From 2f8d76f1e481321d33f8efe1c27ccf337c31377b Mon Sep 17 00:00:00 2001
From: karliss <karlis3p70l1ij@gmail.com>
Date: Tue, 6 May 2025 10:19:34 +0300
Subject: [PATCH] Adjust macos dylib references to keep gatekeeper happy.
 (#3482)

macOS gatekeeper wil block a properly signed/notarized .app from running if it contains absolute rpath references pointing outside the .app.
---
 .github/workflows/ci.yml       |  1 +
 cmake/BundledRizin.cmake       |  5 +++--
 dist/CMakeLists.txt            |  3 +++
 dist/MacOSSetupBundle.cmake.in | 14 ++++++++++++++
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0564317c..9d0d65a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -459,6 +459,7 @@ jobs:
       run: |
         export MACOSX_DEPLOYMENT_TARGET=10.15
         scripts/fetch_deps.sh
+        install_name_tool -delete_rpath /Users/runner/work/cutter-deps/cutter-deps/qt/lib ./cutter-deps/pyside/lib/libpyside6.cpython-312-darwin.6.7.2.dylib #TODO: do this in cutter-deps
         source cutter-deps/env.sh
         set -euo pipefail
         export PATH=/usr/local/opt/llvm/bin:$PATH
diff --git a/cmake/BundledRizin.cmake b/cmake/BundledRizin.cmake
index 3e05b263..e1f7974f 100644
--- a/cmake/BundledRizin.cmake
+++ b/cmake/BundledRizin.cmake
@@ -63,7 +63,7 @@ set (RZ_LIBS rz_core rz_config rz_cons rz_io rz_util rz_flag rz_arch rz_debug
         rz_hash rz_bin rz_lang rz_il rz_bp rz_egg rz_reg rz_search rz_syscall
         rz_socket rz_magic rz_crypto rz_type rz_diff rz_sign rz_demangler)
 set (RZ_EXTRA_LIBS rz_main)
-set (RZ_BIN rz-bin rizin rz-diff rz-find rz-gg rz-hash rz-run rz-asm rz-ax)
+set (RZ_BIN rz-bin rizin rz-diff rz-find rz-gg rz-hash rz-run rz-asm rz-ax rz-sign)
 
 target_link_libraries(Rizin INTERFACE
         ${RZ_LIBS})
@@ -87,5 +87,6 @@ if (WIN32)
         COMPONENT Devel
         PATTERN "*.pdb" EXCLUDE)
 else ()
-    install(DIRECTORY "${RIZIN_INSTALL_DIR}/" DESTINATION "." USE_SOURCE_PERMISSIONS)
+    install(DIRECTORY "${RIZIN_INSTALL_DIR}/" DESTINATION "." USE_SOURCE_PERMISSIONS
+            PATTERN "rz-test" EXCLUDE)
 endif()
diff --git a/dist/CMakeLists.txt b/dist/CMakeLists.txt
index 60b4dd95..956129fb 100644
--- a/dist/CMakeLists.txt
+++ b/dist/CMakeLists.txt
@@ -106,6 +106,9 @@ if(APPLE)
 	foreach(_lib ${RZ_LIBS})
 		list(APPEND ADJUST_RIZIN_LIBS "${RIZIN_INSTALL_DIR}/lib/lib${_lib}.dylib")
 	endforeach()
+	foreach(_lib ${RZ_EXTRA_LIBS})
+		list(APPEND ADJUST_RIZIN_LIBS "${RIZIN_INSTALL_DIR}/lib/lib${_lib}.dylib")
+	endforeach()
 
 	if(CUTTER_PACKAGE_DEPENDENCIES AND CUTTER_ENABLE_PYTHON)
 		set(EMBED_PYTHON_SH "${CMAKE_CURRENT_SOURCE_DIR}/appbundle_embed_python.sh")
diff --git a/dist/MacOSSetupBundle.cmake.in b/dist/MacOSSetupBundle.cmake.in
index 0259ac41..7918a23c 100644
--- a/dist/MacOSSetupBundle.cmake.in
+++ b/dist/MacOSSetupBundle.cmake.in
@@ -5,6 +5,8 @@ set(INFO_PLIST_PATH "@CPACK_BUNDLE_PLIST@")
 set(ADJUST_RIZIN_LIBS "@ADJUST_RIZIN_LIBS@")
 set(CUTTER_PACKAGE_DEPENDENCIES "@CUTTER_PACKAGE_DEPENDENCIES@")
 set(CUTTER_ENABLE_PYTHON "@CUTTER_ENABLE_PYTHON@")
+set(RZ_BIN "@RZ_BIN@")
+
 
 macro(run_or_die)
 	execute_process(${ARGV} RESULT_VARIABLE PROC_RESULT)
@@ -50,6 +52,18 @@ foreach(_lib ${ADJUST_RIZIN_LIBS})
 			"${CMAKE_INSTALL_PREFIX}/lib/${_name}")
 	endforeach()
 endforeach()
+foreach(_lib ${RZ_BIN})
+	get_filename_component(_lib "${_lib}" REALPATH)
+	get_filename_component(_name "${_lib}" NAME)
+	# Fix every lib for every lib too
+	foreach(_lib2 ${ADJUST_RIZIN_LIBS})
+	get_filename_component(_lib2 "${_lib2}" REALPATH)
+		get_filename_component(_name2 "${_lib2}" NAME)
+		run_or_die(COMMAND install_name_tool
+			-change "${_lib2}" "@rpath/${_name2}"
+			"${CMAKE_INSTALL_PREFIX}/bin/${_name}")
+	endforeach()
+endforeach()
 
 # Add rpaths because macdeployqt fails to do that properly
 run_or_die(COMMAND install_name_tool