[CMake] Always build debugserver on Darwin and allow tests to use the system's one

Summary:
We can always build debugserver, but we can't always sign it to be useable for testing. `LLDB_USE_SYSTEM_DEBUGSERVER` should only tell whether or not the system debugserver should be used for testing.
The old behavior complicated the logic around debugserver a lot. The new logic sorts out most of it.

Please note that this patch is in early stage and needs some more testing. It should not affect platfroms other than Darwin. It builds on Davide's approach to validate the code-signing identity at configuration time.

What do you think?

Reviewers: xiaobai, JDevlieghere, davide, compnerd, friss, labath, mgorny, jasonmolenda

Reviewed By: JDevlieghere

Subscribers: lldb-commits, #lldb

Tags: #lldb

Differential Revision: https://reviews.llvm.org/D64806

llvm-svn: 366433

1 files changed, 61 insertions, 124 deletions

diff --git a/lldb/tools/debugserver/source/CMakeLists.txt b/lldb/tools/debugserver/source/CMakeLists.txt
index cf305c9d268..303fd28caf6 100644
--- a/lldb/tools/debugserver/source/CMakeLists.txt
+++ b/lldb/tools/debugserver/source/CMakeLists.txt
@@ -6,6 +6,58 @@ include_directories(MacOSX/DarwinLog)
 
 include_directories(MacOSX)
 
+function(check_certificate identity result_valid)
+  execute_process(
+    COMMAND security find-certificate -Z -p -c ${identity} /Library/Keychains/System.keychain
+    RESULT_VARIABLE exit_code OUTPUT_QUIET ERROR_QUIET)
+  if(exit_code)
+    set(${result_valid} FALSE PARENT_SCOPE)
+  else()
+    set(${result_valid} TRUE PARENT_SCOPE)
+  endif()
+endfunction()
+
+function(get_debugserver_codesign_identity result)
+  string(CONCAT not_found_help
+    "This will cause failures in the test suite."
+    "Pass '-DLLDB_USE_SYSTEM_DEBUGSERVER=ON' to use the system one instead."
+    "See 'Code Signing on macOS' in the documentation."
+  )
+
+  # Explicit override: warn if unavailable
+  if(LLDB_CODESIGN_IDENTITY)
+    set(${result} ${LLDB_CODESIGN_IDENTITY} PARENT_SCOPE)
+    check_certificate(${LLDB_CODESIGN_IDENTITY} available)
+    if(NOT available AND NOT LLDB_USE_SYSTEM_DEBUGSERVER)
+      message(WARNING "LLDB_CODESIGN_IDENTITY not found: '${LLDB_CODESIGN_IDENTITY}' ${not_found_help}")
+    endif()
+    return()
+  endif()
+
+  # Development signing identity: use if available
+  check_certificate(lldb_codesign available)
+  if(available)
+    set(${result} lldb_codesign PARENT_SCOPE)
+    return()
+  endif()
+
+  if(NOT LLDB_USE_SYSTEM_DEBUGSERVER)
+    message(WARNING "Development code sign identiy not found: 'lldb_codesign' ${not_found_help}")
+  endif()
+
+  # LLVM pendant: fallback if available
+  if(LLVM_CODESIGNING_IDENTITY)
+    check_certificate(${LLVM_CODESIGNING_IDENTITY} available)
+    if(available)
+      set(${result} ${LLVM_CODESIGNING_IDENTITY} PARENT_SCOPE)
+      return()
+    endif()
+  endif()
+
+  # Ad-hoc signing: last resort
+  set(${result} "-" PARENT_SCOPE)
+endfunction()
+
 set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -stdlib=libc++ -Wl,-sectcreate,__TEXT,__info_plist,${CMAKE_CURRENT_SOURCE_DIR}/../resources/lldb-debugserver-Info.plist")
 
 check_cxx_compiler_flag("-Wno-gnu-zero-variadic-macro-arguments"
@@ -30,132 +82,17 @@ check_library_exists(compression compression_encode_buffer "" HAVE_LIBCOMPRESSIO
 
 add_subdirectory(MacOSX)
 
-# LLDB-specific identity, currently used for code signing debugserver.
 set(LLDB_CODESIGN_IDENTITY "" CACHE STRING
-    "Override code sign identity for debugserver and for use in tests; falls back to LLVM_CODESIGNING_IDENTITY if set or lldb_codesign otherwise (Darwin only)")
-
-# Determine which identity to use and store it in the separate cache entry.
-# We will query it later for LLDB_TEST_COMMON_ARGS.
-if(LLDB_CODESIGN_IDENTITY)
-  set(LLDB_CODESIGN_IDENTITY_USED ${LLDB_CODESIGN_IDENTITY} CACHE INTERNAL "" FORCE)
-elseif(LLVM_CODESIGNING_IDENTITY)
-  set(LLDB_CODESIGN_IDENTITY_USED ${LLVM_CODESIGNING_IDENTITY} CACHE INTERNAL "" FORCE)
-else()
-  set(LLDB_CODESIGN_IDENTITY_USED lldb_codesign CACHE INTERNAL "" FORCE)
-endif()
+    "Identity override for debugserver; see 'Code Signing on macOS' in the documentation (Darwin only)")
 
-# Override locally, so the identity is used for targets created in this scope.
-set(LLVM_CODESIGNING_IDENTITY ${LLDB_CODESIGN_IDENTITY_USED})
-
-option(LLDB_NO_DEBUGSERVER "Disable the debugserver target" OFF)
-option(LLDB_USE_SYSTEM_DEBUGSERVER "Use the system's debugserver instead of building it from source (Darwin only)." OFF)
+get_debugserver_codesign_identity(debugserver_codesign_identity)
 
-# Incompatible options
-if(LLDB_NO_DEBUGSERVER AND LLDB_USE_SYSTEM_DEBUGSERVER)
-  message(FATAL_ERROR "Inconsistent options: LLDB_NO_DEBUGSERVER and LLDB_USE_SYSTEM_DEBUGSERVER")
-endif()
-
-# Try to locate the system debugserver.
-# Subsequent feasibility checks depend on it.
-if(APPLE AND CMAKE_HOST_APPLE)
-  execute_process(
-    COMMAND xcode-select -p
-    OUTPUT_VARIABLE xcode_dev_dir)
-  string(STRIP ${xcode_dev_dir} xcode_dev_dir)
-
-  set(debugserver_rel_path "LLDB.framework/Resources/debugserver")
-  set(debugserver_shared "${xcode_dev_dir}/../SharedFrameworks/${debugserver_rel_path}")
-  set(debugserver_private "${xcode_dev_dir}/Library/PrivateFrameworks/${debugserver_rel_path}")
-
-  if(EXISTS ${debugserver_shared})
-    set(system_debugserver ${debugserver_shared})
-  elseif(EXISTS ${debugserver_private})
-    set(system_debugserver ${debugserver_private})
-  endif()
-endif()
-
-# Handle unavailability
-if(LLDB_USE_SYSTEM_DEBUGSERVER)
-  if(system_debugserver)
-    set(use_system_debugserver ON)
-  elseif(APPLE AND CMAKE_HOST_APPLE)
-    # Binary not found on system. Keep cached variable, to try again on reconfigure.
-    message(SEND_ERROR
-      "LLDB_USE_SYSTEM_DEBUGSERVER option set, but no debugserver found in:\
-        ${debugserver_shared}\
-        ${debugserver_private}")
-  else()
-    # Non-Apple target platform or non-Darwin host. Reset invalid cached variable.
-    message(WARNING "Reverting invalid option LLDB_USE_SYSTEM_DEBUGSERVER (Darwin only)")
-    set(LLDB_USE_SYSTEM_DEBUGSERVER OFF CACHE BOOL "" FORCE)
-  endif()
-elseif(NOT LLDB_NO_DEBUGSERVER)
-  # Default case: on Darwin we need the right code signing ID.
-  # See lldb/docs/code-signing.txt for details.
-  if(CMAKE_HOST_APPLE AND NOT LLVM_CODESIGNING_IDENTITY STREQUAL "lldb_codesign")
-    message(WARNING "Codesigning debugserver with identity ${LLVM_CODESIGNING_IDENTITY}. "
-                    "The usual setup uses the \"lldb_codesign\" identity created with "
-                    "scripts/macos-setup-codesign.sh. As a result your debugserver might "
-                    "not be able to attach to processes.\n"
-                    "Pass -DLLDB_CODESIGN_IDENTITY=lldb_codesign to use the development "
-                    "signing identity.")
-  endif()
-  set(build_and_sign_debugserver ON)
-endif()
-
-# TODO: We don't use the $<TARGET_FILE:debugserver> generator expression here,
-# because the value of DEBUGSERVER_PATH is used to build LLDB_DOTEST_ARGS,
-# which is used for configuring lldb-dotest.in, which does not have a generator
-# step at the moment.
-set(default_debugserver_path "${LLVM_RUNTIME_OUTPUT_INTDIR}/debugserver${CMAKE_EXECUTABLE_SUFFIX}")
-
-# Remember where debugserver binary goes and whether or not we have to test it.
-set(DEBUGSERVER_PATH "" CACHE FILEPATH "Path to debugserver")
-set(SKIP_TEST_DEBUGSERVER OFF CACHE BOOL "Building the in-tree debugserver was skipped")
-
-# Reset values in all cases in order to correctly support reconfigurations.
-if(use_system_debugserver)
-  add_custom_target(debugserver
-    COMMAND ${CMAKE_COMMAND} -E copy_if_different
-            ${system_debugserver} ${LLVM_RUNTIME_OUTPUT_INTDIR}
-    COMMENT "Copying the system debugserver to LLDB's binaries directory.")
-
-  set_target_properties(debugserver PROPERTIES FOLDER "lldb libraries/debugserver")
-
-  # Don't test debugserver itself.
-  # Tests that require debugserver will use the copy.
-  set(DEBUGSERVER_PATH ${default_debugserver_path} CACHE FILEPATH "" FORCE)
-  set(SKIP_TEST_DEBUGSERVER ON CACHE BOOL "" FORCE)
-
-  message(STATUS "Copy system debugserver from: ${system_debugserver}")
-elseif(build_and_sign_debugserver)
-  # Build, sign and test debugserver (below)
-  set(DEBUGSERVER_PATH ${default_debugserver_path} CACHE FILEPATH "" FORCE)
-  set(SKIP_TEST_DEBUGSERVER OFF CACHE BOOL "" FORCE)
-
-  message(STATUS "lldb debugserver: ${DEBUGSERVER_PATH}")
-else()
-  # No tests for debugserver, no tests that require it.
-  set(DEBUGSERVER_PATH "" CACHE FILEPATH "" FORCE)
-  set(SKIP_TEST_DEBUGSERVER ON CACHE BOOL "" FORCE)
-
-  message(STATUS "lldb debugserver will not be available.")
-endif()
+# Override locally, so the identity is used for targets created in this scope.
+set(LLVM_CODESIGNING_IDENTITY ${debugserver_codesign_identity})
 
-# On MacOS, debugserver needs to be codesigned when built. Check if we have
-# a certificate instead of failing in the middle of the build.
-if(build_and_sign_debugserver)
-  execute_process(
-    COMMAND security find-certificate -Z -p -c ${LLDB_CODESIGN_IDENTITY_USED} /Library/Keychains/System.keychain
-    RESULT_VARIABLE cert_return
-    OUTPUT_QUIET
-    ERROR_QUIET)
-
-  if (cert_return)
-    message(FATAL_ERROR "Certificate for debugserver not found. Run scripts/macos-setup-codesign.sh or "
-                        "use the system debugserver passing -DLLDB_USE_SYSTEM_DEBUGSERVER=ON to CMake")
-  endif()
-endif()
+# Use the same identity later in the test suite.
+set_property(GLOBAL PROPERTY
+  LLDB_DEBUGSERVER_CODESIGN_IDENTITY ${debugserver_codesign_identity})
 
 if(APPLE)
   if(IOS)
@@ -190,7 +127,7 @@ if(LLDB_USE_ENTITLEMENTS)
   endif()
 endif()
 
-if(build_and_sign_debugserver)
+#if(build_and_sign_debugserver)
   set(generated_mach_interfaces
     ${CMAKE_CURRENT_BINARY_DIR}/mach_exc.h
     ${CMAKE_CURRENT_BINARY_DIR}/mach_excServer.c
@@ -318,4 +255,4 @@ if(build_and_sign_debugserver)
         ${entitlements}
       )
   endif()
-endif()
+#endif()