Fix signing bundle with Gradle 8.1 with configuration cache (#3069)

* Fix signing bundle with Gradle 8.1 with configuration cache

Compose Gradle plugin was launching
`/usr/bin/security --find-identity` in a lazy property of
AbstractJPackageTask. Without the configuration cache
the computation was delayed to the execution phase.
However, configuration cache serializes all properties of
all configured tasks, so launching of `/usr/bin/security`
shifted to the configuration phase.
Gradle 8.1 started to throw an exception if an external process is
launched during configuration time.
This change explicitly moves the call to
`/usr/bin/security` to the execution phase.

Resolves #3060

* Turn off Gradle configuration cache for one test

gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/MacSigner.kt

@@ -55,28 +55,33 @@ internal class NoCertificateSigner(runTool: ExternalToolRunner) : MacSigner(runT
 internal class MacSignerImpl(
     override val settings: ValidatedMacOSSigningSettings,
     runTool: ExternalToolRunner
-) : MacSigner(runTool)  {
+) : MacSigner(runTool) {
-    private lateinit var signKey: String
+    @Transient
-
+    private var signKeyValue: String? = null
-    init {
-        runTool(
-            MacUtils.security,
-            args = listOfNotNull(
-                "find-certificate",
-                "-a",
-                "-c",
-                settings.fullDeveloperID,
-                settings.keychain?.absolutePath
-            ),
-            processStdout = { signKey = matchCertificates(it) }
-        )
-    }
 
     override fun sign(
         file: File,
         entitlements: File?,
         forceEntitlements: Boolean
     ) {
+        // sign key calculation is delayed to avoid
+        // creating an external process during the configuration
+        // phase, which became an error in Gradle 8.1
+        // https://github.com/JetBrains/compose-multiplatform/issues/3060
+        val signKey = signKeyValue ?: run {
+            runTool(
+                MacUtils.security,
+                args = listOfNotNull(
+                    "find-certificate",
+                    "-a",
+                    "-c",
+                    settings.fullDeveloperID,
+                    settings.keychain?.absolutePath
+                ),
+                processStdout = { signKeyValue = matchCertificates(it) }
+            )
+            signKeyValue!!
+        }
         runTool.unsign(file)
         runTool.sign(
             file = file,

gradle-plugins/compose/src/test/kotlin/org/jetbrains/compose/test/tests/integration/DesktopApplicationTest.kt

@@ -333,6 +333,15 @@ class DesktopApplicationTest : GradlePluginTestBase() {
         }
     }
 
+    @Test
+    fun testMacSignConfiguration() {
+        Assumptions.assumeTrue(currentOS == OS.MacOS)
+
+        with(testProject(TestProjects.macSign)) {
+            gradle("--dry-run", ":createDistributable")
+        }
+    }
+
     @Test
     @Disabled
     // the test does not work on CI and locally unless test keychain is opened manually

gradle-plugins/compose/src/test/kotlin/org/jetbrains/compose/test/tests/integration/GradlePluginTest.kt

@@ -20,7 +20,14 @@ import org.junit.jupiter.api.Test
 
 class GradlePluginTest : GradlePluginTestBase() {
     @Test
-    fun skikoWasm() = with(testProject(TestProjects.skikoWasm)) {
+    fun skikoWasm() = with(
+        testProject(
+            TestProjects.skikoWasm,
+            // configuration cache is disabled as a temporary workaround for KT-58057
+            // todo: enable once KT-58057 is fixed
+            testEnvironment = defaultTestEnvironment.copy(useGradleConfigurationCache = false)
+        )
+    ) {
         gradle(":build").checks {
             check.taskSuccessful(":unpackSkikoWasmRuntimeJs")
             check.taskSuccessful(":compileKotlinJs")

gradle-plugins/compose/src/test/kotlin/org/jetbrains/compose/test/utils/TestProject.kt

@@ -19,6 +19,7 @@ data class TestEnvironment(
     val composeCompilerPlugin: String? = null,
     val composeCompilerArgs: String? = null,
     val composeVerbose: Boolean = true,
+    val useGradleConfigurationCache: Boolean = TestProperties.gradleConfigurationCache,
 ) {
     private val placeholders = linkedMapOf(
         "COMPOSE_GRADLE_PLUGIN_VERSION_PLACEHOLDER" to composeGradlePluginVersion,
@@ -76,7 +77,7 @@ class TestProject(
     }
 
     internal fun gradle(vararg args: String): BuildResult {
-        if (TestProperties.gradleConfigurationCache) {
+        if (testEnvironment.useGradleConfigurationCache) {
             if (GradleVersion.version(TestProperties.gradleVersionForTests).baseVersion < GradleVersion.version("8.0")) {
                 // Gradle 7.* does not use the configuration cache in the same build.
                 // In other words, if cache misses, Gradle performs configuration,
@@ -106,7 +107,7 @@ class TestProject(
     private fun gradleRunner(args: Array<out String>): GradleRunner {
         val allArgs = args.toMutableList()
         allArgs.addAll(additionalArgs)
-        if (TestProperties.gradleConfigurationCache) {
+        if (testEnvironment.useGradleConfigurationCache) {
             allArgs.add("--configuration-cache")
         }
 

gradle-plugins/gradle.properties

@@ -10,7 +10,7 @@ compose.tests.compiler.compatible.kotlin.version=1.8.20
 # The latest version of Kotlin compatible with compose.tests.compiler.version for JS target. Used only on CI.
 compose.tests.js.compiler.compatible.kotlin.version=1.8.20
 # __SUPPORTED_GRADLE_VERSIONS__
-compose.tests.gradle.versions=7.3.3, 8.0.2
+compose.tests.gradle.versions=7.3.3, 8.1
 
 # A version of Gradle plugin, that will be published,
 # unless overridden by COMPOSE_GRADLE_PLUGIN_VERSION env var.