Changeset 846 for trunk/bin/patch_capabilities.pl

Timestamp:

May 5, 2011, 5:36:53 AM (14 years ago)

Author:

Dmitry A. Kuminov

Message:

trunk: Merged in qt 4.7.2 sources from branches/vendor/nokia/qt.

Location:

trunk

Files:

• . (modified) (1 prop)
• bin/patch_capabilities.pl (modified) (9 diffs)

trunk/bin/patch_capabilities.pl

@@ -2 +2 @@
 #############################################################################
 ##
-## Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+## Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
 ## All rights reserved.
 ## Contact: Nokia Corporation (qt-info@nokia.com)
@@ -47 +47 @@
 #######################################################################
 
+#
+# Note: Please make sure to output all changes done to the pkg file in a print statements
+#       starting with "Patching: " to ease integration into IDEs!
+#
+
+use File::Copy;
+use File::Spec;
+
 sub Usage() {
     print("This script can be used to set capabilities of all binaries\n");
     print("specified for deployment in a .pkg file.\n");
     print("If no capabilities are given, the binaries will be given the\n");
-    print("capabilities supported by self-signed certificates.\n");
-    print("\n *** NOTE: If *_template.pkg file is given, 'target-platform' is REQUIRED. ***\n");
-    print("\nUsage: patch_capabilities.pl pkg_filename <target-platform> [capability list]\n");
+    print("capabilities supported by self-signed certificates.\n\n");
+    print(" *** NOTE: If *_template.pkg file is given and one is using symbian-abld or\n");
+    print(" symbian-sbsv2 platform, 'target-platform' is REQUIRED. ***\n\n");
+    print(" *** NOTE2: When patching gcce binaries built with symbian-sbsv2 toolchain,\n");
+    print(" armv5 must be specified as platform.\n");
+    print("\nUsage: patch_capabilities.pl [-c] pkg_filename [target-platform [capability list]]\n");
     print("\nE.g. patch_capabilities.pl myapp_template.pkg release-armv5 \"All -TCB\"\n");
+    print("\nThe parameter -c can be used to just check if package is compatible with self-signing\n");
+    print("without actually doing any patching.\n");
+    print("Explicit capability list cannot be used with -c parameter.\n");
     exit();
 }
 
-my @capabilitiesToSet = ("LocalServices", "NetworkServices", "ReadUserData", "UserEnvironment", "WriteUserData");
+sub trim($) {
+    my $string = shift;
+    $string =~ s/^\s+//;
+    $string =~ s/\s+$//;
+    return $string;
+}
+
+my $epocroot = $ENV{EPOCROOT};
+my $epocToolsDir = "";
+if ($epocroot ne "") {
+    $epocroot =~ s,\\,/,g;
+    if ($epocroot =~ m,[^/]$,) {
+        $epocroot = $epocroot."/";
+    }
+    $epocToolsDir = "${epocroot}epoc32/tools/";
+}
+
+my $nullDevice = "/dev/null";
+$nullDevice = "NUL" if ($^O =~ /MSWin/);
+
+my @capabilitiesToAllow = ("LocalServices", "NetworkServices", "ReadUserData", "UserEnvironment", "WriteUserData", "Location");
+my @capabilitiesSpecified = ();
 
 # If arguments were given to the script,
@@ -65 +100 @@
     # Parse the first given script argument as a ".pkg" file name.
     my $pkgFileName = shift(@ARGV);
+    my $justCheck = "";
+    my $msgPrefix = "Patching:";
+
+    if ($pkgFileName eq "-c") {
+        $pkgFileName = shift(@ARGV);
+        $justCheck = true;
+        $msgPrefix = "Warning:";
+    }
 
     # These variables will only be set for template .pkg files.
@@ -74 +117 @@
     {
         my $targetplatform;
-        unless ($targetplatform = shift(@ARGV))
+        my $templateFile;
+        my $templateContents;
+        open($templateFile, "< $pkgFileName") or die ("Could not open $pkgFileName");
+        $templateContents = <$templateFile>;
+        close($templateFile);
+        unless (($targetplatform = shift(@ARGV)) || $templateContents !~ /\$\(PLATFORM\)/)
         {
             Usage();
         }
-
+        $targetplatform = "-" if (!$targetplatform);
         my @tmpvalues = split('-', $targetplatform);
         $target = $tmpvalues[0];
@@ -86 +134 @@
         $target =~ s/debug/udeb/i;
         $target =~ s/release/urel/i;
+
+        if (($platform =~ m/^gcce$/i) && ($ENV{SBS_HOME})) {
+            # Print a informative note in case suspected misuse is detected.
+            print "\nNote: You must use armv5 as platform when packaging gcce binaries built using symbian-sbsv2 mkspec.\n";
+        }
     }
 
@@ -91 +144 @@
     if (($pkgFileName =~ m|\.pkg$|i) && -r($pkgFileName))
     {
-        # If there are more arguments given, parse them as capabilities.
-        if (@ARGV)
-        {
-            @capabilitiesToSet = ();
-            while (@ARGV)
+        print ("\n");
+        if ($justCheck) {
+            print ("Checking");
+        } else {
+            print ("Patching");
+        }
+        print (" package file and relevant binaries...\n");
+
+        if (!$justCheck) {
+            # If there are more arguments given, parse them as capabilities.
+            if (@ARGV)
             {
-                push (@capabilitiesToSet, pop(@ARGV));
+                @capabilitiesSpecified = ();
+                while (@ARGV)
+                {
+                    push (@capabilitiesSpecified, pop(@ARGV));
+                }
             }
         }
@@ -105 +168 @@
 
         my $tempPkgFileName = $pkgFileName."_@@TEMP@@";
-        unlink($tempPkgFileName);
-        open (NEW_PKG, ">>".$tempPkgFileName);
+
+        if (!$justCheck) {
+            unlink($tempPkgFileName);
+            open (NEW_PKG, ">>".$tempPkgFileName);
+        }
         open (PKG, "<".$pkgFileName);
 
-        my $manufacturerElseBlock = 0;
+        my $checkFailed = "";
+        my $somethingPatched = "";
 
         # Parse each line.
         while (<PKG>)
         {
-            # Patch pkg UID
             my $line = $_;
             my $newLine = $line;
-            if ($line =~ m/^\#.*\(0x[0-9|a-f|A-F]*\).*$/)
+
+            # Patch pkg UID if it's in protected range
+            if ($line =~ m/^\#.*\((0x[0-7][0-9a-fA-F]*)\).*$/)
             {
-                $newLine =~ s/\(0x./\(0xE/;
-            }
-
-            # Patch embedded sis name and UID
-            if ($line =~ m/^@.*\.sis.*\(0x[0-9|a-f|A-F]*\).*$/)
-            {
-                $newLine =~ s/\(0x./\(0xE/;
-                if ($line !~ m/^.*_selfsigned.sis.*$/)
-                {
-                    $newLine =~ s/\.sis/_selfsigned\.sis/i;
-                }
-            }
-
-            # Remove dependencies to known problem packages (i.e. packages that are likely to be patched, also)
-            # to reduce unnecessary error messages.
-            if ($line =~ m/^\(0x2002af5f\).*\{.*\}$/)
-            {
-                $newLine = "\n"
-            }
-            if ($line =~ m/^\(0x2001E61C\).*\{.*\}$/)
-            {
-                $newLine = "\n"
-            }
-
-            # Remove manufacturer ifdef
-            if ($line =~ m/^.*\(MANUFACTURER\)\=\(.*\).*$/)
-            {
-                $newLine = "\n";
-            }
-
-            if ($line =~ m/^ELSEIF.*MANUFACTURER$/)
-            {
-                $manufacturerElseBlock = 1;
-            }
-
-            if ($manufacturerElseBlock eq 1)
-            {
-                $newLine = "\n";
-            }
-
-            if ($line =~ m/^ENDIF.*MANUFACTURER$/)
-            {
-                $manufacturerElseBlock = 0;
-            }
-
-            print NEW_PKG $newLine;
-
-            chomp ($line);
+                my $oldUID = $1;
+                print ("$msgPrefix UID $oldUID is not compatible with self-signing!\n");
+
+                if ($justCheck) {
+                    $checkFailed = true;
+                } else {
+                    my $newUID = $oldUID;
+                    $newUID =~ s/0x./0xE/i;
+                    $newLine =~ s/$oldUID/$newUID/;
+                    print ("$msgPrefix Package UID changed to: $newUID.\n");
+                    $somethingPatched = true;
+                }
+            }
 
             # If the line specifies a file, parse the source and destination locations.
-            if ($line =~ m|\"([^\"]+)\"\s*\-\s*\"([^\"]+)\"|)
+            if ($line =~ m|^ *\"([^\"]+)\"\s*\-\s*\"([^\"]+)\"|)
             {
                 my $sourcePath = $1;
-                my $destinationPath = $2;
 
                 # If the given file is a binary, check the target and binary type (+ the actual filename) from its path.
-                if ($sourcePath =~ m:/epoc32/release/([^/]+)/(udeb|urel|\$\(TARGET\))/(\w+(\.dll|\.exe)):i)
+                if ($sourcePath =~ m:\w+(\.dll|\.exe)$:i)
                 {
                     # Do preprocessing for template pkg,
@@ -185 +217 @@
                     }
 
-                    push (@binaries, $sourcePath);
-                }
-            }
+                    if ($justCheck) {
+                        push (@binaries, $sourcePath);
+                    } else {
+                        # Change the source file name (but only if not already patched)
+                        my $patchedSourcePath = $sourcePath;
+                        if ($patchedSourcePath !~ m/_patched_caps/)
+                        {
+                            $newLine =~ s/(^.*)(\.dll|\.exe)(.*)(\.dll|\.exe)/$1_patched_caps$2$3$4/i;
+                            $patchedSourcePath =~ s/(^.*)(\.dll|\.exe)/$1_patched_caps$2/i;
+
+                            copy($sourcePath, $patchedSourcePath) or die "$sourcePath cannot be copied for patching.";
+                        }
+                        push (@binaries, $patchedSourcePath);
+                    }
+                }
+            }
+
+            print NEW_PKG $newLine;
+
+            chomp ($line);
         }
 
         close (PKG);
-        close (NEW_PKG);
-
-        unlink($pkgFileName);
-        rename($tempPkgFileName, $pkgFileName);
-
+        if (!$justCheck) {
+            close (NEW_PKG);
+
+            unlink($pkgFileName);
+            rename($tempPkgFileName, $pkgFileName);
+        }
         print ("\n");
 
-        my $baseCommandToExecute = "elftran -vid 0x0 -capability \"";
-        if (@capabilitiesToSet)
-        {
-            $baseCommandToExecute .= join(" ", @capabilitiesToSet);
-        }
-        $baseCommandToExecute .= "\" ";
+        my $baseCommandToExecute = "${epocToolsDir}elftran -vid 0x0 -capability \"%s\" ";
 
         # Actually set the capabilities of the listed binaries.
@@ -209 +254 @@
         {
             # Create the command line for setting the capabilities.
+            my ($binaryVolume, $binaryDirs, $binaryBaseName) = File::Spec->splitpath($binaryPath);
             my $commandToExecute = $baseCommandToExecute;
+            my $executeNeeded = "";
+            if (@capabilitiesSpecified)
+            {
+                $commandToExecute = sprintf($baseCommandToExecute, join(" ", @capabilitiesSpecified));
+                $executeNeeded = true;
+                my $capString = join(" ", @capabilitiesSpecified);
+                print ("$msgPrefix Patching the the Vendor ID to 0 and the capabilities used to: \"$capString\" in \"$binaryBaseName\".\n");
+            } else {
+                # Test which capabilities are present and then restrict them to the allowed set.
+                # This avoid raising the capabilities of apps that already have none.
+                my $dllCaps;
+                open($dllCaps, "${epocToolsDir}elftran -dump s $binaryPath |") or die ("ERROR: Could not execute elftran");
+                my $capsFound = 0;
+                my $originalVid;
+                my @capabilitiesToSet;
+                my $capabilitiesToAllow = join(" ", @capabilitiesToAllow);
+                my @capabilitiesToDrop;
+                while (<$dllCaps>) {
+                    if (/^Secure ID: ([0-7][0-9a-fA-F]*)$/) {
+                        my $exeSid = $1;
+                        if ($binaryBaseName =~ /\.exe$/) {
+                            # Installer refuses to install protected executables in a self signed package, so abort if one is detected.
+                            # We can't simply just patch the executable SID, as any registration resources executable uses will be linked to it via SID.
+                            print ("$msgPrefix Executable with SID in the protected range (0x$exeSid) detected: \"$binaryBaseName\". A self-signed sis with protected executables is not supported.\n\n");
+                            $checkFailed = true;
+                        }
+                    }
+                    if (/^Vendor ID: ([0-9a-fA-F]*)$/) {
+                        $originalVid = "$1";
+                    }
+                    if (!$capsFound) {
+                        $capsFound = 1 if (/Capabilities:/);
+                    } else {
+                        $_ = trim($_);
+                        if ($capabilitiesToAllow =~ /$_/) {
+                            push(@capabilitiesToSet, $_);
+                            if (Location =~ /$_/i) {
+                                print ("$msgPrefix \"Location\" capability detected for binary: \"$binaryBaseName\". This capability is not self-signable for S60 3rd edition feature pack 1 devices, so installing this package on those devices will most likely not work.\n\n");
+                            }
+                        } else {
+                            push(@capabilitiesToDrop, $_);
+                        }
+                    }
+                }
+                close($dllCaps);
+                if ($originalVid !~ "00000000") {
+                    print ("$msgPrefix Non-zero vendor ID (0x$originalVid) is incompatible with self-signed packages in \"$binaryBaseName\"");
+                    if ($justCheck) {
+                        print (".\n\n");
+                        $checkFailed = true;
+                    } else {
+                        print (", setting it to zero.\n\n");
+                        $executeNeeded = true;
+                    }
+                }
+                if ($#capabilitiesToDrop) {
+                    my $capsToDropStr = join("\", \"", @capabilitiesToDrop);
+                    $capsToDropStr =~ s/\", \"$//;
+
+                    if ($justCheck) {
+                        print ("$msgPrefix The following capabilities used in \"$binaryBaseName\" are not compatible with a self-signed package: \"$capsToDropStr\".\n\n");
+                        $checkFailed = true;
+                    } else {
+                        if ($binaryBaseName =~ /\.exe$/) {
+                            # While libraries often have capabilities they do not themselves need just to enable them to be loaded by wider variety of processes,
+                            # executables are more likely to need every capability they have been assigned or they won't function correctly.
+                            print ("$msgPrefix Executable with capabilities incompatible with self-signing detected: \"$binaryBaseName\". (Incompatible capabilities: \"$capsToDropStr\".) Reducing capabilities is only supported for libraries.\n");
+                            $checkFailed = true;
+                        } else {
+                            print ("$msgPrefix The following capabilities used in \"$binaryBaseName\" are not compatible with a self-signed package and will be removed: \"$capsToDropStr\".\n");
+                            $executeNeeded = true;
+                        }
+                    }
+                }
+                $commandToExecute = sprintf($baseCommandToExecute, join(" ", @capabilitiesToSet));
+            }
             $commandToExecute .= $binaryPath;
 
-            # Actually execute the elftran command to set the capabilities.
-            system ($commandToExecute." > NUL");
-            print ("Executed ".$commandToExecute."\n");
-
-            ## Create another command line to check that the set capabilities are correct.
-            #$commandToExecute = "elftran -dump s ".$binaryPath;
-        }
-
+            if ($executeNeeded) {
+                # Actually execute the elftran command to set the capabilities.
+                print ("\n");
+                system ("$commandToExecute > $nullDevice");
+                $somethingPatched = true;
+            }
+        }
+
+        if ($checkFailed) {
+            print ("\n");
+            if ($justCheck) {
+                print ("$msgPrefix The package is not compatible with self-signing.\n");
+            } else {
+                print ("$msgPrefix Unable to patch the package for self-singing.\n");
+            }
+            print ("Use a proper developer certificate for signing this package.\n\n");
+            exit(1);
+        }
+
+        if ($justCheck) {
+            print ("Package is compatible with self-signing.\n");
+        } else {
+            if ($somethingPatched) {
+                print ("NOTE: A patched package may not work as expected due to reduced capabilities and other modifications,\n");
+                print ("      so it should not be used for any kind of Symbian signing or distribution!\n");
+                print ("      Use a proper certificate to avoid the need to patch the package.\n");
+            } else {
+                print ("No patching was required!\n");
+            }
+        }
         print ("\n");
+    } else {
+        Usage();
     }
 }