Unsign dylibs when packaging with JDK 17 (#1703)

Resolves #1666

examples/widgets-gallery/desktop/build.gradle.kts

@@ -35,6 +35,10 @@ compose.desktop {
                 // see https://wixtoolset.org/documentation/manual/v3/howtos/general/generate_guids.html
                 upgradeUuid = "a61b72be-1b0c-4de5-9607-791c17687428"
             }
+
+            macOS {
+                bundleID = "org.jetbrains.compose.demo.widgets"
+            }
         }
     }
 }

examples/widgets-gallery/gradle.properties

@@ -20,5 +20,5 @@ android.enableJetifier=true
 # Kotlin code style for this project: "official" or "obsolete":
 kotlin.code.style=official
 kotlin.version=1.6.10
-compose.version=1.0.1-rc2
-agp.version=4.2.2
+compose.version=1.0.1
+agp.version=7.0.4

examples/widgets-gallery/gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.1.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.3-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/JavaRuntimeProperties.kt

@@ -11,7 +11,8 @@ import java.io.ObjectOutputStream
 import java.io.Serializable
 
 internal data class JavaRuntimeProperties(
-    val availableModules: List<String>
+    val majorVersion: Int,
+    val availableModules: List<String>,
 ) : Serializable {
     companion object {
         @Suppress("unused")

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/MacSigner.kt

@@ -51,6 +51,16 @@ internal class MacSigner(
         runExternalTool(MacUtils.codesign, args)
     }
 
+    fun unsign(file: File) {
+        val args = listOf(
+            "-vvvv",
+            "--remove-signature",
+            file.absolutePath
+        )
+        runExternalTool(MacUtils.codesign, args)
+
+    }
+
     private fun findCertificate(certificates: String): String {
         val regex = Pattern.compile("\"alis\"<blob>=\"([^\"]+)\"")
         val m = regex.matcher(certificates)

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/configureApplication.kt

@@ -112,7 +112,8 @@ internal fun Project.configurePackagingTasks(apps: Collection<Application>) {
             configurePackagingTask(
                 app,
                 createRuntimeImage = createRuntimeImage,
-                prepareAppResources = prepareAppResources
+                prepareAppResources = prepareAppResources,
+                checkRuntime = checkRuntime
             )
         }
 
@@ -131,7 +132,8 @@ internal fun Project.configurePackagingTasks(apps: Collection<Application>) {
                     configurePackagingTask(
                         app,
                         createRuntimeImage = createRuntimeImage,
-                        prepareAppResources = prepareAppResources
+                        prepareAppResources = prepareAppResources,
+                        checkRuntime = checkRuntime
                     )
                 } else {
                     configurePackagingTask(app, createAppImage = createDistributable)
@@ -184,7 +186,8 @@ internal fun AbstractJPackageTask.configurePackagingTask(
     app: Application,
     createAppImage: TaskProvider<AbstractJPackageTask>? = null,
     createRuntimeImage: TaskProvider<AbstractJLinkTask>? = null,
-    prepareAppResources: TaskProvider<Sync>? = null
+    prepareAppResources: TaskProvider<Sync>? = null,
+    checkRuntime: TaskProvider<AbstractCheckNativeDistributionRuntime>? = null
 ) {
     enabled = targetFormat.isCompatibleWithCurrentOS
 
@@ -204,6 +207,11 @@ internal fun AbstractJPackageTask.configurePackagingTask(
         appResourcesDir.set(resourcesDir)
     }
 
+    checkRuntime?.let { checkRuntime ->
+        dependsOn(checkRuntime)
+        javaRuntimePropertiesFile.set(checkRuntime.flatMap { it.javaRuntimePropertiesFile })
+    }
+
     configurePlatformSettings(app)
 
     app.nativeDistributions.let { executables ->

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/files/MacJarSignFileCopyingProcessor.kt

@@ -15,6 +15,7 @@ import java.util.zip.ZipOutputStream
 internal class MacJarSignFileCopyingProcessor(
     private val signer: MacSigner,
     private val tempDir: File,
+    private val jvmRuntimeVersion: Int
 ) : FileCopyingProcessor {
     override fun copy(source: File, target: File) {
         if (source.isJarFile) {
@@ -22,7 +23,18 @@ internal class MacJarSignFileCopyingProcessor(
         } else {
             SimpleFileCopyingProcessor.copy(source, target)
             if (source.name.isDylibPath) {
-                signer.sign(target)
+                when {
+                    jvmRuntimeVersion < 17 -> signer.sign(target)
+                    /**
+                     * JDK 17 started to sign non-jar dylibs,
+                     * but it fails, when libs are already signed,
+                     * so we need to remove signature before running jpackage.
+                     *
+                     * JDK 18 processes signed libraries fine, so we don't have to do anything.
+                     */
+                    jvmRuntimeVersion == 17 -> signer.unsign(target)
+                    else -> {}
+                }
             }
         }
     }

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/tasks/AbstractCheckNativeDistributionRuntime.kt

@@ -47,14 +47,14 @@ abstract class AbstractCheckNativeDistributionRuntime : AbstractComposeDesktopTa
     @TaskAction
     fun run() {
         val javaRuntimeVersion = try {
-            getJavaRuntimeVersionUnsafe()
+            getJavaRuntimeVersionUnsafe()?.toIntOrNull() ?: -1
         } catch (e: Exception) {
             throw IllegalStateException(
                 "Could not infer Java runtime version for Java home directory: ${javaHome.get()}", e
             )
         }
 
-        check((javaRuntimeVersion?.toIntOrNull() ?: -1) >= MIN_JAVA_RUNTIME_VERSION) {
+        check(javaRuntimeVersion >= MIN_JAVA_RUNTIME_VERSION) {
             """|Packaging native distributions requires JDK runtime version >= $MIN_JAVA_RUNTIME_VERSION
                |Actual version: '${javaRuntimeVersion ?: "<unknown>"}'
                |Java home: ${javaHome.get()}
@@ -76,7 +76,7 @@ abstract class AbstractCheckNativeDistributionRuntime : AbstractComposeDesktopTa
             }
         )
 
-        val properties = JavaRuntimeProperties(modules)
+        val properties = JavaRuntimeProperties(javaRuntimeVersion, modules)
         JavaRuntimeProperties.writeToFile(properties, javaRuntimePropertiesFile.ioFile)
     }
 

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/tasks/AbstractJPackageTask.kt

@@ -193,6 +193,10 @@ abstract class AbstractJPackageTask @Inject constructor(
     @get:Optional
     internal val macExtraPlistKeysRawXml: Property<String?> = objects.nullableProperty()
 
+    @get:InputFile
+    @get:Optional
+    val javaRuntimePropertiesFile: RegularFileProperty = objects.fileProperty()
+
     @get:Optional
     @get:Nested
     internal var nonValidatedMacSigningSettings: MacOSSigningSettings? = null
@@ -408,7 +412,12 @@ abstract class AbstractJPackageTask @Inject constructor(
                 fileOperations.delete(tmpDirForSign)
                 tmpDirForSign.mkdirs()
 
-                MacJarSignFileCopyingProcessor(signer, tmpDirForSign)
+                val jvmRuntimeInfo = JavaRuntimeProperties.readFromFile(javaRuntimePropertiesFile.ioFile)
+                MacJarSignFileCopyingProcessor(
+                    signer,
+                    tmpDirForSign,
+                    jvmRuntimeVersion = jvmRuntimeInfo.majorVersion
+                )
             } ?: SimpleFileCopyingProcessor
         fun copyFileToLibsDir(sourceFile: File): File {
             val targetFileName =