Merge lp:~mikemc/ubuntuone-windows-installer/setup-mac-certfix into lp:ubuntuone-windows-installer

[Mike McCracken]

- Fix filename for cert in setup-mac, use full CN for code signing req.

- Fix filename for cert in setup-mac, use full CN for code signing req.

To test, in an os x buildout, run python setup-mac.py prepare py2app.

It should not complain about the valicert cert, and should complete successfully.

Then to test the code signing, cd to dist/build_to_sign/ and sign the app:
bash codesign-darwin.sh "Mac Developer: Michael McCracken (GP72FH8MSU)"

Then run the new verify script:
bash codesign-darwin-verify.sh

[Roberto Alsina (ralsina)]

Looks good to me.

review: Approve

=== added file 'scripts/codesign-darwin-verify.sh'
--- scripts/codesign-darwin-verify.sh	1970-01-01 00:00:00 +0000
+++ scripts/codesign-darwin-verify.sh	2012-09-11 16:17:19 +0000
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+codesign=/usr/bin/codesign
+
+set -x 
+set -e
+
+helper=UbuntuOne.app/Contents/Library/LaunchServices/com.ubuntu.one.fsevents
+
+echo "\nDisplaying Contents:"
+$codesign -d -vvvv UbuntuOne.app
+
+echo "\nVerifying Main App:"
+$codesign -v -v UbuntuOne.app
+
+echo "\nVerifying Daemon:"
+$codesign -v -v $helper
+
+echo "\nDouble-check: the SMPrivilegedExecutables entry should show the right ID and CN"
+defaults read "`pwd`/UbuntuOne.app/Contents/Info.plist" SMPrivilegedExecutables 
+defaults read "`pwd`/UbuntuOne.app/Contents/Info.plist" SMPrivilegedExecutables | perl -nle 'print "identifier $1 and certificate leaf[subject.CN] = \"$3\"" if /\"(.*)\" = \"identifier (.*) and certificate leaf\[subject.CN\] = \\\\\"(.*)\\\\\"/;' > tmp.req
+
+echo "\nChecking that the helper satisfies the app SMPrivilegedExecutables requirement"
+$codesign -v -v -R tmp.req $helper
+rm tmp.req
+
+echo "\nChecking that the app satisfies the helper's SMAuthorizedClients requirement"
+otool -s __TEXT __info_plist $helper | grep "^[0-9a-f]\{8,16\}" | xxd -r - - > tmp.plist
+perl -nle 'print "identifier $1 and certificate leaf[subject.CN] = \"$2\"" if /identifier (.*) and certificate leaf\[subject.CN\] = "(.*)"/;' tmp.plist > tmp.req 
+$codesign -v -v -R tmp.req UbuntuOne.app
+rm tmp.plist tmp.req
+
+echo Done.

=== modified file 'scripts/codesign-darwin.sh'
--- scripts/codesign-darwin.sh	2012-08-28 15:46:09 +0000
+++ scripts/codesign-darwin.sh	2012-09-11 16:17:19 +0000
@@ -1,16 +1,16 @@
 #!/bin/bash
 
+codesign=/usr/bin/codesign
+
 set -x 
 set -e
 
-/usr/bin/codesign -f -s "$@" com.ubuntu.one.fsevents
+$codesign -f -s "$@" com.ubuntu.one.fsevents
 
 mkdir -p UbuntuOne.app/Contents/Library/LaunchServices
 
-mv com.ubuntu.one.fsevents UbuntuOne.app/Contents/Library/LaunchServices/
-
-/usr/bin/codesign -f -s "$@" UbuntuOne.app
-
-/usr/bin/codesign -vvvv -d UbuntuOne.app
+cp com.ubuntu.one.fsevents UbuntuOne.app/Contents/Library/LaunchServices/
+
+$codesign -f -s "$@" UbuntuOne.app
 
 echo Done.

=== modified file 'scripts/setup-mac.py'
--- scripts/setup-mac.py	2012-09-05 19:08:47 +0000
+++ scripts/setup-mac.py	2012-09-11 16:17:19 +0000
@@ -52,7 +52,11 @@
     print "or see http://bitbucket.com/ronaldoussoren/py2app/"
     sys.exit()
 
-CODESIGN_CN = "Joe Developer"
+# NOTE - this needs to be the full CN, not just a substring.
+# /usr/bin/codesign will find the right cert if you pass it a
+# substring, but the rest of the system wants an exact match.
+CODESIGN_CN = "Mac Developer: Michael McCracken (GP72FH8MSU)"
+
 FSEVENTS_DAEMON_NAME = "com.ubuntu.one.fsevents"
 
 APP_NAMES = {'ubuntu-sso-login': 'Ubuntu SSO Helper',
@@ -797,5 +801,7 @@
     shutil.copy(daemon_build_path, sign_dir)
     shutil.copy(os.path.join("codesign-darwin.sh"),
                 sign_dir)
+    shutil.copy(os.path.join("codesign-darwin-verify.sh"),
+                sign_dir)
 
     print "Done. See %r for the signing package." % sign_dir