CPack: Change CPACK_PRODUCTBUILD_DOMAINS default to true (CMP0161)

Fixes: #23351

14 files changed, 99 insertions, 3 deletions

diff --git a/Help/cpack_gen/productbuild.rst b/Help/cpack_gen/productbuild.rst
index 48a9b44..ee8a03f 100644
--- a/Help/cpack_gen/productbuild.rst
+++ b/Help/cpack_gen/productbuild.rst
@@ -91,8 +91,9 @@ macOS using ProductBuild:
  .. versionadded:: 3.23
 
  This option enables more granular control over where the product may be
- installed. When it is set to true, a ``domains`` element of the following
- form will be added to the productbuild Distribution XML:
+ installed. When it is set to true (see policy :policy:`CMP0161`), a
+ ``domains`` element of the following form will be added to the
+ productbuild Distribution XML:
 
  .. code-block:: xml
 
diff --git a/Help/manual/cmake-policies.7.rst b/Help/manual/cmake-policies.7.rst
index d37c855..bb6cfd4 100644
--- a/Help/manual/cmake-policies.7.rst
+++ b/Help/manual/cmake-policies.7.rst
@@ -57,6 +57,7 @@ Policies Introduced by CMake 3.29
 .. toctree::
    :maxdepth: 1
 
+   CMP0161: CPACK_PRODUCTBUILD_DOMAINS defaults to true. </policy/CMP0161>
    CMP0160: More read-only target properties now error when trying to set them. </policy/CMP0160>
    CMP0159: file(STRINGS) with REGEX updates CMAKE_MATCH_<n>. </policy/CMP0159>
    CMP0158: add_test() honors CMAKE_CROSSCOMPILING_EMULATOR only when cross-compiling. </policy/CMP0158>
diff --git a/Help/policy/CMP0161.rst b/Help/policy/CMP0161.rst
new file mode 100644
index 0000000..34bb64c
--- /dev/null
+++ b/Help/policy/CMP0161.rst
@@ -0,0 +1,36 @@
+CMP0161
+-------
+
+.. versionadded:: 3.29
+
+The :variable:`CPACK_PRODUCTBUILD_DOMAINS` variable defaults to true.
+
+Before CMake 3.29, the :variable:`CPACK_PRODUCTBUILD_DOMAINS` variable is
+unset by default.  When using the :cpack_gen:`CPack productbuild Generator`,
+this disables the use of the ``domains`` attribute in the productbuild
+Distribution XML, and falls back to the ``auth`` attribute instead.
+These attributes control where a productbuild package is allowed to be
+installed.  But the ``auth`` attribute has been deprecated by Apple,
+so projects should migrate to using ``domains`` instead.
+
+CMake 3.29 and above prefer to use a default value of true for
+:variable:`CPACK_PRODUCTBUILD_DOMAINS`, which means ``domains`` will be used
+by default unless the project explicitly sets
+:variable:`CPACK_PRODUCTBUILD_DOMAINS` to false.
+This policy provides compatibility with projects that enabled the
+:cpack_gen:`CPack productbuild Generator`, but did not explicitly set
+:variable:`CPACK_PRODUCTBUILD_DOMAINS`.
+
+The ``OLD`` behavior for this policy is to leave
+:variable:`CPACK_PRODUCTBUILD_DOMAINS` unset if it hasn't been set.
+The ``NEW`` behavior for this policy is to use a default value of true for
+:variable:`CPACK_PRODUCTBUILD_DOMAINS`.
+
+.. |INTRODUCED_IN_CMAKE_VERSION| replace:: 3.29
+.. |WARNS_OR_DOES_NOT_WARN| replace:: warns
+.. include:: STANDARD_ADVICE.txt
+Note that a warning will only be emitted if the
+:variable:`CPACK_BINARY_PRODUCTBUILD <CPACK_BINARY_<GENNAME>>` variable is
+set to true and the project is being built for an Apple platform.
+
+.. include:: DEPRECATED.txt
diff --git a/Help/release/dev/productbuild-domains-policy.rst b/Help/release/dev/productbuild-domains-policy.rst
new file mode 100644
index 0000000..2009453
--- /dev/null
+++ b/Help/release/dev/productbuild-domains-policy.rst
@@ -0,0 +1,5 @@
+productbuild-domains-policy
+---------------------------
+
+* The :variable:`CPACK_PRODUCTBUILD_DOMAINS` variable now defaults to true.
+  See policy :policy:`CMP0161`.
diff --git a/Modules/CPack.cmake b/Modules/CPack.cmake
index e7d8970..813ac3c 100644
--- a/Modules/CPack.cmake
+++ b/Modules/CPack.cmake
@@ -883,6 +883,24 @@ endif()
 # WiX specific variables
 _cpack_set_default(CPACK_WIX_SIZEOF_VOID_P "${CMAKE_SIZEOF_VOID_P}")
 
+# productbuild specific variables
+cmake_policy(GET CMP0161 _CPack_CMP0161)
+if("x${_CPack_CMP0161}x" STREQUAL "xNEWx")
+  _cpack_set_default(CPACK_PRODUCTBUILD_DOMAINS ON)
+elseif(APPLE AND CPACK_BINARY_PRODUCTBUILD AND
+       NOT DEFINED CPACK_PRODUCTBUILD_DOMAINS AND
+       NOT "x${_CPack_CMP0161}x" STREQUAL "xOLDx")
+  cmake_policy(GET_WARNING CMP0161 _CMP0161_warning)
+  message(AUTHOR_WARNING
+    "${_CMP0161_warning}\n"
+    "For compatibility, CPACK_PRODUCTBUILD_DOMAINS will remain unset. "
+    "Explicitly setting CPACK_PRODUCTBUILD_DOMAINS or setting policy CMP0161 "
+    "to NEW will prevent this warning."
+  )
+  unset(_CMP0161_warning)
+endif()
+unset(_CPack_CMP0161)
+
 # set sysroot so SDK tools can be used
 if(CMAKE_OSX_SYSROOT)
   _cpack_set_default(CPACK_OSX_SYSROOT "${_CMAKE_OSX_SYSROOT_PATH}")
diff --git a/Source/cmPolicies.h b/Source/cmPolicies.h
index e23e687..705314f 100644
--- a/Source/cmPolicies.h
+++ b/Source/cmPolicies.h
@@ -491,7 +491,9 @@ class cmMakefile;
   SELECT(                                                                     \
     POLICY, CMP0160,                                                          \
     "More read-only target properties now error when trying to set them.", 3, \
-    29, 0, cmPolicies::WARN)
+    29, 0, cmPolicies::WARN)                                                  \
+  SELECT(POLICY, CMP0161, "CPACK_PRODUCTBUILD_DOMAINS defaults to true.", 3,  \
+         29, 0, cmPolicies::WARN)
 
 #define CM_SELECT_ID(F, A1, A2, A3, A4, A5, A6) F(A1)
 #define CM_FOR_EACH_POLICY_ID(POLICY)                                         \
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-NEW-check.cmake b/Tests/RunCMake/CPackConfig/CMP0161-NEW-check.cmake
new file mode 100644
index 0000000..586fcf9
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-NEW-check.cmake
@@ -0,0 +1,3 @@
+include(${RunCMake_SOURCE_DIR}/check.cmake)
+
+test_variable(CPACK_PRODUCTBUILD_DOMAINS "ON")
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-NEW.cmake b/Tests/RunCMake/CPackConfig/CMP0161-NEW.cmake
new file mode 100644
index 0000000..cc4d34b
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-NEW.cmake
@@ -0,0 +1,2 @@
+cmake_policy(SET CMP0161 NEW)
+set(CPACK_BINARY_PRODUCTBUILD ON CACHE BOOL "" FORCE)
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-OLD-check.cmake b/Tests/RunCMake/CPackConfig/CMP0161-OLD-check.cmake
new file mode 100644
index 0000000..e3cb854
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-OLD-check.cmake
@@ -0,0 +1,5 @@
+include(${RunCMake_SOURCE_DIR}/check.cmake)
+
+if(DEFINED CPACK_PRODUCTBUILD_DOMANS)
+  message(FATAL_ERROR "CPACK_PRODUCTBUILD_DOMANS was defined, but it should not have been")
+endif()
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-OLD.cmake b/Tests/RunCMake/CPackConfig/CMP0161-OLD.cmake
new file mode 100644
index 0000000..4d47576
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-OLD.cmake
@@ -0,0 +1,2 @@
+cmake_policy(SET CMP0161 OLD)
+set(CPACK_BINARY_PRODUCTBUILD ON CACHE BOOL "" FORCE)
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-WARN-check.cmake b/Tests/RunCMake/CPackConfig/CMP0161-WARN-check.cmake
new file mode 100644
index 0000000..e3cb854
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-WARN-check.cmake
@@ -0,0 +1,5 @@
+include(${RunCMake_SOURCE_DIR}/check.cmake)
+
+if(DEFINED CPACK_PRODUCTBUILD_DOMANS)
+  message(FATAL_ERROR "CPACK_PRODUCTBUILD_DOMANS was defined, but it should not have been")
+endif()
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-WARN-stderr-darwin.txt b/Tests/RunCMake/CPackConfig/CMP0161-WARN-stderr-darwin.txt
new file mode 100644
index 0000000..5841ec7
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-WARN-stderr-darwin.txt
@@ -0,0 +1,12 @@
+^CMake Warning \(dev\) at [^
+]*/Modules/CPack\.cmake:[0-9]+ \(message\):
+  Policy CMP0161 is not set: CPACK_PRODUCTBUILD_DOMAINS defaults to true\.
+  Run "cmake --help-policy CMP0161" for policy details\.  Use the cmake_policy
+  command to set the policy and suppress this warning\.
+
+  For compatibility, CPACK_PRODUCTBUILD_DOMAINS will remain unset\.
+  Explicitly setting CPACK_PRODUCTBUILD_DOMAINS or setting policy CMP0161 to
+  NEW will prevent this warning\.
+Call Stack \(most recent call first\):
+  CMakeLists\.txt:[0-9]+ \(include\)
+This warning is for project developers\.  Use -Wno-dev to suppress it\.$
diff --git a/Tests/RunCMake/CPackConfig/CMP0161-WARN.cmake b/Tests/RunCMake/CPackConfig/CMP0161-WARN.cmake
new file mode 100644
index 0000000..f387c69
--- /dev/null
+++ b/Tests/RunCMake/CPackConfig/CMP0161-WARN.cmake
@@ -0,0 +1 @@
+set(CPACK_BINARY_PRODUCTBUILD ON CACHE BOOL "" FORCE)
diff --git a/Tests/RunCMake/CPackConfig/RunCMakeTest.cmake b/Tests/RunCMake/CPackConfig/RunCMakeTest.cmake
index 32c7296..1de640b 100644
--- a/Tests/RunCMake/CPackConfig/RunCMakeTest.cmake
+++ b/Tests/RunCMake/CPackConfig/RunCMakeTest.cmake
@@ -2,6 +2,9 @@ include(RunCMake)
 
 run_cmake(CMP0133-NEW)
 run_cmake(CMP0133-WARN)
+run_cmake(CMP0161-NEW)
+run_cmake(CMP0161-OLD)
+run_cmake(CMP0161-WARN)
 run_cmake(Simple)
 run_cmake(Default)
 run_cmake(Special)