shell_i: Build the extension with the '-' identity by default

This allows developers to build and run the extension by default.
Official packages bundles will be re-signed after the build, we

The SocketApi prefix can be set at configure time through cmake and
should match the key that will be used to sign the whole .app bundle
(including the embedded FindexSync .appex bundle).

CMakeLists.txt

@@ -118,6 +118,10 @@ if(OWNCLOUD_5XX_NO_BLACKLIST)
     add_definitions(-DOWNCLOUD_5XX_NO_BLACKLIST=1)
 endif()
 
+if(APPLE)
+  set( SOCKETAPI_TEAM_IDENTIFIER_PREFIX "" CACHE STRING "SocketApi prefix (including a following dot) that must match the codesigh key's TeamIdentifier/Organizational Unit" )
+endif()
+
 #### find libs
 #find_package(Qt4 4.7.0 COMPONENTS QtCore QtGui QtXml QtNetwork QtTest QtWebkit REQUIRED )
 #if( UNIX AND NOT APPLE ) # Fdo notifications

config.h.in

@@ -5,7 +5,7 @@
 #cmakedefine WITH_QTKEYCHAIN 1
 #cmakedefine WITH_CRASHREPORTER
 #cmakedefine CRASHREPORTER_EXECUTABLE "@CRASHREPORTER_EXECUTABLE@"
-
+#define SOCKETAPI_TEAM_IDENTIFIER_PREFIX "@SOCKETAPI_TEAM_IDENTIFIER_PREFIX@"
 
 #cmakedefine APPLICATION_DOMAIN @APPLICATION_DOMAIN@
 #cmakedefine THEME_CLASS @THEME_CLASS@

shell_integration/MacOSX/CMakeLists.txt

@@ -1,9 +1,11 @@
 
 if(APPLE)
 add_custom_target( legacy_mac_overlayplugin ALL
-                   xcodebuild -workspace ${CMAKE_SOURCE_DIR}/shell_integration/MacOSX/OwnCloud.xcworkspace
-                            -scheme SyncStateFinder.osax -configuration Release SYMROOT=${CMAKE_CURRENT_BINARY_DIR}
-                   COMMENT building Legacy Mac Overlay icons)
+    xcodebuild -workspace ${CMAKE_SOURCE_DIR}/shell_integration/MacOSX/OwnCloud.xcworkspace
+        -scheme SyncStateFinder.osax -configuration Release SYMROOT=${CMAKE_CURRENT_BINARY_DIR}
+        OC_APPLICATION_REV_DOMAIN=${APPLICATION_REV_DOMAIN}
+        OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX=${SOCKETAPI_TEAM_IDENTIFIER_PREFIX}
+    COMMENT building Legacy Mac Overlay icons)
 
 # The bundle identifier and application group need to have compatible values with the client
 # to be able to open a Mach port across the extension's sandbox boundary.
@@ -14,6 +16,7 @@ add_custom_target( mac_overlayplugin ALL
         -target FinderSyncExt -configuration Release SYMROOT=${CMAKE_CURRENT_BINARY_DIR}
         OC_APPLICATION_NAME=${APPLICATION_NAME}
         OC_APPLICATION_REV_DOMAIN=${APPLICATION_REV_DOMAIN}
+        OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX=${SOCKETAPI_TEAM_IDENTIFIER_PREFIX}
     COMMENT building Mac Overlay icons)
 
 INSTALL( DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/Release/SyncStateFinder.osax/Contents

shell_integration/MacOSX/OwnCloudFinder/ContentManager.m

@@ -142,7 +142,7 @@ static OwnCloudFinderContentManager* sharedInstance = nil;
 	}
 	NSString* normalizedPath = [path decomposedStringWithCanonicalMapping];
 
-	if (![[RequestManager sharedInstance] isRegisteredPath:normalizedPath isDirectory:isDir]) {
+	if (![[OwnCloudFinderRequestManager sharedInstance] isRegisteredPath:normalizedPath isDirectory:isDir]) {
 		return [NSNumber numberWithInt:0];
 	}
 	
@@ -154,7 +154,7 @@ static OwnCloudFinderContentManager* sharedInstance = nil;
 		// Set 0 into the cache, meaning "don't have an icon, but already requested it"
 		[_fileNamesCache setObject:result forKey:normalizedPath];
 		// start the async call
-		[[RequestManager sharedInstance] askForIcon:normalizedPath isDirectory:isDir];
+		[[OwnCloudFinderRequestManager sharedInstance] askForIcon:normalizedPath isDirectory:isDir];
 	}
 	if ([result intValue] == 0) {
 		// Show the old state while we wait for the new one
@@ -223,7 +223,7 @@ static OwnCloudFinderContentManager* sharedInstance = nil;
 		}
 
 		MenuManager* menuManager = [MenuManager sharedInstance];
-		RequestManager* requestManager = [RequestManager sharedInstance];
+		OwnCloudFinderRequestManager* requestManager = [OwnCloudFinderRequestManager sharedInstance];
 
 		if ([[window className] isEqualToString:@"TBrowserWindow"])
 		{

shell_integration/MacOSX/OwnCloudFinder/FinderHook.m

@@ -51,7 +51,7 @@ static BOOL installed = NO;
 
 	// NSLog(@"SyncStateFinder: installing SyncState Shell extension");
 
-	[RequestManager sharedInstance];
+	[OwnCloudFinderRequestManager sharedInstance];
 
 	// Icons
 	[self hookMethod:@selector(drawImage:) inClass:@"IKImageBrowserCell" toCallToTheNewMethod:@selector(OCIconOverlayHandlers_IKImageBrowserCell_drawImage:)]; // 10.7 & 10.8 & 10.9 (Icon View arrange by name)
@@ -99,7 +99,7 @@ static BOOL installed = NO;
 
 	[[IconCache sharedInstance] dealloc];
 
-	[[RequestManager sharedInstance] dealloc];
+	[[OwnCloudFinderRequestManager sharedInstance] dealloc];
 
 	// Icons
 	[self hookMethod:@selector(OCIconOverlayHandlers_drawImage:) inClass:@"TIconViewCell" toCallToTheNewMethod:@selector(drawImage:)]; // 10.7 & 10.8 & 10.9

shell_integration/MacOSX/OwnCloudFinder/Info.plist

@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>SocketApiPrefix</key>
+	<string>$(OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX)$(OC_APPLICATION_REV_DOMAIN)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>English</string>
 	<key>CFBundleExecutable</key>

shell_integration/MacOSX/OwnCloudFinder/MenuManager.m

@@ -73,7 +73,7 @@ static MenuManager* sharedInstance = nil;
 
 - (void)addItemsToMenu:(TContextMenu*)menu forFiles:(NSArray*)files
 {
-	RequestManager *requestManager = [RequestManager sharedInstance];
+	OwnCloudFinderRequestManager *requestManager = [OwnCloudFinderRequestManager sharedInstance];
 	NSString *shareItemTitle = [requestManager shareItemTitle];
 	if (!shareItemTitle || shareItemTitle.length == 0) {
 		return;
@@ -157,7 +157,7 @@ static MenuManager* sharedInstance = nil;
 
 - (void)menuItemClicked:(id)param
 {
-	[[RequestManager sharedInstance] menuItemClicked:[param representedObject]];
+	[[OwnCloudFinderRequestManager sharedInstance] menuItemClicked:[param representedObject]];
 }
 
 - (NSArray*)pathsForNodes:(const struct TFENodeVector*)nodes

shell_integration/MacOSX/OwnCloudFinder/OwnCloudFinder.xcodeproj/project.pbxproj

@@ -285,6 +285,8 @@
 				GCC_OPTIMIZATION_LEVEL = 0;
 				INFOPLIST_FILE = Info.plist;
 				INSTALL_PATH = "$(HOME)/Library/Bundles";
+				OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient;
+				OC_TEAM_IDENTIFIER_PREFIX = "";
 				PRODUCT_NAME = SyncStateFinder;
 				WRAPPER_EXTENSION = bundle;
 			};
@@ -302,6 +304,8 @@
 				GCC_MODEL_TUNING = G5;
 				INFOPLIST_FILE = Info.plist;
 				INSTALL_PATH = "$(HOME)/Library/Bundles";
+				OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient;
+				OC_TEAM_IDENTIFIER_PREFIX = "";
 				PRODUCT_NAME = SyncStateFinder;
 				WRAPPER_EXTENSION = bundle;
 			};

shell_integration/MacOSX/OwnCloudFinder/RequestManager.h

@@ -16,7 +16,7 @@
 #import "RequestManager.h"
 #import "SyncClientProxy.h"
 
-@interface RequestManager : NSObject <SyncClientProxyDelegate>
+@interface OwnCloudFinderRequestManager : NSObject <SyncClientProxyDelegate>
 {
 	SyncClientProxy *_syncClientProxy;
 
@@ -29,7 +29,7 @@
 
 @property (nonatomic, retain) NSString* filterFolder;
 
-+ (RequestManager*)sharedInstance;
++ (OwnCloudFinderRequestManager*)sharedInstance;
 
 - (BOOL)isRegisteredPath:(NSString*)path isDirectory:(BOOL)isDir;
 - (void)askForIcon:(NSString*)path isDirectory:(BOOL)isDir;

shell_integration/MacOSX/OwnCloudFinder/RequestManager.m

@@ -16,19 +16,22 @@
 #import "IconCache.h"
 #import "RequestManager.h"
 
-#define READ_TAG 2422
+static OwnCloudFinderRequestManager* sharedInstance = nil;
 
-static RequestManager* sharedInstance = nil;
-
-@implementation RequestManager
+@implementation OwnCloudFinderRequestManager
 
 - (id)init
 {
 	if ((self = [super init]))
 	{
 		// For the sake of allowing both the legacy and the FinderSync extensions to work with the same
-		// client build, use the same server name including the Team ID even though we won't be signing the bundle.
-		NSString *serverName = @"9B5WD74GWJ.com.owncloud.desktopclient.socketApi";
+		// client build, use the same server name including the Team ID even though we won't be sandboxed.
+		NSBundle *extBundle = [NSBundle bundleForClass:[self class]];
+		// This was added to the bundle's Info.plist to get it from the build system
+		NSString *socketApiPrefix = [extBundle objectForInfoDictionaryKey:@"SocketApiPrefix"];
+		NSString *serverName = [socketApiPrefix stringByAppendingString:@".socketApi"];
+		// NSLog(@"OwnCloudFinderRequestManager serverName %@", serverName);
+
 		_syncClientProxy = [[SyncClientProxy alloc] initWithDelegate:self serverName:serverName];
 
 		_registeredPathes = [[NSMutableDictionary alloc] init];
@@ -53,7 +56,7 @@ static RequestManager* sharedInstance = nil;
 	[super dealloc];
 }
 
-+ (RequestManager*)sharedInstance
++ (OwnCloudFinderRequestManager*)sharedInstance
 {
 	@synchronized(self)
 	{

shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSync.m

@@ -25,7 +25,7 @@
 	FIFinderSyncController *syncController = [FIFinderSyncController defaultController];
 	NSBundle *extBundle = [NSBundle bundleForClass:[self class]];
 	// This was added to the bundle's Info.plist to get it from the build system
-	NSString *teamIdentifierPrefix = [extBundle objectForInfoDictionaryKey:@"TeamIdentifierPrefix"];
+	NSString *socketApiPrefix = [extBundle objectForInfoDictionaryKey:@"SocketApiPrefix"];
 
 	NSImage *ok = [extBundle imageForResource:@"ok.icns"];
 	NSImage *ok_swm = [extBundle imageForResource:@"ok_swm.icns"];
@@ -44,10 +44,18 @@
 	[syncController setBadgeImage:warning label:@"Ignored" forBadgeIdentifier:@"IGNORE+SWM"];
 	[syncController setBadgeImage:error label:@"Error" forBadgeIdentifier:@"ERROR+SWM"];
 	
-	// The Mach port name needs to be prefixed with the code signing Team ID
+	// The Mach port name needs to:
+	// - Be prefixed with the code signing Team ID
+	// - Then infixed with the sandbox App Group
+	// - The App Group itself must be a prefix of (or equal to) the application bundle identifier
+	// We end up in the official signed client with: 9B5WD74GWJ.com.owncloud.desktopclient.socketApi
+	// With ad-hoc signing (the '-' signing identity) we must drop the Team ID.
+	// When the code isn't sandboxed (e.g. the OC client or the legacy overlay icon extension)
+	// the OS doesn't seem to put any restriction on the port name, so we just follow what
+	// the sandboxed App Extension needs.
 	// https://developer.apple.com/library/mac/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW24
-	NSString *serverName = [[teamIdentifierPrefix stringByAppendingString:[extBundle bundleIdentifier]]
-		stringByReplacingOccurrencesOfString:@".FinderSyncExt" withString:@".socketApi"];
+	NSString *serverName = [socketApiPrefix stringByAppendingString:@".socketApi"];
+	// NSLog(@"FinderSync serverName %@", serverName);
 
 	_syncClientProxy = [[SyncClientProxy alloc] initWithDelegate:self serverName:serverName];
 	_registeredDirectories = [[NSMutableSet alloc] init];

shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/FinderSyncExt.entitlements

@@ -6,7 +6,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>$(TeamIdentifierPrefix)$(OC_APPLICATION_REV_DOMAIN)</string>
+		<string>$(OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX)$(OC_APPLICATION_REV_DOMAIN)</string>
 	</array>
 </dict>
 </plist>

shell_integration/MacOSX/OwnCloudFinderSync/FinderSyncExt/Info.plist

@@ -2,8 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>TeamIdentifierPrefix</key>
-	<string>$(TeamIdentifierPrefix)</string>
+	<key>SocketApiPrefix</key>
+	<string>$(OC_SOCKETAPI_TEAM_IDENTIFIER_PREFIX)$(OC_APPLICATION_REV_DOMAIN)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>en</string>
 	<key>CFBundleDisplayName</key>

shell_integration/MacOSX/OwnCloudFinderSync/OwnCloudFinderSync.xcodeproj/project.pbxproj

@@ -312,8 +312,7 @@
 				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "Developer ID Application";
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_IDENTITY = "-";
 				COMBINE_HIDPI_IMAGES = YES;
 				COPY_PHASE_STRIP = NO;
 				DEBUG_INFORMATION_FORMAT = dwarf;
@@ -362,8 +361,7 @@
 				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				CODE_SIGN_IDENTITY = "Developer ID Application";
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_IDENTITY = "-";
 				COMBINE_HIDPI_IMAGES = YES;
 				COPY_PHASE_STRIP = NO;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
@@ -405,8 +403,7 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				CODE_SIGN_ENTITLEMENTS = FinderSyncExt/FinderSyncExt.entitlements;
-				CODE_SIGN_IDENTITY = "Developer ID Application";
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_IDENTITY = "-";
 				COMBINE_HIDPI_IMAGES = YES;
 				COPY_PHASE_STRIP = NO;
 				DEBUG_INFORMATION_FORMAT = dwarf;
@@ -432,6 +429,7 @@
 				MTL_ENABLE_DEBUG_INFO = YES;
 				OC_APPLICATION_NAME = ownCloud;
 				OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient;
+				OC_TEAM_IDENTIFIER_PREFIX = "";
 				ONLY_ACTIVE_ARCH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE = "";
@@ -458,8 +456,7 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				CODE_SIGN_ENTITLEMENTS = FinderSyncExt/FinderSyncExt.entitlements;
-				CODE_SIGN_IDENTITY = "Developer ID Application";
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_IDENTITY = "-";
 				COMBINE_HIDPI_IMAGES = YES;
 				COPY_PHASE_STRIP = NO;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
@@ -479,6 +476,7 @@
 				MTL_ENABLE_DEBUG_INFO = NO;
 				OC_APPLICATION_NAME = ownCloud;
 				OC_APPLICATION_REV_DOMAIN = com.owncloud.desktopclient;
+				OC_TEAM_IDENTIFIER_PREFIX = "";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE = "";
 				SDKROOT = macosx;

src/gui/socketapi.cpp

@@ -16,6 +16,7 @@
 
 #include "socketapi.h"
 
+#include "config.h"
 #include "configfile.h"
 #include "folderman.h"
 #include "folder.h"
@@ -84,11 +85,10 @@ SocketApi::SocketApi(QObject* parent)
         // See issue #2388
         // + Theme::instance()->appName();
     } else if (Utility::isMac()) {
-        // This much match the code signing Team setting of the extension
-        // FIXME: Hardcoded for now, but if we want to allow builds to be
-        // signed by third party Apple Developer accounts, we'll have to
-        // allow changing this through the build system.
-        socketPath = "9B5WD74GWJ." APPLICATION_REV_DOMAIN ".socketApi";
+        // This must match the code signing Team setting of the extension
+        // Example for developer builds (with ad-hoc signing identity): "" "com.owncloud.desktopclient" ".socketApi"
+        // Example for official signed packages: "9B5WD74GWJ." "com.owncloud.desktopclient" ".socketApi"
+        socketPath = SOCKETAPI_TEAM_IDENTIFIER_PREFIX APPLICATION_REV_DOMAIN ".socketApi";
     } else if( Utility::isLinux() || Utility::isBSD() ) {
         QString runtimeDir;
 #if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)