DRTVWR-447: Try to defeat scary Mac Gatekeeper popups

by replacing the viewer's baked-in BugsplatMac.framework @rpath path with one
based on @executable_path.

1 files changed, 29 insertions, 1 deletions

diff --git a/indra/newview/viewer_manifest.py b/indra/newview/viewer_manifest.py
index ed9b5a35fd..508c5cb043 100755
--- a/indra/newview/viewer_manifest.py
+++ b/indra/newview/viewer_manifest.py
@@ -933,6 +933,34 @@ class DarwinManifest(ViewerManifest):
                     self.path2basename(relpkgdir, "BugsplatMac.framework")
 
             with self.prefix(dst="MacOS"):
+                executable = self.dst_path_of(self.channel())
+                if self.args.get('bugsplat'):
+                    # According to Apple Technical Note TN2206:
+                    # https://developer.apple.com/library/archive/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG207
+                    # "If an app uses @rpath or an absolute path to link to a
+                    # dynamic library outside of the app, the app will be
+                    # rejected by Gatekeeper. ... Neither the codesign nor the
+                    # spctl tool will show the error."
+                    # (Thanks, Apple. Maybe fix spctl to warn?)
+                    # The BugsplatMac framework embeds @rpath, which is
+                    # causing scary Gatekeeper popups at viewer start. Work
+                    # around this by changing the reference baked into our
+                    # viewer. The install_name_tool -change option needs the
+                    # previous value. Instead of guessing -- which might
+                    # silently be defeated by a BugSplat SDK update that
+                    # changes their baked-in @rpath -- ask for the path
+                    # stamped into the framework.
+                    # Let exception, if any, propagate -- if this doesn't
+                    # work, we need the build to noisily fail!
+                    oldpath = subprocess.check_output(
+                        ['objdump', '-macho', '-dylib-id', '-non-verbose',
+                         os.path.join(relpkgdir, "BugsplatMac.framework", "BugsplatMac")]
+                        ).splitlines()[-1]  # take the last line of output
+                    self.run_command(
+                        ['install_name_tool', '-change', oldpath,
+                         '@executable_path/../Frameworks/BugsplatMac.framework/BugsplatMac',
+                         executable])
+
                 # NOTE: the -S argument to strip causes it to keep
                 # enough info for annotated backtraces (i.e. function
                 # names in the crash log). 'strip' with no arguments
@@ -942,7 +970,7 @@ class DarwinManifest(ViewerManifest):
                 if ("package" in self.args['actions'] or 
                     "unpacked" in self.args['actions']):
                     self.run_command(
-                        ['strip', '-S', self.dst_path_of(self.channel())])
+                        ['strip', '-S', executable])
 
             with self.prefix(dst="Resources"):
                 # defer cross-platform file copies until we're in the