1 files changed, 13 insertions, 6 deletions

diff --git a/share/qbs/modules/codesign/codesign.js b/share/qbs/modules/codesign/codesign.js
index 5aa303c9c..463e7cbb7 100644
--- a/share/qbs/modules/codesign/codesign.js
+++ b/share/qbs/modules/codesign/codesign.js
@@ -301,16 +301,14 @@ function prepareSign(project, product, inputs, outputs, input, output) {
         // If this is a framework, we need to sign its versioned directory
         var subpath = "";
         if (isBundle) {
-            var frameworkVersion = product.bundle.frameworkVersion;
-            if (frameworkVersion) {
+            var isFramework = product.bundle.packageType === "FMWK";
+            if (isFramework) {
                 subpath = product.bundle.contentsFolderPath;
                 subpath = subpath.substring(product.bundle.bundleName.length);
             }
         }
 
-        var args = product.codesign.codesignFlags || [];
-        args.push("--force");
-        args.push("--sign", actualSigningIdentity.SHA1);
+        var args = ["--force", "--sign", actualSigningIdentity.SHA1];
 
         // If signingTimestamp is undefined or empty, do not specify the flag at all -
         // this uses the system-specific default behavior
@@ -328,6 +326,9 @@ function prepareSign(project, product, inputs, outputs, input, output) {
             args.push("--entitlements", inputs["codesign.xcent"][j].filePath);
             break; // there should only be one
         }
+
+        args = args.concat(product.codesign.codesignFlags || []);
+
         args.push(outputFilePath + subpath);
         cmd = new Command(product.codesign.codesignPath, args);
         cmd.description = "codesign " + outputFileName
@@ -425,7 +426,7 @@ function prepareSigntool(project, product, inputs, outputs, input, output) {
     if (!product.codesign.enableCodeSigning)
         return cmds;
 
-    var args = ["sign"].concat(product.codesign.codesignFlags || []);
+    var args = ["sign"];
 
     var subjectName = product.codesign.subjectName;
     if (subjectName)
@@ -443,6 +444,10 @@ function prepareSigntool(project, product, inputs, outputs, input, output) {
     if (signingTimestamp)
         args.push("/tr", signingTimestamp);
 
+    var timestampAlgorithm = product.codesign.timestampAlgorithm;
+    if (timestampAlgorithm)
+        args.push("/td", timestampAlgorithm);
+
     var certificatePath = product.codesign.certificatePath;
     if (certificatePath)
         args.push("/f", certificatePath);
@@ -455,6 +460,8 @@ function prepareSigntool(project, product, inputs, outputs, input, output) {
     if (crossCertificatePath)
         args.push("/ac", crossCertificatePath);
 
+    args = args.concat(product.codesign.codesignFlags || []);
+
     var outputArtifact = outputs["codesign.signed_artifact"][0];
     args.push(outputArtifact.filePath);