RFR: 8370126: Improve jpackage signing testing

[Alexey Semenyuk]

On Tue, 21 Oct 2025 00:48:03 GMT, Alexey Semenyuk <asemenyuk at openjdk.org> wrote:

>> test/jdk/tools/jpackage/helpers/jdk/jpackage/test/MacSignVerify.java line 205:
>> 
>>> 203:             // It is known to fail for some AppContentTest test cases and all FileAssociationsTest test cases.
>>> 204:             // Rerunning the command with "sudo" works, though.
>>> 205:             return str.equals(String.format("%s: Permission denied", path));
>> 
>> Did you check permissions on generated application bundles in case of failure vs when it pass? Maybe we have issue with permissions in generated application images and by doing work around we hiding current bug or potential bugs.
>
> This is what fails:
> 
> $ /usr/bin/codesign --verify --strict --verbose=2 /Applications/AppContentTest.app
> /Applications/AppContentTest.app: Permission denied
> 
> This is what works:
> 
> $ sudo /usr/bin/codesign --verify --strict --verbose=2 /Applications/AppContentTest.app
> /Applications/AppContentTest.app: valid on disk
> /Applications/AppContentTest.app: satisfies its Designated Requirement
> 
> 
> I can't spot anything suspicious, can you?
> 
> 
> $ ls -alR /Applications/AppContentTest.app
> total 0
> drwxr-xr-x   3 root  wheel    96B Oct 20 20:40 ./
> drwxrwxr-x  31 root  admin   992B Oct 20 20:40 ../
> drwxr-xr-x   9 root  wheel   288B Oct 20 20:40 Contents/
> 
> /Applications/AppContentTest.app/Contents:
> total 16
> drwxr-xr-x  9 root  wheel   288B Oct 20 20:40 ./
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 ../
> -rw-r--r--  1 root  wheel   1.3K Oct 20 20:40 Info.plist
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 MacOS/
> -rw-r--r--  1 root  wheel     8B Oct 20 20:40 PkgInfo
> drwxr-xr-x  5 root  wheel   160B Oct 20 20:40 Resources/
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 _CodeSignature/
> drwxr-xr-x  5 root  wheel   160B Oct 20 20:40 app/
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 runtime/
> 
> /Applications/AppContentTest.app/Contents/MacOS:
> total 440
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 ./
> drwxr-xr-x  9 root  wheel   288B Oct 20 20:40 ../
> -rwxr-xr-x  1 root  wheel   217K Oct 20 20:40 AppContentTest*
> 
> /Applications/AppContentTest.app/Contents/Resources:
> total 760
> drwxr-xr-x  5 root  wheel   160B Oct 20 20:40 ./
> drwxr-xr-x  9 root  wheel   288B Oct 20 20:40 ../
> -rw-r--r--  1 root  wheel   370K Oct 20 20:40 AppContentTest.icns
> -rwx------  1 root  wheel   3.5K Oct 20 20:40 PrintEnv.java*
> -rwx------  1 root  wheel   1.4K Oct 20 20:40 dukeplug.png*
> 
> /Applications/AppContentTest.app/Contents/_CodeSignature:
> total 16
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 ./
> drwxr-xr-x  9 root  wheel   288B Oct 20 20:40 ../
> -rw-r--r--  1 root  wheel   4.7K Oct 20 20:40 CodeResources
> 
> /Applications/AppContentTest.app/Contents/app:
> total 32
> drwxr-xr-x  5 root  wheel   160B Oct 20 20:40 ./
> drwxr-xr-x  9 root  wheel   288B Oct 20 20:40 ../
> -rw-r--r--  1 root  wheel    14B Oct 20 20:40 .package
> -rw-r--r--  1 root  wheel   121B Oct 20 20:40 AppContentTest.cfg
> -rw-r--r--  1 root  wheel   4.4K Oct 20 20:40 hello.jar
> 
> /Applications/AppContentTest.app/Contents/runtime:
> total 0
> drwxr-xr-x  3 root  wheel    96B Oct 20 20:40 ./
> drwxr-xr-x  9 root  wheel   288B Oct 20 20:40 ../
> drwxr-xr-x  6 root  wheel   1...

It always fails for me. This is an unsigned bundle, and we never checked the signature of unsigned bundles before this fix in the tests.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/27875#discussion_r2446459737