From dee6e7533b18aa163ea9d5ce41df10c9e6a7dce5 Mon Sep 17 00:00:00 2001
From: Alan Fregtman <941331+darkvertex@users.noreply.github.com>
Date: Tue, 6 Apr 2021 15:39:12 -0400
Subject: [PATCH] Implements issue #30, a way to pass "--deep" flag to
 "codesign" tool.

---
 README.md                 | 8 +++++++-
 cmd/gon/main.go           | 2 ++
 internal/config/config.go | 2 ++
 sign/sign.go              | 8 ++++++++
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index cba22a6..b2e2cec 100644
--- a/README.md
+++ b/README.md
@@ -153,6 +153,7 @@ apple_id {
 
 sign {
   application_identity = "Developer ID Application: Mitchell Hashimoto"
+  deep = false
 }
 
 dmg {
@@ -174,7 +175,8 @@ zip {
         "password":  "@env:AC_PASSWORD"
     },
     "sign" :{
-        "application_identity" : "Developer ID Application: Mitchell Hashimoto"
+        "application_identity" : "Developer ID Application: Mitchell Hashimoto",
+        "deep": false
     },
     "dmg" :{
         "output_path":  "terraform.dmg",
@@ -224,6 +226,10 @@ Supported configurations:
       flag for the `codesign` binary on macOS. See `man codesign` for detailed
       documentation on accepted values.
 
+    * `deep` (`bool` _optional_) - If true, the `--deep` flag is used, which will recursively
+    codesign any directory paths (such as an *.app directory, for example.) Has no effect on
+    individual file paths.
+
     * `entitlements_file` (`string` _optional_) - The full path to a plist format .entitlements file, used for the `--entitlements` argument to `codesign`
 
   * `dmg` (_optional_) - Settings related to creating a disk image (dmg) as output.
diff --git a/cmd/gon/main.go b/cmd/gon/main.go
index 26213bf..b4a49fc 100644
--- a/cmd/gon/main.go
+++ b/cmd/gon/main.go
@@ -184,6 +184,7 @@ func realMain() int {
 				Files:        cfg.Source,
 				Identity:     cfg.Sign.ApplicationIdentity,
 				Entitlements: cfg.Sign.EntitlementsFile,
+				Deep:         cfg.Sign.Deep,
 				Logger:       logger.Named("sign"),
 			})
 			if err != nil {
@@ -232,6 +233,7 @@ func realMain() int {
 			err = sign.Sign(context.Background(), &sign.Options{
 				Files:    []string{cfg.Dmg.OutputPath},
 				Identity: cfg.Sign.ApplicationIdentity,
+				Deep:     cfg.Sign.Deep,
 				Logger:   logger.Named("dmg"),
 			})
 			if err != nil {
diff --git a/internal/config/config.go b/internal/config/config.go
index 8c8706e..fe8b2a9 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -70,6 +70,8 @@ type Sign struct {
 	ApplicationIdentity string `hcl:"application_identity"`
 	// Specify a path to an entitlements file in plist format
 	EntitlementsFile string `hcl:"entitlements_file,optional"`
+	// Specific to request a --deep codesigning.
+	Deep bool `hcl:"deep,optional"`
 }
 
 // Dmg are the options for a dmg file as output.
diff --git a/sign/sign.go b/sign/sign.go
index 40e1781..4383cb4 100644
--- a/sign/sign.go
+++ b/sign/sign.go
@@ -27,6 +27,10 @@ type Options struct {
 	// Entitlements is an (optional) path to a plist format .entitlements file
 	Entitlements string
 
+	// Deep is an (optional) toggle to force the --deep flag when codesigning.
+	// This can be useful for signing *.app directories and their child files.
+	Deep bool
+
 	// Output is an io.Writer where the output of the command will be written.
 	// If this is nil then the output will only be sent to the log (if set)
 	// or in the error result value if signing failed.
@@ -76,6 +80,10 @@ func Sign(ctx context.Context, opts *Options) error {
 		cmd.Args = append(cmd.Args, "--entitlements", opts.Entitlements)
 	}
 
+	if opts.Deep {
+		cmd.Args = append(cmd.Args, "--deep")
+	}
+
 	// Append the files that we want to sign
 	cmd.Args = append(cmd.Args, opts.Files...)