vd #{staging_dir} #{project.package_name}"
       shellout! "pkgtrans #{staging_dir} #{package_path} #{project.package_name}"
     end

data/lib/omnibus/packagers/windows_base.rb

@@ -59,11 +59,11 @@ module Omnibus
             raise InvalidValue.new(:params, "be a Hash")
           end
 
-          valid_keys = [:store, :timestamp_servers, :machine_store, :algorithm]
+          valid_keys = %i{store timestamp_servers machine_store algorithm}
           invalid_keys = params.keys - valid_keys
           unless invalid_keys.empty?
-            raise InvalidValue.new(:params, "contain keys from [#{valid_keys.join(', ')}]. "\
-                                   "Found invalid keys [#{invalid_keys.join(', ')}]")
+            raise InvalidValue.new(:params, "contain keys from [#{valid_keys.join(", ")}]. "\
+                                   "Found invalid keys [#{invalid_keys.join(", ")}]")
           end
 
           if !params[:machine_store].nil? && !(
@@ -117,11 +117,11 @@ module Omnibus
         success = try_sign(package_file, ts)
         break if success
       end
-      raise FailedToSignWindowsPackage.new if !success
+      raise FailedToSignWindowsPackage.new unless success
     end
 
     def try_sign(package_file, url)
-      cmd = Array.new.tap do |arr|
+      cmd = [].tap do |arr|
         arr << "signtool.exe"
         arr << "sign /v"
         arr << "/t #{url}"
@@ -158,8 +158,9 @@ module Omnibus
     #
     def certificate_subject
       return "CN=#{project.package_name}" unless signing_identity
+
       store = machine_store? ? "LocalMachine" : "CurrentUser"
-      cmd = Array.new.tap do |arr|
+      cmd = [].tap do |arr|
         arr << "powershell.exe"
         arr << "-ExecutionPolicy Bypass"
         arr << "-NoProfile"