CMake: Ad-hoc sign plugin bundles before copying them for running locally

Some hosts on Apple Silicon require that the entire bundle has a
well-formed signature, rather than just the plugin binary itself. This
patch checks whether the bundle signature is valid, and if it is not,
ad-hoc signs the bundle before copying.

CMakeLists.txt

@@ -141,8 +141,8 @@ configure_package_config_file("${JUCE_CMAKE_UTILS_DIR}/JUCEConfig.cmake.in"
 
 install(FILES "${JUCE_BINARY_DIR}/JUCEConfigVersion.cmake"
               "${JUCE_BINARY_DIR}/JUCEConfig.cmake"
-              "${JUCE_CMAKE_UTILS_DIR}/JUCEHelperTargets.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/JUCECheckAtomic.cmake"
+              "${JUCE_CMAKE_UTILS_DIR}/JUCEHelperTargets.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/JUCEModuleSupport.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/JUCEUtils.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/LaunchScreen.storyboard"
@@ -151,6 +151,7 @@ install(FILES "${JUCE_BINARY_DIR}/JUCEConfigVersion.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/PIPConsole.cpp.in"
               "${JUCE_CMAKE_UTILS_DIR}/RecentFilesMenuTemplate.nib"
               "${JUCE_CMAKE_UTILS_DIR}/UnityPluginGUIScript.cs.in"
+              "${JUCE_CMAKE_UTILS_DIR}/checkBundleSigning.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/copyDir.cmake"
               "${JUCE_CMAKE_UTILS_DIR}/juce_runtime_arch_detection.cpp"
         DESTINATION "${JUCE_INSTALL_DESTINATION}")

extras/Build/CMake/JUCEUtils.cmake

@@ -856,7 +856,15 @@ function(juce_enable_copy_plugin_step shared_code_target)
         get_target_property(source "${target}" JUCE_PLUGIN_ARTEFACT_FILE)
 
         if(source)
-            get_target_property(dest   "${target}" JUCE_PLUGIN_COPY_DIR)
+            if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+                add_custom_command(TARGET ${target} POST_BUILD
+                    COMMAND "${CMAKE_COMMAND}"
+                        "-Dsrc=${source}"
+                        "-P" "${JUCE_CMAKE_UTILS_DIR}/checkBundleSigning.cmake"
+                    VERBATIM)
+            endif()
+
+            get_target_property(dest "${target}" JUCE_PLUGIN_COPY_DIR)
 
             if(dest)
                 _juce_copy_dir("${target}" "${source}" "$<GENEX_EVAL:${dest}>")

extras/Build/CMake/checkBundleSigning.cmake

@@ -0,0 +1,37 @@
+# ==============================================================================
+#
+#  This file is part of the JUCE library.
+#  Copyright (c) 2020 - Raw Material Software Limited
+#
+#  JUCE is an open source library subject to commercial or open-source
+#  licensing.
+#
+#  By using JUCE, you agree to the terms of both the JUCE 6 End-User License
+#  Agreement and JUCE Privacy Policy (both effective as of the 16th June 2020).
+#
+#  End User License Agreement: www.juce.com/juce-6-licence
+#  Privacy Policy: www.juce.com/juce-privacy-policy
+#
+#  Or: You may also use this code under the terms of the GPL v3 (see
+#  www.gnu.org/licenses).
+#
+#  JUCE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY, AND ALL WARRANTIES, WHETHER
+#  EXPRESSED OR IMPLIED, INCLUDING MERCHANTABILITY AND FITNESS FOR PURPOSE, ARE
+#  DISCLAIMED.
+#
+# ==============================================================================
+
+find_program(JUCE_XCRUN xcrun)
+
+if(NOT JUCE_XCRUN)
+    return()
+endif()
+
+execute_process(
+    COMMAND "${JUCE_XCRUN}" codesign --verify "${src}"
+    RESULT_VARIABLE result)
+
+if(result)
+    message(STATUS "Replacing invalid signature with ad-hoc signature")
+    execute_process(COMMAND "${JUCE_XCRUN}" codesign -s - "${src}")
+endif()