v.util.machosign #

TinyCC signs the executables it links on macOS by running Apple's codesign -f -s - <file>, and that tool costs about 50 ms per build, half of TinyCC's own time for the self-host. The drivers therefore put a no-op codesign first on TinyCC's PATH (codesign_shim_dir) and ad-hoc sign the Mach-O themselves (sign_adhoc), in about a millisecond.

fn codesign_shim_dir() CodesignShim

codesign_shim_dir prepares a directory whose codesign is a link to /usr/bin/true and puts it first on PATH, so TinyCC's post-link codesign call (Apple's tool takes tens of milliseconds) does nothing; the driver then signs the executable itself with sign_adhoc.

fn remove_codesign_shim_dir(shim CodesignShim)

remove_codesign_shim_dir restores PATH and removes the shim directory.

fn sign_adhoc(path string) !

sign_adhoc gives the 64-bit Mach-O executable at path an ad-hoc code signature (a SHA-256 code directory over 4 KiB pages, an empty requirements blob and an empty CMS wrapper), replacing any signature it has. The identifier is the file name, as codesign -s - uses.

struct CodesignShim {
pub:
	dir string
mut:
	previous_path     string
	previous_path_set bool
}

CodesignShim owns the temporary codesign shim and the PATH value that must be restored when its use ends.