8351073: [macos] jpackage produces invalid Java runtime DMG bundles

Reviewed-by: asemenyuk

Author: Alexander Matveev

src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/CodesignConfig.java

@@ -44,7 +44,9 @@ record CodesignConfig(Optional<SigningIdentity> identity, Optional<String> ident
         Objects.requireNonNull(keychain);
 
         if (identity.isPresent() != identifierPrefix.isPresent()) {
-            throw new IllegalArgumentException("Signing identity and identifier prefix mismatch");
+            throw new IllegalArgumentException(
+                "Signing identity (" + identity + ") and identifier prefix (" +
+                identifierPrefix + ") mismatch");
         }
 
         identifierPrefix.ifPresent(v -> {

src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/MacAppBundler.java

@@ -69,7 +69,7 @@ private static void doValidate(Map<String, ? super Object> params)
             }
         }
 
-        if (StandardBundlerParam.getPredefinedAppImage(params) != null) {
+        if (StandardBundlerParam.hasPredefinedAppImage(params)) {
             if (!Optional.ofNullable(
                     SIGN_BUNDLE.fetchFrom(params)).orElse(Boolean.FALSE)) {
                 throw new ConfigException(

src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/MacBundle.java

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.jpackage.internal;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Objects;
+import jdk.jpackage.internal.model.AppImageLayout;
+
+/**
+ * An abstraction of macOS Application bundle.
+ *
+ * @see <a href="https://en.wikipedia.org/wiki/Bundle_(macOS)#Application_bundles">https://en.wikipedia.org/wiki/Bundle_(macOS)#Application_bundles</a>
+ */
+record MacBundle(Path root) {
+
+    MacBundle {
+        Objects.requireNonNull(root);
+    }
+
+    boolean isValid() {
+        return Files.isDirectory(contentsDir()) && Files.isDirectory(macOsDir()) && Files.isRegularFile(infoPlistFile());
+    }
+
+    boolean isSigned() {
+        return Files.isDirectory(contentsDir().resolve("_CodeSignature"));
+    }
+
+    Path contentsDir() {
+        return root.resolve("Contents");
+    }
+
+    Path homeDir() {
+        return contentsDir().resolve("Home");
+    }
+
+    Path macOsDir() {
+        return contentsDir().resolve("MacOS");
+    }
+
+    Path resourcesDir() {
+        return contentsDir().resolve("Resources");
+    }
+
+    Path infoPlistFile() {
+        return contentsDir().resolve("Info.plist");
+    }
+
+    static boolean isDirectoryMacBundle(Path dir) {
+        return new MacBundle(dir).isValid();
+    }
+
+    static MacBundle fromAppImageLayout(AppImageLayout layout) {
+        return new MacBundle(layout.rootDirectory());
+    }
+}

src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/MacFromParams.java

@@ -147,7 +147,15 @@ private static MacApplication createMacApplication(
                 signingBuilder.entitlementsResourceName("sandbox.plist");
             }
 
-            app.mainLauncher().flatMap(Launcher::startupInfo).ifPresent(signingBuilder::signingIdentifierPrefix);
+            final var bundleIdentifier = appBuilder.create().bundleIdentifier();
+            app.mainLauncher().flatMap(Launcher::startupInfo).ifPresentOrElse(
+                signingBuilder::signingIdentifierPrefix,
+                () -> {
+                    // Runtime installer does not have main launcher, so use
+                    // 'bundleIdentifier' as prefix by default.
+                    signingBuilder.signingIdentifierPrefix(
+                        bundleIdentifier + ".");
+                });
             SIGN_IDENTIFIER_PREFIX.copyInto(params, signingBuilder::signingIdentifierPrefix);
 
             ENTITLEMENTS.copyInto(params, signingBuilder::entitlements);
@@ -168,6 +176,12 @@ private static MacPackageBuilder createMacPackageBuilder(
                 .map(MacAppImageFileExtras::signed)
                 .ifPresent(builder::predefinedAppImageSigned);
 
+        PREDEFINED_RUNTIME_IMAGE.findIn(params)
+                .map(MacBundle::new)
+                .filter(MacBundle::isValid)
+                .map(MacBundle::isSigned)
+                .ifPresent(builder::predefinedAppImageSigned);
+
         return builder;
     }
 

src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/MacPackagingPipeline.java

@@ -41,6 +41,7 @@
 import java.io.StringWriter;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
+import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -72,6 +73,7 @@
 import jdk.jpackage.internal.model.Package;
 import jdk.jpackage.internal.model.PackageType;
 import jdk.jpackage.internal.model.PackagerException;
+import jdk.jpackage.internal.util.FileUtils;
 import jdk.jpackage.internal.util.PathUtils;
 import jdk.jpackage.internal.util.function.ThrowingConsumer;
 
@@ -91,6 +93,7 @@ enum MacBuildApplicationTaskID implements TaskID {
     enum MacCopyAppImageTaskID implements TaskID {
         COPY_PACKAGE_FILE,
         COPY_RUNTIME_INFO_PLIST,
+        COPY_RUNTIME_JLILIB,
         REPLACE_APP_IMAGE_FILE,
         COPY_SIGN
     }
@@ -115,10 +118,10 @@ static PackagingPipeline.Builder build(Optional<Package> pkg) {
                 .task(CopyAppImageTaskID.COPY)
                         .copyAction(MacPackagingPipeline::copyAppImage).add()
                 .task(MacBuildApplicationTaskID.RUNTIME_INFO_PLIST)
-                        .applicationAction(MacPackagingPipeline::writeApplicationRuntimeInfoPlist)
+                        .appImageAction(MacPackagingPipeline::writeRuntimeInfoPlist)
                         .addDependent(BuildApplicationTaskID.CONTENT).add()
                 .task(MacBuildApplicationTaskID.COPY_JLILIB)
-                        .applicationAction(MacPackagingPipeline::copyJliLib)
+                        .appImageAction(MacPackagingPipeline::copyJliLib)
                         .addDependency(BuildApplicationTaskID.RUNTIME)
                         .addDependent(BuildApplicationTaskID.CONTENT).add()
                 .task(MacBuildApplicationTaskID.APP_ICON)
@@ -138,13 +141,18 @@ static PackagingPipeline.Builder build(Optional<Package> pkg) {
                         .addDependencies(CopyAppImageTaskID.COPY)
                         .addDependents(PrimaryTaskID.COPY_APP_IMAGE).add()
                 .task(MacCopyAppImageTaskID.COPY_RUNTIME_INFO_PLIST)
+                        .appImageAction(MacPackagingPipeline::writeRuntimeInfoPlist)
+                        .addDependencies(CopyAppImageTaskID.COPY)
+                        .addDependents(PrimaryTaskID.COPY_APP_IMAGE).add()
+                .task(MacCopyAppImageTaskID.COPY_RUNTIME_JLILIB)
+                        .noaction()
                         .addDependencies(CopyAppImageTaskID.COPY)
                         .addDependents(PrimaryTaskID.COPY_APP_IMAGE).add()
                 .task(MacBuildApplicationTaskID.FA_ICONS)
                         .applicationAction(MacPackagingPipeline::writeFileAssociationIcons)
                         .addDependent(BuildApplicationTaskID.CONTENT).add()
                 .task(MacBuildApplicationTaskID.APP_INFO_PLIST)
-                        .applicationAction(MacPackagingPipeline::writeAppInfoPlist)
+                        .applicationAction(MacPackagingPipeline::writeApplicationInfoPlist)
                         .addDependent(BuildApplicationTaskID.CONTENT).add();
 
         builder.task(MacBuildApplicationTaskID.SIGN)
@@ -172,16 +180,38 @@ static PackagingPipeline.Builder build(Optional<Package> pkg) {
                 disabledTasks.add(MacCopyAppImageTaskID.COPY_PACKAGE_FILE);
                 disabledTasks.add(CopyAppImageTaskID.COPY);
                 disabledTasks.add(PackageTaskID.RUN_POST_IMAGE_USER_SCRIPT);
-                builder.task(MacCopyAppImageTaskID.REPLACE_APP_IMAGE_FILE).applicationAction(createWriteAppImageFileAction()).add();
+                builder.task(MacCopyAppImageTaskID.REPLACE_APP_IMAGE_FILE)
+                        .applicationAction(createWriteAppImageFileAction()).add();
                 builder.appImageLayoutForPackaging(Package::appImageLayout);
-            } else if (p.isRuntimeInstaller() || ((MacPackage)p).predefinedAppImageSigned().orElse(false)) {
-                // If this is a runtime package or a signed predefined app image,
-                // don't create ".package" file and don't sign it.
+            } else if (p.isRuntimeInstaller()) {
+
+                builder.task(MacCopyAppImageTaskID.COPY_RUNTIME_JLILIB)
+                        .appImageAction(MacPackagingPipeline::copyJliLib).add();
+
+                final var predefinedRuntimeBundle = Optional.of(
+                        new MacBundle(p.predefinedAppImage().orElseThrow())).filter(MacBundle::isValid);
+
+                // Don't create ".package" file.
+                disabledTasks.add(MacCopyAppImageTaskID.COPY_PACKAGE_FILE);
+
+                if (predefinedRuntimeBundle.isPresent()) {
+                    // The predefined app image is a macOS bundle.
+                    // Disable all alterations of the input bundle, but keep the signing enabled.
+                    disabledTasks.addAll(List.of(MacCopyAppImageTaskID.values()));
+                    disabledTasks.remove(MacCopyAppImageTaskID.COPY_SIGN);
+                }
+
+                if (predefinedRuntimeBundle.map(MacBundle::isSigned).orElse(false) && !((MacPackage)p).app().sign()) {
+                    // The predefined app image is a signed bundle; explicit signing is not requested for the package.
+                    // Disable the signing, i.e. don't re-sign the input bundle.
+                    disabledTasks.add(MacCopyAppImageTaskID.COPY_SIGN);
+                }
+            } else if (((MacPackage)p).predefinedAppImageSigned().orElse(false)) {
+                // This is a signed predefined app image.
+                // Don't create ".package" file.
                 disabledTasks.add(MacCopyAppImageTaskID.COPY_PACKAGE_FILE);
+                // Don't sign the image.
                 disabledTasks.add(MacCopyAppImageTaskID.COPY_SIGN);
-//                if (p.isRuntimeInstaller()) {
-//                    builder.task(MacCopyAppImageTaskID.COPY_RUNTIME_INFO_PLIST).packageAction(MacPackagingPipeline::writeRuntimeRuntimeInfoPlist).add();
-//                }
             }
 
             for (final var taskId : disabledTasks) {
@@ -208,13 +238,27 @@ static Package createSignAppImagePackage(MacApplication app, BuildEnv env) {
 
     private static void copyAppImage(MacPackage pkg, AppImageDesc srcAppImage,
             AppImageDesc dstAppImage) throws IOException {
-        PackagingPipeline.copyAppImage(srcAppImage, dstAppImage, !pkg.predefinedAppImageSigned().orElse(false));
+
+        boolean predefinedAppImageSigned = pkg.predefinedAppImageSigned().orElse(false);
+
+        var inputRootDirectory = srcAppImage.resolvedAppImagelayout().rootDirectory();
+
+        if (pkg.isRuntimeInstaller() && MacBundle.isDirectoryMacBundle(inputRootDirectory)) {
+            // Building runtime package from the input runtime bundle.
+            // Copy the input bundle verbatim.
+            FileUtils.copyRecursive(
+                    inputRootDirectory,
+                    dstAppImage.resolvedAppImagelayout().rootDirectory(),
+                    LinkOption.NOFOLLOW_LINKS);
+        } else {
+            PackagingPipeline.copyAppImage(srcAppImage, dstAppImage, !predefinedAppImageSigned);
+        }
     }
 
     private static void copyJliLib(
-            AppImageBuildEnv<MacApplication, MacApplicationLayout> env) throws IOException {
+            AppImageBuildEnv<MacApplication, AppImageLayout> env) throws IOException {
 
-        final var runtimeMacOSDir = env.resolvedLayout().runtimeRootDirectory().resolve("Contents/MacOS");
+        final var runtimeBundle = runtimeBundle(env);
 
         final var jliName = Path.of("libjli.dylib");
 
@@ -223,8 +267,8 @@ private static void copyJliLib(
                     .filter(file -> file.getFileName().equals(jliName))
                     .findFirst()
                     .orElseThrow();
-            Files.createDirectories(runtimeMacOSDir);
-            Files.copy(jli, runtimeMacOSDir.resolve(jliName));
+            Files.createDirectories(runtimeBundle.macOsDir());
+            Files.copy(jli, runtimeBundle.macOsDir().resolve(jliName));
         }
     }
 
@@ -247,36 +291,47 @@ private static void writePkgInfoFile(
                 "APPL????".getBytes(StandardCharsets.ISO_8859_1));
     }
 
-    private static void writeRuntimeRuntimeInfoPlist(PackageBuildEnv<MacPackage, AppImageLayout> env) throws IOException {
-        writeRuntimeInfoPlist(env.pkg().app(), env.env(), env.resolvedLayout().rootDirectory());
-    }
-
-    private static void writeApplicationRuntimeInfoPlist(
-            AppImageBuildEnv<MacApplication, MacApplicationLayout> env) throws IOException {
-        writeRuntimeInfoPlist(env.app(), env.env(), env.resolvedLayout().runtimeRootDirectory());
-    }
+    private static void writeRuntimeInfoPlist(
+            AppImageBuildEnv<MacApplication, AppImageLayout> env) throws IOException {
 
-    private static void writeRuntimeInfoPlist(MacApplication app, BuildEnv env, Path runtimeRootDirectory) throws IOException {
+        final var app = env.app();
 
         Map<String, String> data = new HashMap<>();
         data.put("CF_BUNDLE_IDENTIFIER", app.bundleIdentifier());
         data.put("CF_BUNDLE_NAME", app.bundleName());
         data.put("CF_BUNDLE_VERSION", app.version());
         data.put("CF_BUNDLE_SHORT_VERSION_STRING", app.shortVersion().toString());
+        if (app.isRuntime()) {
+            data.put("CF_BUNDLE_VENDOR", app.vendor());
+        }
+
+        final String template;
+        final String publicName;
+        final String category;
+
+        if (app.isRuntime()) {
+            template = "Runtime-Info.plist.template";
+            publicName = "Info.plist";
+            category = "resource.runtime-info-plist";
+        } else {
+            template = "ApplicationRuntime-Info.plist.template";
+            publicName = "Runtime-Info.plist";
+            category = "resource.app-runtime-info-plist";
+        }
 
-        env.createResource("Runtime-Info.plist.template")
-                .setPublicName("Runtime-Info.plist")
-                .setCategory(I18N.getString("resource.runtime-info-plist"))
+        env.env().createResource(template)
+                .setPublicName(publicName)
+                .setCategory(I18N.getString(category))
                 .setSubstitutionData(data)
-                .saveToFile(runtimeRootDirectory.resolve("Contents/Info.plist"));
+                .saveToFile(runtimeBundle(env).infoPlistFile());
     }
 
-    private static void writeAppInfoPlist(
+    private static void writeApplicationInfoPlist(
             AppImageBuildEnv<MacApplication, MacApplicationLayout> env) throws IOException {
 
         final var app = env.app();
 
-        final var infoPlistFile = env.resolvedLayout().contentDirectory().resolve("Info.plist");
+        final var infoPlistFile = MacBundle.fromAppImageLayout(env.resolvedLayout()).infoPlistFile();
 
         Log.verbose(I18N.format("message.preparing-info-plist", PathUtils.normalizedAbsolutePathString(infoPlistFile)));
 
@@ -308,7 +363,7 @@ private static void writeAppInfoPlist(
                 .saveToFile(infoPlistFile);
     }
 
-    private static void sign(AppImageBuildEnv<MacApplication, MacApplicationLayout> env) throws IOException {
+    private static void sign(AppImageBuildEnv<MacApplication, AppImageLayout> env) throws IOException {
 
         final var app = env.app();
 
@@ -410,6 +465,14 @@ private static void addFaToUTExportedTypeDeclarations(XMLStreamWriter xml,
         }));
     }
 
+    private static MacBundle runtimeBundle(AppImageBuildEnv<MacApplication, AppImageLayout> env) {
+        if (env.app().isRuntime()) {
+            return new MacBundle(env.resolvedLayout().rootDirectory());
+        } else {
+            return new MacBundle(((MacApplicationLayout)env.resolvedLayout()).runtimeRootDirectory());
+        }
+    }
+
     private static class ApplicationIcon implements ApplicationImageTaskAction<MacApplication, MacApplicationLayout> {
         static Path getPath(Application app, ApplicationLayout appLayout) {
             return appLayout.desktopIntegrationDirectory().resolve(app.name() + ".icns");

src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/model/MacApplication.java

@@ -54,11 +54,13 @@ default DottedVersion shortVersion() {
 
     @Override
     default Path appImageDirName() {
+        final String suffix;
         if (isRuntime()) {
-            return Application.super.appImageDirName();
+            suffix = ".jdk";
         } else {
-            return Path.of(Application.super.appImageDirName().toString() + ".app");
+            suffix = ".app";
         }
+        return Path.of(Application.super.appImageDirName().toString() + suffix);
     }
 
     /**