From 4302a306472ea759d994b42f06b57150a13fd3d4 Mon Sep 17 00:00:00 2001 From: deepend Date: Wed, 14 Oct 2026 17:54:45 -0600 Subject: [PATCH] rebuild macos build --- .github/workflows/macos-build.yml | 154 ++++++++ .gitignore | 6 + meson.build | 20 +- meson_options.txt | 4 + packaging/macos/Brewfile | 15 + packaging/macos/README.md | 335 ++++++++++++++++ packaging/macos/build.py | 71 ++++ packaging/macos/bundle.py | 358 ++++++++++++++++++ packaging/macos/direct.entitlements | 6 + packaging/macos/release.py | 220 +++++++++++ packaging/macos/smoke.py | 49 +++ .../macos/store-experimental.entitlements | 10 + packaging/macos/tests/test_bundle.py | 125 ++++++ packaging/macos/tests/test_release.py | 153 ++++++++ src/common/macos.c | 127 +++++++ src/common/macos.h | 6 + src/common/meson.build | 15 +- src/common/zoitechat.c | 7 + src/fe-gtk/fe-gtk.c | 20 +- src/fe-gtk/meson.build | 16 + src/fe-gtk/notifications/notification-osx.m | 89 +++-- src/fe-gtk/sexy-spell-entry.c | 17 +- .../test-theme-application-input-style.c | 8 + src/fe-text/fe-text.c | 11 +- 24 files changed, 1798 insertions(+), 44 deletions(-) create mode 100644 .github/workflows/macos-build.yml create mode 100644 packaging/macos/Brewfile create mode 100644 packaging/macos/README.md create mode 100644 packaging/macos/build.py create mode 100644 packaging/macos/bundle.py create mode 100644 packaging/macos/direct.entitlements create mode 100644 packaging/macos/release.py create mode 100644 packaging/macos/smoke.py create mode 100644 packaging/macos/store-experimental.entitlements create mode 100644 packaging/macos/tests/test_bundle.py create mode 100644 packaging/macos/tests/test_release.py create mode 100644 src/common/macos.c create mode 100644 src/common/macos.h diff --git a/.github/workflows/macos-build.yml b/.github/workflows/macos-build.yml new file mode 100644 index 00000000..40aba025 --- /dev/null +++ b/.github/workflows/macos-build.yml @@ -0,0 +1,154 @@ +name: macOS build + +on: + workflow_dispatch: + inputs: + sign_and_notarize: + description: 'Sign with Developer ID and notarize using release credentials' + type: boolean + default: false + push: + branches: [master] + tags: ['v*'] + paths: + - 'src/**' + - 'plugins/**' + - 'data/**' + - 'tools/**' + - 'po/**' + - 'meson*' + - 'VERSION' + - 'packaging/macos/**' + - '.github/workflows/macos-build.yml' + pull_request: + paths: + - 'src/**' + - 'plugins/**' + - 'data/**' + - 'tools/**' + - 'po/**' + - 'meson*' + - 'VERSION' + - 'packaging/macos/**' + - '.github/workflows/macos-build.yml' + +permissions: + contents: read + +jobs: + build: + if: >- + github.event_name == 'pull_request' || + (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) || + (github.event_name == 'workflow_dispatch' && !inputs.sign_and_notarize) + name: Native ${{ matrix.arch }} bundle + strategy: + fail-fast: false + matrix: + include: + - runner: macos-15 + arch: arm64 + - runner: macos-15-intel + arch: x86_64 + runs-on: ${{ matrix.runner }} + timeout-minutes: 90 + env: + HOMEBREW_NO_AUTO_UPDATE: '1' + steps: + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - name: Install native dependencies + run: brew bundle --file packaging/macos/Brewfile + - name: Test packaging logic + run: python3 -m unittest discover -s packaging/macos/tests -v + - name: Build and test application + run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}' + - name: Verify relocated startup + run: python3 packaging/macos/smoke.py dist/ZoiteChat.app + - name: Create artifact preserving the application signature + run: ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-${{ matrix.arch }}.zip + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: ZoiteChat-macos-${{ matrix.arch }} + path: dist/ZoiteChat-${{ matrix.arch }}.zip + if-no-files-found: error + - name: Upload build logs on failure + if: failure() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: ZoiteChat-macos-${{ matrix.arch }}-logs + path: build-macos/meson-logs/ + if-no-files-found: ignore + + release: + name: Signed and notarized ${{ matrix.arch }} release + if: >- + (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || + (github.event_name == 'workflow_dispatch' && inputs.sign_and_notarize && github.ref == 'refs/heads/master') + environment: macos-release + strategy: + fail-fast: false + matrix: + include: + - runner: macos-15 + arch: arm64 + - runner: macos-15-intel + arch: x86_64 + runs-on: ${{ matrix.runner }} + timeout-minutes: 180 + env: + HOMEBREW_NO_AUTO_UPDATE: '1' + steps: + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false + - name: Validate release settings before building + env: + MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }} + MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} + MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }} + APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} + APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} + APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} + run: python3 packaging/macos/release.py --check-config + - name: Install native dependencies + run: brew bundle --file packaging/macos/Brewfile + - name: Test packaging and release logic + run: python3 -m unittest discover -s packaging/macos/tests -v + - name: Build and test application + run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}' + - name: Verify relocated startup + run: python3 packaging/macos/smoke.py dist/ZoiteChat.app + - name: Sign, notarize, staple and verify release + env: + MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }} + MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} + MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }} + APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} + APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} + APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} + run: >- + python3 packaging/macos/release.py + --app dist/ZoiteChat.app + --output dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip + --diagnostics dist/notarization + --notary-timeout 60m + - name: Upload signed and notarized application + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: ZoiteChat-macos-${{ matrix.arch }}-signed-notarized + path: dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip + if-no-files-found: error + - name: Upload notarization diagnostics + if: always() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: ZoiteChat-macos-${{ matrix.arch }}-notarization-log + path: dist/notarization/*.json + if-no-files-found: ignore + - name: Upload build logs on failure + if: failure() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: ZoiteChat-macos-${{ matrix.arch }}-release-build-logs + path: build-macos/meson-logs/ + if-no-files-found: ignore diff --git a/.gitignore b/.gitignore index 0b2b4750..cba77ef4 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,9 @@ osx/.ZoiteChat.app *.dmg *.VC.db *.VC.opendb + +# Native macOS packaging output +/build-macos*/ +/dist/ +/packaging/macos/__pycache__/ +/packaging/macos/tests/__pycache__/ diff --git a/meson.build b/meson.build index 7119a8e4..a658677b 100644 --- a/meson.build +++ b/meson.build @@ -13,7 +13,9 @@ gnome = import('gnome') cc = meson.get_compiler('c') -libgio_dep = dependency('gio-2.0', version: '>= 2.36.0') +# The relocatable macOS runtime sets the GIO TLS database explicitly. +libgio_dep = dependency('gio-2.0', + version: host_machine.system() == 'darwin' ? '>= 2.60.0' : '>= 2.36.0') libgmodule_dep = dependency('gmodule-2.0') libcanberra_dep = dependency('libcanberra', version: '>= 0.22', @@ -29,7 +31,13 @@ else required: get_option('tls')) endif +gtk_mac_dep = disabler() +if host_machine.system() == 'darwin' and get_option('gtk-frontend') + gtk_mac_dep = dependency('gtk-mac-integration-gtk3', required: get_option('mac-integration')) +endif + config_h = configuration_data() +config_h.set('HAVE_GTK_MAC', host_machine.system() == 'darwin' and gtk_mac_dep.found()) config_h.set_quoted('PACKAGE_VERSION', meson.project_version()) config_h.set_quoted('PACKAGE_NAME', meson.project_name()) config_h.set_quoted('GETTEXT_PACKAGE', 'zoitechat') @@ -99,6 +107,12 @@ global_cflags = [ '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_36', '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_36', ] +if host_machine.system() == 'darwin' + global_cflags = [ + '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_60', + '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_60', + ] +endif test_cflags = [ '-funsigned-char', '-Wno-conversion', @@ -159,6 +173,10 @@ foreach ldflag : test_ldflags global_ldflags += ldflag endif endforeach +if host_machine.system() == 'darwin' + # Leave room for install_name_tool to rewrite packaged dependencies. + global_ldflags += '-Wl,-headerpad_max_install_names' +endif add_project_link_arguments(global_ldflags, language: 'c') subdir('src') diff --git a/meson_options.txt b/meson_options.txt index 04b0265e..9153eba5 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -23,6 +23,10 @@ option('appindicator', type: 'feature', value: 'auto', description: 'Use Ayatana/AppIndicator-based tray backend for GTK frontend (non-Windows only)' ) +# macOS only; ignored by other platforms. +option('mac-integration', type: 'feature', value: 'auto', + description: 'Native macOS menu bar, Dock and application lifecycle') + # Install options option('dbus-service-use-appid', type: 'boolean', value: false, description: 'Rename dbus service to match app-id, required for Flatpak' diff --git a/packaging/macos/Brewfile b/packaging/macos/Brewfile new file mode 100644 index 00000000..96888746 --- /dev/null +++ b/packaging/macos/Brewfile @@ -0,0 +1,15 @@ +brew "meson" +brew "ninja" +brew "pkgconf" +brew "python" +brew "gettext" +brew "gtk+3" +brew "gtk-mac-integration" +brew "libarchive" +brew "openssl@3" +brew "lua" +brew "librsvg" +brew "glib-networking" +brew "adwaita-icon-theme" +brew "enchant" +brew "ca-certificates" diff --git a/packaging/macos/README.md b/packaging/macos/README.md new file mode 100644 index 00000000..5c3f09ca --- /dev/null +++ b/packaging/macos/README.md @@ -0,0 +1,335 @@ +# Native macOS build and distribution + +This builds GTK3 with the native Quartz backend, macOS menus/Dock integration, +UserNotifications, translations, bundled emoji, TLS, image loaders and supported +native plugins. It creates a self-contained `ZoiteChat.app`; end users do not +need Homebrew, XQuartz or Python. No system-wide ZoiteChat installation occurs. + +The source changes are conditional on Darwin. Windows and Linux retain their +existing notification backends and feature defaults. This adds a separate +macOS workflow; it does not replace existing workflows. + +## 1. Install build prerequisites + +Use a Mac with a currently supported macOS release and native Homebrew. On Apple +Silicon, use ARM Homebrew (`/opt/homebrew`), not Intel Homebrew under Rosetta. +Intel builds use Intel Homebrew (`/usr/local`). Install Xcode command-line tools +and Homebrew from https://brew.sh if absent. Full current Xcode is recommended +for distribution and needed to meet the current App Store submission SDK rules. + +```sh +xcode-select --install +# Run once if the command-line tools are not installed; let installation finish. + +cd /path/to/zoitechat +brew bundle --file packaging/macos/Brewfile +python3 packaging/macos/build.py +open dist/ZoiteChat.app +``` + +The build compiles the app, runs its Meson tests, stages an installation within +`build-macos/macos-stage`, bundles and rewrites every non-system Mach-O dependency, +creates the icon and plist, audits the result, and signs it ad hoc for local use. +It refuses to overwrite an existing output app. For another build, choose a new +output path, or explicitly delete your old generated app before rebuilding: + +```sh +python3 packaging/macos/build.py --output dist/ZoiteChat-test2.app --build-number 2 +``` + +The same build directory can be reconfigured. Use a different build directory +for another architecture or the experimental store variant. Do not change +architectures within one Meson build directory. + +Homebrew packages change over time; this is a repeatable procedure, not a +bit-for-bit reproducible dependency lock. The bundle records dependency versions +in `Contents/Resources/homebrew-dependencies.json`. Retain that record and the +release's source commit. For a reproducible release, archive the exact dependency +sources and build them in a controlled prefix, or maintain pinned Homebrew formulae. + +## 2. Verify portability and behavior + +```sh +python3 -m unittest discover -s packaging/macos/tests -v +python3 packaging/macos/bundle.py audit dist/ZoiteChat.app +python3 packaging/macos/smoke.py dist/ZoiteChat.app +``` + +The smoke check copies the app to a path containing spaces, verifies its signature, +runs `--version`, and keeps an isolated GUI process alive for ten seconds without +connecting to IRC. It tests startup, not interaction or long-running stability. + +The audit verifies the entire dependency closure, including GTK image/input +modules, GIO TLS, Enchant providers, OpenSSL providers and ZoiteChat plugins. It +fails on missing libraries, external symlinks/search paths, architecture mismatches +or unresolved load commands. The minimum macOS version in the plist is derived +from **all** bundled binaries, including Homebrew libraries. Lowering that plist +value does not make newer dependency bottles run on an older Mac. + +Before releasing, test on a second Mac without Homebrew installed: + +- Launch from Finder and from a relocated/read-only location; verify Dock and + menu bar, preferences persistence, dark/light themes and normal shutdown. +- Connect with verified TLS, exercise SASL authentication and reconnect. +- Send Unicode/emoji, render SVG/PNG/JPEG icons/images, and test HTTPS image previews. +- Verify clipboard shortcuts, input methods, notifications/permission denial, + detach/reattach tabs, focus changes, unread highlights and notification clicks. +- Send/receive/resume DCC, write downloads and logs, import/export themes/settings. +- Test FiSH, Lua and DCC checksum plugins in the direct build. +- Exercise accessibility with VoiceOver and keyboard-only navigation. + +Direct builds include Lua, FiSH and checksum, and retain the plugin loader. +Python/Perl are explicitly not bundled: reliable redistribution requires packaging +and auditing their interpreter runtimes, standard libraries and extensions. +Linux `/proc`/PCI sysinfo is not built on macOS. These are macOS build choices; +other platforms' plugin defaults are unchanged. macOS uses the existing password +storage fallback; this patch does not add a Keychain backend. Audit credentials +storage before adopting a stronger macOS security claim. + +Desktop URL registration (`irc://` in Finder/browser) is not advertised by the +plist; command-line IRC URLs continue to work. A native open-URL event handler +and single-instance forwarding need separate integration before registering those +schemes. AppIndicator and Linux D-Bus scripting/single-instance support are not +used on macOS. + +## 3. Sign and notarize for direct downloads + +Local ad-hoc builds are for testing; they are not notarized releases. For public +release, enroll in Apple's Developer Program, install your **Developer ID +Application** certificate with its private key, then sign using that identity. +Use your actual certificate identity in place of the example: + +```sh +python3 packaging/macos/bundle.py sign dist/ZoiteChat.app \ + --identity 'Developer ID Application: YOUR NAME (TEAMID)' \ + --entitlements packaging/macos/direct.entitlements + +# Store credentials once in your login Keychain; enter your own values interactively. +xcrun notarytool store-credentials ZoiteChat-notary + +ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-notarization.zip +xcrun notarytool submit dist/ZoiteChat-notarization.zip \ + --keychain-profile ZoiteChat-notary --wait + +# Only after notarization has succeeded: +xcrun stapler staple dist/ZoiteChat.app +xcrun stapler validate dist/ZoiteChat.app +spctl --assess --type execute --verbose=2 dist/ZoiteChat.app + +ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-macos.zip +``` + +Signing runs inside-out, verifies the final bundle and enables hardened runtime. +It does not use `codesign --deep` to sign. `--deep` is used only for verification. +The direct entitlement allows users' independently signed native plugins; it +relaxes library validation, not the entire hardened runtime. No JIT or executable +memory entitlements are added. Do not change bundle contents after signing; signing +again is required after any code/resource edit. Stapling is Apple's supported +post-signing operation. + +Publish exact corresponding source for ZoiteChat and satisfy the applicable +licenses of each bundled dependency. Notices and dependency metadata are included, +but those alone do not satisfy every source-distribution obligation. Review the +notarization log if rejected; the script does not silently bypass Gatekeeper. + +### Automate signing and notarization with GitHub Actions + +The workflow now has a separate signed/notarized release job for both +architectures. It uses Developer ID distribution for direct downloads, not Mac +App Store signing. You can manage it from Windows/Linux; GitHub's macOS runners +perform all signing, notarization and stapling. + +Prepare these repository Actions secrets under **Settings → Secrets and +variables → Actions**, or store them as environment secrets in **macos-release**. +The certificate setting names are unchanged from the original instructions. +The three `APPLE_API_*` settings are new notarization credentials: + +| Name | Type | Value | +| --- | --- | --- | +| `MACOS_CERTIFICATE_P12_BASE64` | Secret | Base64-encoded Developer ID Application `.p12`, including its private key | +| `MACOS_CERTIFICATE_PASSWORD` | Secret | Password used to export that `.p12` | +| `MACOS_SIGNING_IDENTITY` | Variable, or Secret | Exact `Developer ID Application: YOUR NAME (TEAMID)` identity; the matching certificate's SHA-1 fingerprint is also accepted | +| `APPLE_API_KEY_P8` | Secret | Entire plain-text App Store Connect **Team API key** `.p8` file, including PEM header/footer and newlines | +| `APPLE_API_KEY_ID` | Secret | That API key's Key ID | +| `APPLE_API_ISSUER_ID` | Secret | The Team API key's Issuer ID UUID; this is **not** your Apple Team ID | + +Repository variables are under the **Variables** tab. If the identity is entered +as both a variable and a secret, the variable takes precedence. No separate +keychain password is needed; the job generates a temporary random password. +The `.p8` is the notarization API key; it does not replace the signing `.p12`. +No Apple ID password or app-specific password is used by this configuration. + +To obtain the API key, open **App Store Connect → Users and Access → Integrations +→ App Store Connect API → Team Keys → Generate API Key**. Choose **Developer** +access for notarization. If API access is not enabled, the Account Holder must +request it first. Download the `.p8` and record the Key ID and Issuer ID. Use a +**Team** key with this workflow: individual API keys use different authentication +and are not supported by this issuer-based configuration. Apple allows the +private key download only once, so retain your copy securely. + +For the certificate, export the Developer ID Application identity (certificate +plus private key) from Keychain Access as a password-protected `.p12`. +If you generated the CSR with OpenSSL on Linux/WSL, you can also create it there. +Assuming Apple's downloaded DER certificate has been saved as +`developerID_application.cer`, and you retained `zoitechat-signing.key`: + +```sh +openssl x509 -inform DER -in developerID_application.cer \ + -out zoitechat-signing.pem +openssl pkcs12 -export -inkey zoitechat-signing.key \ + -in zoitechat-signing.pem -out ZoiteChat-signing.p12 + +# Enter the existing private-key password, then choose the .p12 export password. +# Copy the resulting Base64 text into MACOS_CERTIFICATE_P12_BASE64: +openssl base64 -A -in ZoiteChat-signing.p12 -out ZoiteChat-signing.p12.base64 + +# Read the certificate's commonName to obtain MACOS_SIGNING_IDENTITY: +openssl x509 -in zoitechat-signing.pem -noout -subject -nameopt multiline +``` + +Upload only the public CSR to Apple. Put the `.p12` Base64, export password and +API credentials in GitHub settings, never in the repository or build artifacts. + +Once these patches are committed to `master` and the settings are ready: + +1. Open **Actions → macOS build → Run workflow**. +2. Select **master** and enable **Sign with Developer ID and notarize using + release credentials**. +3. Run the workflow. It creates separate Apple Silicon and Intel release jobs. +4. After success, download `ZoiteChat-macos-arm64-signed-notarized` or + `ZoiteChat-macos-x86_64-signed-notarized`. The ZIP inside contains the signed, + stapled app. Actions artifacts wrap it in their own download archive. + +A push of a `v*` tag also triggers the signed release jobs automatically, so wait +until credentials are configured before pushing a release tag. Normal branch +pushes, pull requests and manual runs with the checkbox off continue to build +ad-hoc test artifacts without any signing secrets. Manual credentialed releases +are restricted to `master`; pull requests cannot invoke the release job. +Missing/malformed release settings fail before the Homebrew/build steps rather +than producing an unsigned artifact marked as a release. + +The release jobs use the GitHub environment **macos-release**. Repository secrets +work with it; environment secrets can override them. Configure environment +branch/tag restrictions or required reviewers if that fits your repository's +release process. This workflow does not automatically create a GitHub Release, +publish to zoitechat.org, or upload to App Store Connect; it produces downloadable +signed/notarized artifacts for you to publish. + +The job imports the `.p12` into a temporary keychain, installs Apple's public +Developer ID intermediate certificates, verifies a valid matching identity, +and signs inside-out with hardened runtime and the direct plugin entitlement. +It uses the existing bundle audit and then submits a ZIP with `notarytool`. +After Apple reports **Accepted**, it staples the ticket to the `.app`, verifies +stapling/signatures and Gatekeeper acceptance, and creates a **new** final ZIP. +Private credential files and the temporary keychain are cleaned up on normal +success/failure paths; hosted runner VMs are also discarded after the job. + +The default Apple wait limit is **60 minutes** within a **180-minute** release +job. A rejected, failed or still-pending submission produces no final release +ZIP. The `ZoiteChat-macos--notarization-log` artifact retains the submission +ID, status and Apple's available diagnostic log. First submissions can take +longer; check the saved ID with `notarytool info` and your API credentials. An +accepted submission still requires stapling and repackaging before publication; +rerunning this workflow starts a new build and submission. To increase the wait +limit, update `--notary-timeout` and allow adequate job timeout for build plus wait. + +Both architecture builds receive the same bundle build number for one workflow +run. The API credentials are supplied only to the config-check/release steps, +not to Homebrew, compiler tests, ordinary builds or pull-request jobs. + +## 4. Mac App Store: experimental groundwork, not submission-ready + +A working direct-download app is not sufficient for App Store submission. This +repository inherits GPL-2.0-or-later code from XChat/HexChat and other contributors. +App Store terms and GPL obligations require a licensing review; do not assume +that signing, a custom EULA, or relicensing only your new changes resolves rights +to inherited code. This patch changes no licenses or copyright permissions. + +An isolated sandbox-test build is provided: + +```sh +python3 packaging/macos/build.py --store-experimental \ + --build-dir build-macos-store --output dist/ZoiteChat-store-test.app \ + --build-number 1 + +# Local sandbox experimentation (not an uploadable distribution signature): +python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \ + --identity - --entitlements packaging/macos/store-experimental.entitlements +open dist/ZoiteChat-store-test.app +``` + +The separate store variant excludes loadable plugins and scripting runtimes. +The template grants sandboxed client/server networking, user-selected files and +Downloads. The direct version retains its plugin functionality. This is an +explicit experimental variant, not a change to Windows/Linux or direct builds. + +Before a store package can be regarded as a release candidate: + +1. Resolve the inherited GPL/dependency-license distribution question and review + Apple's current SDK, content/chat moderation, privacy and accessibility rules. +2. Register `org.Zoitechat` (or change the plist identifier consistently if already + owned by another developer), create App Store Connect metadata, and choose a + unique incrementing build number. Use a stable release, not a `-dev` snapshot. +3. Test sandboxed settings/logs, notifications, SASL/TLS, HTTPS and DCC on a real + Mac. GTK dialogs are not assumed to grant Powerbox access. Add native + `NSOpenPanel`/`NSSavePanel` integration and security-scoped bookmarks for + persistent access to user-selected files. The entitlement template alone does + not solve persistent file access. `/EXEC`, custom external commands, user + plugin loading and arbitrary external paths cannot be promised under sandbox. +4. Add required privacy manifest declarations based on an actual API audit of the + app and dependencies; do not submit an invented empty compliance declaration. +5. Obtain matching App Store distribution application/installer certificates and + a matching provisioning profile. Generate team-specific signing entitlements + from the profile with Xcode; do not use Developer ID or the generic local-test + template as a store distribution identity/profile. +6. Embed the matching profile as `Contents/embedded.provisionprofile` **before** + final signing. Sign embedded libraries with the distribution identity, then + the app with its profile-authorized entitlements (use `bundle.py sign` with + that identity and generated entitlement file). Package with Apple's + `productbuild`, validate and upload with Transporter/App Store Connect, then + test the App Store processed build via TestFlight before submission. + +Example **after those prerequisites are satisfied**: + +```sh +# Use the actual prepared profile and team-specific entitlements: +cp /path/to/ZoiteChat.provisionprofile \ + dist/ZoiteChat-store-test.app/Contents/embedded.provisionprofile +python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \ + --identity 'YOUR APP STORE APPLICATION CERTIFICATE IDENTITY' \ + --entitlements /path/to/ZoiteChat-distribution.entitlements +productbuild --component dist/ZoiteChat-store-test.app /Applications \ + --sign 'YOUR APP STORE INSTALLER CERTIFICATE IDENTITY' dist/ZoiteChat-store.pkg +``` + +No App Store approval, sandbox compatibility or legal compatibility is asserted. +For an initial macOS release, the signed/notarized direct build is the practical +path while those issues are resolved. + +## 5. CI and architecture support + +`.github/workflows/macos-build.yml` adds independent Apple Silicon and Intel jobs. +Ordinary jobs install prerequisites, run tests, create/audit/ad-hoc-sign the +bundle, check relocated startup and upload test ZIPs. They need no Apple secrets. +The separate release jobs add Developer ID signing, Apple notarization, stapling +and final verification. Only their successful output is named signed/notarized. + +Homebrew may build unsupported Intel bottles from source; that can be slower. +The workflow uses native runners and does not claim a universal application. +Do not merge only the main executable with `lipo`: a universal release must merge +and validate every bundled dylib, module and plugin plus matching resources. +Signing must happen after that merge. Publish separate architecture downloads +until a full universal dependency pipeline is available. + +## References + +- GTK on macOS: https://www.gtk.org/docs/installations/macos +- GTK macOS backend: https://docs.gtk.org/gtk3/macos.html +- Apple distribution signing: https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac +- Apple packaging: https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution +- GitHub certificate import: https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications +- Apple notarization authentication: https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool +- App Store Connect API keys: https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/ +- Apple review rules (especially 1.2 and 2.4.5): https://developer.apple.com/app-store/review/guidelines/ +- Apple sandbox file access: https://developer.apple.com/documentation/security/accessing-files-from-the-macos-app-sandbox +- FSF discussion of GPL and App Store terms (historical, not a current legal determination): https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement diff --git a/packaging/macos/build.py b/packaging/macos/build.py new file mode 100644 index 00000000..50343a78 --- /dev/null +++ b/packaging/macos/build.py @@ -0,0 +1,71 @@ +#!/usr/bin/env python3 +"""Compile, test, stage and package ZoiteChat on the host Mac.""" +from __future__ import annotations + +import argparse +import os +from pathlib import Path +import platform +import shutil +import subprocess +import sys + +from bundle import ROOT, package, run + + +def main() -> None: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--build-dir", type=Path, default=Path("build-macos")) + parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat.app")) + parser.add_argument("--build-number", default="1") + parser.add_argument("--store-experimental", action="store_true", help="Build a separate sandbox test variant without loadable plugins; not submission approval") + args = parser.parse_args() + if platform.system() != "Darwin": + parser.error("Build on macOS; cross-compiling from Linux is not supported") + if args.output.exists(): + parser.error("Output already exists; use a new --output or explicitly remove the old app") + build = args.build_dir.resolve() + if build == ROOT or ROOT.is_relative_to(build): + parser.error("Build directory must not contain the source checkout") + run("xcrun", "--find", "clang") + env = os.environ.copy() + prefixes = [Path(run("brew", "--prefix", name)) for name in ("gettext", "openssl@3", "libarchive", "lua", "gtk+3", "gtk-mac-integration")] + brew = Path(run("brew", "--prefix")) + # Keg-only gettext, OpenSSL and libarchive are not necessarily in PATH/pkg-config. + env["PATH"] = os.pathsep.join([str(p / "bin") for p in prefixes] + [str(brew / "bin"), env.get("PATH", "")]) + env["PKG_CONFIG_PATH"] = os.pathsep.join([str(p / "lib/pkgconfig") for p in prefixes] + [str(brew / "lib/pkgconfig"), str(brew / "share/pkgconfig"), env.get("PKG_CONFIG_PATH", "")]) + # Native dependency bottles determine the true deployment target; the bundle + # auditor derives the final minimum rather than promising an arbitrary old OS. + env.setdefault("MACOSX_DEPLOYMENT_TARGET", "11.0") + backend = run("pkg-config", "--variable=targets", "gtk+-3.0", env=env).split() + if "quartz" not in backend: + parser.error(f"GTK must provide the native Quartz backend, got {backend}") + # Do not silently select an XQuartz GTK stack or mix Intel/ARM Homebrew prefixes. + machine = platform.machine() + if machine not in ("arm64", "x86_64"): + parser.error(f"Unsupported architecture: {machine}") + options = [ + "--prefix=/", "--libdir=lib", "--buildtype=release", "-Dgtk-frontend=true", + "-Dtext-frontend=false", "-Dmac-integration=enabled", "-Ddbus=disabled", + "-Dlibcanberra=disabled", "-Dappindicator=disabled", "-Dinstall-appdata=false", + "-Dwith-sysinfo=false", "-Dwith-python=false", "-Dwith-perl=false", + "-Dwith-lua=lua", "-Dwith-fishlim=true", "-Dwith-checksum=true", + "-Dplugin=" + ("false" if args.store_experimental else "true"), + ] + if (build / "meson-private/coredata.dat").exists(): + options.insert(0, "--reconfigure") + subprocess.run(["meson", "setup", str(build), str(ROOT), *options], env=env, check=True) + subprocess.run(["meson", "compile", "-C", str(build)], env=env, check=True) + subprocess.run(["meson", "test", "-C", str(build), "--print-errorlogs"], env=env, check=True) + stage = build / "macos-stage" + if stage.exists(): + shutil.rmtree(stage) + subprocess.run(["meson", "install", "-C", str(build), "--destdir", str(stage)], env=env, check=True) + package(stage, args.output.resolve(), args.build_number) + + +if __name__ == "__main__": + try: + main() + except (RuntimeError, subprocess.CalledProcessError, OSError) as error: + sys.exit(f"macOS build failed: {error}") diff --git a/packaging/macos/bundle.py b/packaging/macos/bundle.py new file mode 100644 index 00000000..b774d3f7 --- /dev/null +++ b/packaging/macos/bundle.py @@ -0,0 +1,358 @@ +#!/usr/bin/env python3 +"""Build and audit a relocatable GTK3 application. No third-party Python packages.""" +from __future__ import annotations + +import argparse +import json +import os +from pathlib import Path +import platform +import plistlib +import re +import shutil +import subprocess +import sys + +ROOT = Path(__file__).resolve().parents[2] +MACH_MAGIC = {bytes.fromhex(h) for h in ("feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca")} +SYSTEM_ROOTS = ("/usr/lib/", "/System/Library/") + + +def run(*args: str | Path, env: dict[str, str] | None = None) -> str: + return subprocess.check_output([str(arg) for arg in args], env=env, text=True).strip() + + +def is_macho(path: Path) -> bool: + if not path.is_file() or path.is_symlink(): + return False + with path.open("rb") as stream: + return stream.read(4) in MACH_MAGIC + + +def dependencies(path: Path) -> list[str]: + # Paths may contain spaces; splitting on whitespace would corrupt them. + return re.findall(r"^\s+(.+?) \(compatibility version", run("otool", "-L", path), re.M) + + +def rpaths(path: Path) -> list[str]: + return re.findall(r"cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset", run("otool", "-l", path)) + + +def dylib_id(path: Path) -> str | None: + lines = run("otool", "-D", path).splitlines() + return lines[1].strip() if len(lines) > 1 else None + + +def system_library(name: str) -> bool: + return name.startswith(SYSTEM_ROOTS) + + +def expand_path(name: str, loader: Path, executable: Path) -> Path: + return Path(name.replace("@loader_path", str(loader.parent)).replace("@executable_path", str(executable.parent))) + + +def resolve_dependency(name: str, loader: Path, executable: Path, search: list[Path]) -> Path: + if name.startswith("@rpath/"): + suffix = name[len("@rpath/"):] + candidates = [directory / suffix for directory in search] + else: + candidates = [expand_path(name, loader, executable)] + for candidate in candidates: + if candidate.is_absolute() and candidate.is_file(): + return candidate.resolve() + raise RuntimeError(f"Cannot resolve {name!r} from {loader}; searched {candidates}") + + +class Relocator: + def __init__(self, app: Path, executable: Path): + self.app = app + self.executable = executable + self.frameworks = app / "Contents/Frameworks" + self.frameworks.mkdir(parents=True) + self.sources: dict[Path, Path] = {} + self.names: dict[str, Path] = {} + self.visited: set[Path] = set() + + def copy_dependency(self, source: Path) -> Path: + source = source.resolve() + if ".framework/" in str(source): + raise RuntimeError(f"Third-party frameworks require separate packaging support: {source}") + if source in self.sources: + return self.sources[source] + existing = self.names.get(source.name) + if existing and existing != source: + raise RuntimeError(f"Conflicting library basename: {existing} and {source}") + target = self.frameworks / source.name + shutil.copy2(source, target) + target.chmod(target.stat().st_mode | 0o200) + self.sources[source] = target + self.names[source.name] = source + return target + + def relocate(self, source: Path, target: Path, inherited: list[Path] | None = None) -> None: + source = source.resolve() + if target in self.visited: + return + self.visited.add(target) + local = [expand_path(name, source, self.executable) for name in rpaths(source)] + search = local + (inherited or []) + identity = dylib_id(source) + # Keep the existing signature allocation while editing: stripping it + # first can leave __LINKEDIT padding that install_name_tool rejects. + # The final inside-out codesign --force pass replaces stale signatures. + edits: list[str | Path] = [] + for name in dependencies(source): + if name == identity or system_library(name): + continue + dependency = resolve_dependency(name, source, self.executable, search) + destination = self.copy_dependency(dependency) + relative = os.path.relpath(destination, target.parent) + edits += ["-change", name, "@loader_path/" + relative] + self.relocate(dependency, destination, search) + if identity: + edits += ["-id", "@rpath/" + target.name] + for name in sorted(set(rpaths(target))): + edits += ["-delete_rpath", name] + if edits: + run("install_name_tool", *edits, target) + + +def copy_tree(source: Path, target: Path) -> None: + if source.is_dir(): + # Dereference symlinks: never leave links into the builder's Cellar. + shutil.copytree(source, target, dirs_exist_ok=True, symlinks=False) + + +def audit(app: Path) -> dict[str, object]: + binary = app / "Contents/MacOS/zoitechat" + architectures = set(run("lipo", "-archs", binary).split()) + minimum = (11, 0, 0) + entries = [] + for path in sorted(app.rglob("*")): + if path.is_symlink(): + resolved = path.resolve() + if not resolved.is_relative_to(app.resolve()): + raise RuntimeError(f"External symlink: {path} -> {resolved}") + if not is_macho(path): + continue + if not architectures.issubset(set(run("lipo", "-archs", path).split())): + raise RuntimeError(f"Architecture mismatch: {path}") + identity = dylib_id(path) + for name in dependencies(path): + if name == identity or system_library(name): + continue + if not name.startswith("@loader_path/"): + raise RuntimeError(f"Non-relocatable dependency: {path}: {name}") + target = expand_path(name, path, binary).resolve() + if not target.is_relative_to(app.resolve()) or not target.is_file(): + raise RuntimeError(f"Missing or external dependency: {path}: {name}") + if rpaths(path): + raise RuntimeError(f"Unexpected runtime search paths: {path}") + load_commands = run("otool", "-l", path) + versions = re.findall(r"\bminos (\d+(?:\.\d+){0,2})", load_commands) + versions += re.findall(r"cmd LC_VERSION_MIN_MACOSX\s+cmdsize \d+\s+version (\d+(?:\.\d+){0,2})", load_commands) + if not versions: + raise RuntimeError(f"Missing deployment version: {path}") + for version in versions: + parts = tuple(int(value) for value in version.split(".")) + minimum = max(minimum, parts + (0,) * (3 - len(parts))) + entries.append({"path": str(path.relative_to(app))}) + return {"architectures": sorted(architectures), "minimum_macos": ".".join(map(str, minimum if minimum[2] else minimum[:2])), "mach_o": entries} + + +def package(stage: Path, app: Path, build_number: str) -> None: + if not re.fullmatch(r"[1-9]\d*(?:\.\d+){0,2}", build_number): + raise RuntimeError("Build number must be a positive Apple CFBundleVersion (for example 1 or 12.3)") + if app.exists(): + raise RuntimeError(f"Output already exists; choose another --output or remove it explicitly: {app}") + app.mkdir(parents=True) + resources = app / "Contents/Resources" + resources.mkdir(parents=True) + binary = app / "Contents/MacOS/zoitechat" + binary.parent.mkdir() + shutil.copy2(stage / "bin/zoitechat", binary) + copy_tree(stage / "share", resources / "share") + copy_tree(stage / "lib/zoitechat/plugins", resources / "lib/zoitechat/plugins") + relocator = Relocator(app, stage / "bin/zoitechat") + seeds: list[tuple[Path, Path]] = [(stage / "bin/zoitechat", binary)] + for source in (stage / "lib/zoitechat/plugins").glob("*"): + if is_macho(source): + seeds.append((source, resources / "lib/zoitechat/plugins" / source.name)) + + prefixes = {formula: Path(run("brew", "--prefix", formula)) for formula in ( + "gtk+3", "gdk-pixbuf", "glib", "glib-networking", "librsvg", "enchant", "adwaita-icon-theme", "hicolor-icon-theme", "gsettings-desktop-schemas", "ca-certificates", "openssl@3", "lua", "libarchive", "gtk-mac-integration")} + # Runtime-loaded code is not visible in the main executable's otool output. + module_groups = [ + (prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"), + (prefixes["librsvg"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"), + (prefixes["gtk+3"] / "lib/gtk-3.0/3.0.0/immodules", "lib/gtk-3.0/3.0.0/immodules"), + (prefixes["glib-networking"] / "lib/gio/modules", "lib/gio/modules"), + (prefixes["enchant"] / "lib/enchant-2", "lib/enchant-2"), + (prefixes["openssl@3"] / "lib/ossl-modules", "lib/ossl-modules"), + ] + for source_dir, relative in module_groups: + target_dir = resources / relative + target_dir.mkdir(parents=True, exist_ok=True) + for source in sorted(source_dir.glob("*")): + if source.suffix not in (".so", ".dylib") or not source.is_file(): + continue + target = target_dir / source.name + if target.exists() and target.read_bytes() != source.read_bytes(): + raise RuntimeError(f"Conflicting module: {target}") + shutil.copy2(source.resolve(), target) + seeds.append((source.resolve(), target)) + enchant = (prefixes["enchant"] / "lib/libenchant-2.dylib").resolve() + # Register Enchant at Resources/lib so its public prefix relocation API + # finds Resources/lib/enchant-2 and Resources/share/enchant. + enchant_alias = resources / "lib/libenchant-2.dylib" + shutil.copy2(enchant, enchant_alias) + relocator.sources[enchant] = enchant_alias + relocator.names[enchant.name] = enchant + seeds.append((enchant, enchant_alias)) + for formula, prefix in prefixes.items(): + for name in ("icons", "glib-2.0/schemas", "locale", "enchant", "hunspell"): + copy_tree(prefix / "share" / name, resources / "share" / name) + ca = prefixes["ca-certificates"] / "share/ca-certificates/cacert.pem" + if not ca.is_file(): + raise RuntimeError(f"CA bundle not found: {ca}") + (resources / "certs").mkdir() + shutil.copy2(ca, resources / "certs/ca-bundle.crt") + schemas = resources / "share/glib-2.0/schemas" + run(prefixes["glib"] / "bin/glib-compile-schemas", schemas) + pixbuf_modules = sorted((resources / "lib/gdk-pixbuf-2.0/2.10.0/loaders").glob("*")) + if not any("svg" in path.name for path in pixbuf_modules): + raise RuntimeError("SVG loader missing: install librsvg") + if list((resources / "lib/zoitechat/plugins").glob("fishlim.*")) and not list((resources / "lib/ossl-modules").glob("legacy.*")): + raise RuntimeError("FiSH needs the OpenSSL legacy provider in the bundle") + if not list((resources / "lib/gio/modules").glob("*tls*")): + raise RuntimeError("GIO TLS backend missing: install glib-networking") + # Query original binaries before relocation, then rewrite only the cached paths. + pixbuf_query = prefixes["gdk-pixbuf"] / "bin/gdk-pixbuf-query-loaders" + if not pixbuf_query.exists(): + pixbuf_query = prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders" + for tool, module_dir, cache in ( + (pixbuf_query, "lib/gdk-pixbuf-2.0/2.10.0/loaders", "pixbuf-loaders.cache"), + (prefixes["gtk+3"] / "bin/gtk-query-immodules-3.0", "lib/gtk-3.0/3.0.0/immodules", "gtk-immodules.cache"), + ): + originals = [(source, target) for source, target in seeds if target.parent == resources / module_dir] + # Never call a query tool with zero arguments: it would scan global modules. + data = run(tool, *(source for source, _ in originals)) if originals else "# No external input-method modules\n" + for source, target in originals: + data = data.replace(str(source), "@ZOITECHAT_RESOURCES@/" + str(target.relative_to(resources))) + (resources / cache).write_text(data + "\n") + # The private font map loads the bundled Noto font; ordinary GTK fonts stay local. + (resources / "fonts.conf").write_text(''' + + + /System/Library/Fonts/Library/Fonts~/Library/Fonts + fontconfig + sans-serifHelvetica + monospaceMenlo + +''') + (resources / "zoitechat-bundle").write_text("1\n") + licenses = resources / "licenses" + licenses.mkdir() + shutil.copy2(ROOT / "COPYING", licenses / "ZoiteChat-COPYING") + # Preserve the notices shipped with every installed Homebrew dependency. + # brew deps traverses dependencies by default; --recursive is not an option. + wanted = set(prefixes) + for formula in prefixes: + wanted.update(run("brew", "deps", "--formula", formula).splitlines()) + installed = [item for item in json.loads(run("brew", "info", "--json=v2", "--installed"))["formulae"] + if item["name"] in wanted] + for formula in installed: + prefix = Path(run("brew", "--prefix", formula["name"])) + notices = [p for p in prefix.iterdir() if p.is_file() and re.match(r"(?i)(copying|license|copyright|notice)", p.name)] + if notices: + target = licenses / formula["name"].replace("/", "-") + target.mkdir(exist_ok=True) + for notice in notices: + shutil.copy2(notice, target / notice.name) + (resources / "homebrew-dependencies.json").write_text(json.dumps(installed, indent=2) + "\n") + for source, target in seeds: + relocator.relocate(source, target) + report = audit(app) + (resources / "bundle-audit.json").write_text(json.dumps(report, indent=2) + "\n") + # Use the actual highest deployment target of the executable and all dylibs. + # Setting an older plist version cannot make newer Homebrew bottles compatible. + version = (ROOT / "VERSION").read_text().strip() + release = re.match(r"\d+\.\d+\.\d+", version) + if not release: + raise RuntimeError(f"Unsupported release version: {version}") + plist = { + "CFBundleIdentifier": "org.Zoitechat", "CFBundleExecutable": "zoitechat", + "CFBundleName": "ZoiteChat", "CFBundleDisplayName": "ZoiteChat", + "CFBundlePackageType": "APPL", "CFBundleShortVersionString": release.group(), + "CFBundleVersion": build_number, "CFBundleIconFile": "ZoiteChat.icns", + "LSMinimumSystemVersion": report["minimum_macos"], "NSHighResolutionCapable": True, + "NSPrincipalClass": "NSApplication", + "LSApplicationCategoryType": "public.app-category.social-networking", + "DTSDKName": "macosx" + run("xcrun", "--sdk", "macosx", "--show-sdk-version"), + "DTSDKBuild": run("xcrun", "--sdk", "macosx", "--show-sdk-build-version"), + } + with (app / "Contents/Info.plist").open("wb") as stream: + plistlib.dump(plist, stream) + iconset = app.parent / (app.stem + ".iconset") + if iconset.exists(): + raise RuntimeError(f"Icon staging directory already exists: {iconset}") + iconset.mkdir() + try: + # Rasterize the original vector at 1024px, then generate every icon size. + large = iconset / "source.png" + run(prefixes["librsvg"] / "bin/rsvg-convert", "-w", "1024", "-h", "1024", "-o", large, ROOT / "data/icons/zoitechat.svg") + for size in (16, 32, 128, 256, 512): + for scale in (1, 2): + name = f"icon_{size}x{size}" + ("@2x" if scale == 2 else "") + ".png" + run("sips", "-z", str(size * scale), str(size * scale), large, "--out", iconset / name) + large.unlink() + run("iconutil", "-c", "icns", iconset, "-o", resources / "ZoiteChat.icns") + finally: + shutil.rmtree(iconset) + # Local builds need an ad-hoc signature after install_name_tool changes. + sign(app, "-", None) + print(f"Created {app}: {', '.join(report['architectures'])}, macOS {report['minimum_macos']}+") + + +def sign(app: Path, identity: str, entitlements: Path | None, *, keychain: Path | None = None) -> None: + audit(app) + binaries = [p for p in app.rglob("*") if is_macho(p) and p != app / "Contents/MacOS/zoitechat"] + options = [] if identity == "-" else ["--timestamp", "--options", "runtime"] + if keychain is not None: + options += ["--keychain", str(keychain)] + for binary in sorted(binaries, key=lambda p: len(p.parts), reverse=True): + run("codesign", "--force", "--sign", identity, *options, binary) + main_options = ["--entitlements", str(entitlements)] if entitlements else [] + run("codesign", "--force", "--sign", identity, *options, *main_options, app) + run("codesign", "--verify", "--deep", "--strict", "--verbose=2", app) + + +def main() -> None: + parser = argparse.ArgumentParser(description=__doc__) + sub = parser.add_subparsers(dest="action", required=True) + create = sub.add_parser("create") + create.add_argument("--stage", type=Path, required=True) + create.add_argument("--app", type=Path, required=True) + create.add_argument("--build-number", default="1") + verify = sub.add_parser("audit") + verify.add_argument("app", type=Path) + signing = sub.add_parser("sign") + signing.add_argument("app", type=Path) + signing.add_argument("--identity", required=True) + signing.add_argument("--entitlements", type=Path) + args = parser.parse_args() + if platform.system() != "Darwin": + parser.error("This tool requires macOS and the Xcode command-line tools") + if args.action == "create": + package(args.stage.resolve(), args.app.resolve(), args.build_number) + elif args.action == "audit": + print(json.dumps(audit(args.app.resolve()), indent=2)) + else: + sign(args.app.resolve(), args.identity, args.entitlements) + + +if __name__ == "__main__": + try: + main() + except (RuntimeError, subprocess.CalledProcessError, OSError) as error: + sys.exit(f"macOS packaging failed: {error}") diff --git a/packaging/macos/direct.entitlements b/packaging/macos/direct.entitlements new file mode 100644 index 00000000..66d9abbe --- /dev/null +++ b/packaging/macos/direct.entitlements @@ -0,0 +1,6 @@ + + + + + com.apple.security.cs.disable-library-validation + diff --git a/packaging/macos/release.py b/packaging/macos/release.py new file mode 100644 index 00000000..e3e009ef --- /dev/null +++ b/packaging/macos/release.py @@ -0,0 +1,220 @@ +#!/usr/bin/env python3 +"""Developer ID sign, notarize and staple a built app using CI environment secrets.""" +from __future__ import annotations + +import argparse +import base64 +import binascii +from contextlib import contextmanager +from dataclasses import dataclass +import json +import os +from pathlib import Path +import platform +import re +import secrets +import shlex +import subprocess +import sys +import tempfile +import urllib.request +import uuid + +from bundle import sign + +REQUIRED = ( + "MACOS_CERTIFICATE_P12_BASE64", "MACOS_CERTIFICATE_PASSWORD", + "MACOS_SIGNING_IDENTITY", "APPLE_API_KEY_P8", "APPLE_API_KEY_ID", "APPLE_API_ISSUER_ID", +) + + +@dataclass(repr=False) +class Credentials: + certificate: bytes + password: str + identity: str + api_key: str + key_id: str + issuer: str + + @classmethod + def from_environment(cls) -> Credentials: + missing = [name for name in REQUIRED if not os.environ.get(name, "").strip()] + if missing: + raise RuntimeError("Missing release settings: " + ", ".join(missing)) + try: + certificate = base64.b64decode("".join(os.environ[REQUIRED[0]].split()), validate=True) + except (binascii.Error, ValueError): + raise RuntimeError("MACOS_CERTIFICATE_P12_BASE64 must contain Base64-encoded .p12 bytes") from None + if not certificate: + raise RuntimeError("Signing certificate is empty") + identity = os.environ["MACOS_SIGNING_IDENTITY"].strip() + if not (identity.startswith("Developer ID Application:") or re.fullmatch(r"[a-fA-F0-9]{40}", identity)): + raise RuntimeError("MACOS_SIGNING_IDENTITY must identify a Developer ID Application certificate") + api_key = os.environ["APPLE_API_KEY_P8"].strip() + if not (api_key.startswith("-----BEGIN PRIVATE KEY-----") and api_key.endswith("-----END PRIVATE KEY-----")): + raise RuntimeError("APPLE_API_KEY_P8 must contain the complete, plain-text .p8 private key") + key_id = os.environ["APPLE_API_KEY_ID"].strip() + if not re.fullmatch(r"[A-Za-z0-9]{6,32}", key_id): + raise RuntimeError("APPLE_API_KEY_ID must be an App Store Connect key ID") + try: + issuer = str(uuid.UUID(os.environ["APPLE_API_ISSUER_ID"].strip())) + except ValueError: + raise RuntimeError("APPLE_API_ISSUER_ID must be the Team API key issuer UUID") from None + return cls(certificate, os.environ["MACOS_CERTIFICATE_PASSWORD"], identity, api_key, key_id, issuer) + + +def execute(args: list[str | Path], operation: str, *, check: bool = True) -> subprocess.CompletedProcess[str]: + # Do not print argv or CalledProcessError: security commands contain passwords. + try: + result = subprocess.run([str(arg) for arg in args], capture_output=True, text=True, check=False) + except OSError: + raise RuntimeError(f"{operation}: could not start the required tool") from None + if check and result.returncode != 0: + raise RuntimeError(f"{operation} failed (exit {result.returncode})") + return result + + +def write_private(path: Path, data: bytes) -> None: + with path.open("xb") as stream: + path.chmod(0o600) + stream.write(data) + + +def resolve_identity(output: str, requested: str) -> str: + for fingerprint, name in re.findall(r'\b([A-Fa-f0-9]{40})\s+"([^"\n]+)"', output): + if name.startswith("Developer ID Application:") and (requested == name or requested.upper() == fingerprint.upper()): + return fingerprint + raise RuntimeError("Imported .p12 has no valid Developer ID Application identity matching MACOS_SIGNING_IDENTITY; check its private key, password, expiry and certificate chain") + + +@contextmanager +def signing_keychain(credentials: Credentials): + original = shlex.split(execute(["security", "list-keychains", "-d", "user"], "Read keychain search list").stdout) + with tempfile.TemporaryDirectory(prefix="zoitechat-signing-", dir=os.environ.get("RUNNER_TEMP")) as temporary: + directory = Path(temporary) + keychain = directory / "signing.keychain-db" + keychain_password = secrets.token_urlsafe(32) + certificate = directory / "signing.p12" + api_key = directory / "notary.p8" + write_private(certificate, credentials.certificate) + write_private(api_key, (credentials.api_key + "\n").encode()) + try: + execute(["security", "create-keychain", "-p", keychain_password, keychain], "Create signing keychain") + execute(["security", "set-keychain-settings", "-lut", "21600", keychain], "Configure signing keychain") + execute(["security", "unlock-keychain", "-p", keychain_password, keychain], "Unlock signing keychain") + # Include both public Developer ID intermediates so signing does not + # depend on the runner having cached the leaf certificate's issuer. + for name in ("DeveloperIDCA.cer", "DeveloperIDG2CA.cer"): + intermediate = directory / name + try: + with urllib.request.urlopen("https://www.apple.com/certificateauthority/" + name, timeout=60) as response: + write_private(intermediate, response.read()) + except OSError: + raise RuntimeError("Download of Apple's public Developer ID intermediate failed") from None + execute(["security", "import", intermediate, "-k", keychain], "Import Developer ID intermediate") + execute(["security", "import", certificate, "-P", credentials.password, + "-k", keychain, "-T", "/usr/bin/codesign", "-T", "/usr/bin/security"], "Import signing .p12") + execute(["security", "set-key-partition-list", "-S", "apple-tool:,apple:", + "-k", keychain_password, keychain], "Allow non-interactive code signing") + execute(["security", "list-keychains", "-d", "user", "-s", keychain, *original], "Add temporary signing keychain") + identities = execute(["security", "find-identity", "-v", "-p", "codesigning", keychain], "Find signing identity").stdout + yield keychain, api_key, resolve_identity(identities, credentials.identity) + finally: + # Hosted runners are discarded too, but clean up on every ordinary + # success/failure path and restore the original search list. + execute(["security", "list-keychains", "-d", "user", "-s", *original], "Restore keychain search list", check=False) + if keychain.exists(): + result = execute(["security", "delete-keychain", keychain], "Delete signing keychain", check=False) + if result.returncode: + print("Warning: keychain deletion failed; temporary files will still be removed.", file=sys.stderr) + + +def decode_response(result: subprocess.CompletedProcess[str], operation: str) -> dict: + try: + response = json.loads(result.stdout) + except (json.JSONDecodeError, TypeError): + raise RuntimeError(f"{operation} did not return valid JSON (exit {result.returncode})") from None + if not isinstance(response, dict): + raise RuntimeError(f"{operation} returned an unexpected response") + return response + + +def save_json(path: Path, response: dict) -> None: + path.write_text(json.dumps(response, indent=2) + "\n") + + +def notarize(app: Path, output: Path, diagnostics: Path, credentials: Credentials, api_key: Path, timeout: str) -> None: + diagnostics.mkdir(parents=True, exist_ok=True) + authentication = ["--key", str(api_key), "--key-id", credentials.key_id, "--issuer", credentials.issuer] + with tempfile.TemporaryDirectory(prefix="zoitechat-notary-", dir=os.environ.get("RUNNER_TEMP")) as temporary: + submission_zip = Path(temporary) / "ZoiteChat-submission.zip" + execute(["ditto", "-c", "-k", "--keepParent", app, submission_zip], "Package notarization submission") + result = execute(["xcrun", "notarytool", "submit", submission_zip, *authentication, + "--output-format", "json"], "Submit notarization", check=False) + submission = decode_response(result, "Notarization submission") + save_json(diagnostics / "submission.json", submission) + if result.returncode or not submission.get("id"): + raise RuntimeError("Apple rejected the notarization submission; see submission.json") + try: + submission_id = str(uuid.UUID(submission["id"])) + except (ValueError, TypeError, AttributeError): + raise RuntimeError("Apple returned an invalid notarization submission ID") from None + print(f"Notarization submitted: {submission_id}", flush=True) + waited = execute(["xcrun", "notarytool", "wait", submission_id, *authentication, + "--timeout", timeout, "--output-format", "json"], "Wait for notarization", check=False) + try: + status = decode_response(waited, "Notarization wait") + except RuntimeError: + status = {"id": submission_id, "status": "Unknown", "exit_code": waited.returncode} + save_json(diagnostics / "status.json", status) + # Apple can provide a diagnostic log after processing. Fetch it for both + # successful and rejected submissions; never include credential files. + execute(["xcrun", "notarytool", "log", submission_id, *authentication, + diagnostics / "notary-log.json"], "Fetch notarization log", check=False) + if waited.returncode or status.get("status") != "Accepted": + raise RuntimeError("Notarization was not accepted or exceeded the wait limit; see the notarization diagnostic artifact. No release ZIP will be published") + execute(["xcrun", "stapler", "staple", app], "Staple notarization ticket") + execute(["xcrun", "stapler", "validate", app], "Validate notarization ticket") + execute(["codesign", "--verify", "--deep", "--strict", "--verbose=2", app], "Verify stapled app signature") + execute(["spctl", "--assess", "--type", "execute", "--verbose=2", app], "Assess Gatekeeper acceptance") + output.parent.mkdir(parents=True, exist_ok=True) + # Repack only after stapling. The submission ZIP is not the distributable ZIP. + execute(["ditto", "-c", "-k", "--keepParent", app, output], "Package notarized release") + print(f"Signed and notarized release: {output}", flush=True) + + +def main() -> None: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--check-config", action="store_true", help="Validate release settings without accessing Apple or a keychain") + parser.add_argument("--app", type=Path, default=Path("dist/ZoiteChat.app")) + parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat-signed-notarized.zip")) + parser.add_argument("--diagnostics", type=Path, default=Path("dist/notarization")) + parser.add_argument("--notary-timeout", default="60m") + args = parser.parse_args() + credentials = Credentials.from_environment() + if args.check_config: + print("Release signing and notarization settings are present and correctly formatted.") + return + if platform.system() != "Darwin": + parser.error("Signing/notarization requires the macOS runner and Xcode command-line tools") + if not args.app.is_dir() or args.output.exists(): + parser.error("Provide a built .app and an output ZIP path that does not already exist") + if not re.fullmatch(r"[1-9]\d*[smh]", args.notary_timeout): + parser.error("Use a positive notarization timeout, such as 60m") + with signing_keychain(credentials) as (keychain, api_key, identity): + sign(args.app.resolve(), identity, Path(__file__).with_name("direct.entitlements"), keychain=keychain) + notarize(args.app.resolve(), args.output.resolve(), args.diagnostics.resolve(), credentials, api_key, args.notary_timeout) + + +if __name__ == "__main__": + try: + main() + except (RuntimeError, OSError): + # RuntimeError messages are authored above and do not contain secret argv. + error = sys.exc_info()[1] + if isinstance(error, RuntimeError): + sys.exit(f"macOS release failed: {error}") + sys.exit("macOS release failed: file or network operation failed") + except subprocess.CalledProcessError: + sys.exit("macOS release failed: code signing or bundle audit failed") diff --git a/packaging/macos/smoke.py b/packaging/macos/smoke.py new file mode 100644 index 00000000..a9154c7f --- /dev/null +++ b/packaging/macos/smoke.py @@ -0,0 +1,49 @@ +#!/usr/bin/env python3 +"""Run the relocated bundle with temporary settings and no IRC auto-connect.""" +from __future__ import annotations +import argparse +from pathlib import Path +import shutil +import subprocess +import tempfile + + +def main() -> None: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("app", type=Path) + args = parser.parse_args() + with tempfile.TemporaryDirectory(prefix="zoitechat-macos-smoke-") as directory: + # Include spaces to exercise dyld and GTK module-cache path handling. + app = Path(directory) / "Relocated App" / "ZoiteChat.app" + shutil.copytree(args.app.resolve(), app) + binary = app / "Contents/MacOS/zoitechat" + subprocess.run(["codesign", "--verify", "--deep", "--strict", str(app)], check=True) + subprocess.run([str(binary), "--version"], check=True, timeout=30) + config = Path(directory) / "test-config" + with (Path(directory) / "startup.log").open("w+") as log: + process = subprocess.Popen([str(binary), "--no-auto", "--cfgdir", str(config)], stdout=log, stderr=log) + try: + process.wait(timeout=10) + except subprocess.TimeoutExpired: + # Stop the isolated process after checking for early startup failure. + process.terminate() + try: + process.wait(timeout=10) + except subprocess.TimeoutExpired: + process.kill() + process.wait() + raise RuntimeError("GUI startup process did not terminate") + else: + log.seek(0) + raise RuntimeError(f"GUI exited before smoke interval (code {process.returncode}):\n{log.read()}") + log.seek(0) + messages = log.read() + print(messages) + for failure in ("Library not loaded:", "Symbol not found:", "cannot open display", "Cannot load bundled HTTPS trust database", "Bundled emoji font is missing", "Cannot relocate", "Error loading plugin:"): + if failure.lower() in messages.lower(): + raise RuntimeError(f"Startup failure found: {failure}") + print("Relocated bundle stayed running for 10 seconds; manual interaction testing is still required.") + + +if __name__ == "__main__": + main() diff --git a/packaging/macos/store-experimental.entitlements b/packaging/macos/store-experimental.entitlements new file mode 100644 index 00000000..0ff752e5 --- /dev/null +++ b/packaging/macos/store-experimental.entitlements @@ -0,0 +1,10 @@ + + + + com.apple.security.app-sandbox + com.apple.security.network.client + + com.apple.security.network.server + com.apple.security.files.user-selected.read-write + com.apple.security.files.downloads.read-write + diff --git a/packaging/macos/tests/test_bundle.py b/packaging/macos/tests/test_bundle.py new file mode 100644 index 00000000..a01ee2d0 --- /dev/null +++ b/packaging/macos/tests/test_bundle.py @@ -0,0 +1,125 @@ +"""Dependency parsing, relocation guards and release audit tests without a Mac SDK.""" +from pathlib import Path +import shutil +import sys +import tempfile +import unittest +from unittest.mock import patch + +sys.path.insert(0, str(Path(__file__).resolve().parents[1])) +import bundle + + +class BundleTests(unittest.TestCase): + @unittest.skipUnless(sys.platform == "darwin", "requires Apple's Mach-O tools") + def test_signed_binary_relocation_and_resigning(self): + with tempfile.TemporaryDirectory(prefix="zoitechat relocation ") as temporary: + directory = Path(temporary) + library_source = directory / "answer.c" + library_source.write_text("int answer(void) { return 42; }\n") + library = directory / "libanswer.dylib" + main_source = directory / "main.c" + main_source.write_text( + "#include \n" + "extern int answer(void);\n" + "int main(void) { printf(\"%d\\n\", answer()); return 0; }\n" + ) + executable = directory / "original" + bundle.run("xcrun", "clang", "-dynamiclib", "-Wl,-headerpad_max_install_names", + "-Wl,-install_name," + str(library), library_source, "-o", library) + bundle.run("xcrun", "clang", "-Wl,-headerpad_max_install_names", + "-Wl,-rpath," + str(directory), main_source, library, "-o", executable) + for binary in (library, executable): + bundle.run("codesign", "--force", "--sign", "-", binary) + app = directory / "Test.app" + target = app / "Contents/MacOS/zoitechat" + target.parent.mkdir(parents=True) + shutil.copy2(executable, target) + relocator = bundle.Relocator(app, executable) + relocator.relocate(executable, target) + # Remove the original dependency so execution proves relocation. + library.unlink() + for binary in (app / "Contents/Frameworks/libanswer.dylib", target): + bundle.run("codesign", "--force", "--sign", "-", binary) + bundle.run("codesign", "--verify", "--strict", binary) + self.assertEqual(bundle.run(target), "42") + self.assertEqual(len(bundle.audit(app)["mach_o"]), 2) + + def test_otool_preserves_paths_with_spaces(self): + output = "app:\n\t/opt/Build Dependencies/lib/liba.dylib (compatibility version 1.0.0, current version 1.0.0)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1.0.0)" + with patch.object(bundle, "run", return_value=output): + self.assertEqual(bundle.dependencies(Path("app")), ["/opt/Build Dependencies/lib/liba.dylib", "/usr/lib/libSystem.B.dylib"]) + + def test_lc_rpaths_preserve_spaces(self): + with patch.object(bundle, "run", return_value="cmd LC_RPATH\n cmdsize 48\n path @loader_path/../Build Dependencies (offset 12)\n"): + self.assertEqual(bundle.rpaths(Path("app")), ["@loader_path/../Build Dependencies"]) + + def test_inherited_rpath_resolution(self): + with tempfile.TemporaryDirectory() as temporary: + directory = Path(temporary) + library = directory / "with spaces/libtest.dylib" + library.parent.mkdir() + library.write_bytes(b"library") + self.assertEqual(bundle.resolve_dependency("@rpath/libtest.dylib", directory / "libparent.dylib", directory / "app", [library.parent]), library.resolve()) + + def test_unresolved_rpath_fails(self): + with self.assertRaisesRegex(RuntimeError, "Cannot resolve"): + bundle.resolve_dependency("@rpath/missing.dylib", Path("/tmp/parent"), Path("/tmp/app"), []) + + def test_conflicting_basename_fails(self): + with tempfile.TemporaryDirectory() as temporary: + directory = Path(temporary) + sources = [directory / name / "libtest.dylib" for name in ("one", "two")] + for source in sources: + source.parent.mkdir() + source.write_bytes(b"library") + relocator = bundle.Relocator(directory / "App.app", directory / "executable") + relocator.copy_dependency(sources[0]) + with self.assertRaisesRegex(RuntimeError, "Conflicting library basename"): + relocator.copy_dependency(sources[1]) + + def test_audit_rejects_external_symlink(self): + with tempfile.TemporaryDirectory() as temporary: + app = Path(temporary) / "App.app" + app.mkdir() + (app / "outside").symlink_to("/usr/lib") + with patch.object(bundle, "run", return_value="arm64"), self.assertRaisesRegex(RuntimeError, "External symlink"): + bundle.audit(app) + + def test_audit_raises_minimum_for_dependencies(self): + with tempfile.TemporaryDirectory() as temporary: + app = Path(temporary) / "App.app" + binary = app / "Contents/MacOS/zoitechat" + library = app / "Contents/Frameworks/libtest.dylib" + for path in (binary, library): + path.parent.mkdir(parents=True, exist_ok=True) + path.write_bytes(bytes.fromhex("cffaedfe") + b"payload") + def fake_run(*args): + if args[0] == "lipo": + return "arm64" + if args[1] == "-D": + return str(args[2]) + ("\n@rpath/libtest.dylib" if args[2] == library else "") + if args[1] == "-L": + name = "@loader_path/../Frameworks/libtest.dylib" if args[2] == binary else "@rpath/libtest.dylib" + return f"{args[2]}:\n\t{name} (compatibility version 1.0.0, current version 1.0.0)" + return "cmd LC_BUILD_VERSION\n cmdsize 32\n platform 1\n minos " + ("15.0.1" if args[2] == library else "11.0") + with patch.object(bundle, "run", side_effect=fake_run): + report = bundle.audit(app) + self.assertEqual(report["minimum_macos"], "15.0.1") + self.assertEqual(report["architectures"], ["arm64"]) + self.assertEqual(len(report["mach_o"]), 2) + + def test_audit_rejects_wrong_architecture(self): + with tempfile.TemporaryDirectory() as temporary: + app = Path(temporary) / "App.app" + binary = app / "Contents/MacOS/zoitechat" + library = app / "Contents/Frameworks/libtest.dylib" + for path in (binary, library): + path.parent.mkdir(parents=True, exist_ok=True) + path.write_bytes(bytes.fromhex("cffaedfe")) + with patch.object(bundle, "run", side_effect=["arm64", "x86_64"]), self.assertRaisesRegex(RuntimeError, "Architecture mismatch"): + bundle.audit(app) + + +if __name__ == "__main__": + unittest.main() diff --git a/packaging/macos/tests/test_release.py b/packaging/macos/tests/test_release.py new file mode 100644 index 00000000..88cdbc54 --- /dev/null +++ b/packaging/macos/tests/test_release.py @@ -0,0 +1,153 @@ +"""Release failure gates, private-key handling and notarization result checks.""" +from contextlib import redirect_stdout +import base64 +import io +import json +import os +from pathlib import Path +import subprocess +import sys +import tempfile +import unittest +from unittest.mock import patch + +sys.path.insert(0, str(Path(__file__).resolve().parents[1])) +import release + +FINGERPRINT = "A" * 40 +IDENTITY = "Developer ID Application: Test Only (NOTAREALID)" +SUBMISSION = "a8c9438a-b972-455e-aedc-278070349394" +ENVIRONMENT = { + "MACOS_CERTIFICATE_P12_BASE64": base64.b64encode(b"not-a-real-certificate").decode(), + "MACOS_CERTIFICATE_PASSWORD": "unit-test-password", + "MACOS_SIGNING_IDENTITY": IDENTITY, + "APPLE_API_KEY_P8": "-----BEGIN PRIVATE KEY-----\nunit-test-only\n-----END PRIVATE KEY-----", + "APPLE_API_KEY_ID": "TESTKEY123", + "APPLE_API_ISSUER_ID": SUBMISSION, +} + + +class ReleaseTests(unittest.TestCase): + def credentials(self): + with patch.dict(os.environ, ENVIRONMENT, clear=True): + return release.Credentials.from_environment() + + def test_config_reports_names_and_never_values(self): + with patch.dict(os.environ, {}, clear=True), self.assertRaisesRegex(RuntimeError, "MACOS_CERTIFICATE_P12_BASE64"): + release.Credentials.from_environment() + + def test_config_accepts_multiline_certificate_base64(self): + env = ENVIRONMENT.copy() + text = env["MACOS_CERTIFICATE_P12_BASE64"] + env["MACOS_CERTIFICATE_P12_BASE64"] = text[:10] + "\n" + text[10:] + with patch.dict(os.environ, env, clear=True): + self.assertEqual(release.Credentials.from_environment().certificate, b"not-a-real-certificate") + + def test_config_rejects_development_certificate(self): + env = {**ENVIRONMENT, "MACOS_SIGNING_IDENTITY": "Apple Development: Test"} + with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "Developer ID Application"): + release.Credentials.from_environment() + + def test_config_rejects_base64_instead_of_plain_p8(self): + env = {**ENVIRONMENT, "APPLE_API_KEY_P8": "not-the-pem-contents"} + with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "complete, plain-text"): + release.Credentials.from_environment() + + def test_execute_does_not_expose_secret_argv_or_stderr(self): + result = subprocess.CompletedProcess([], 1, stdout="", stderr="secret-password") + with patch.object(release.subprocess, "run", return_value=result): + with self.assertRaises(RuntimeError) as error: + release.execute(["security", "import", "-P", "secret-password"], "Import certificate") + self.assertNotIn("secret-password", str(error.exception)) + + def test_matching_identity_requires_developer_id_and_private_key(self): + output = f' 1) {FINGERPRINT} "{IDENTITY}"\n' + self.assertEqual(release.resolve_identity(output, IDENTITY), FINGERPRINT) + with self.assertRaisesRegex(RuntimeError, "no valid Developer ID"): + release.resolve_identity("0 valid identities found", IDENTITY) + + def test_private_files_have_restricted_permissions(self): + with tempfile.TemporaryDirectory() as directory: + path = Path(directory) / "private.p8" + release.write_private(path, b"test-only") + self.assertEqual(path.stat().st_mode & 0o777, 0o600) + + def test_keychain_and_private_files_are_cleaned_up_after_signing_failure(self): + calls = [] + def fake_execute(args, operation, **kwargs): + calls.append([str(value) for value in args]) + output = '' + if args[:3] == ["security", "list-keychains", "-d"] and len(args) == 4: + output = '"/tmp/original.keychain-db"\n' + if args[:2] == ["security", "create-keychain"]: + Path(args[-1]).touch() + if args[:2] == ["security", "find-identity"]: + output = f' 1) {FINGERPRINT} "{IDENTITY}"\n' + return subprocess.CompletedProcess(args, 0, output, "") + temporary_path = None + with patch.object(release, "execute", side_effect=fake_execute), patch.object(release.urllib.request, "urlopen", side_effect=lambda *args, **kwargs: io.BytesIO(b"public-test-ca")): + with self.assertRaisesRegex(RuntimeError, "test signing failed"): + with release.signing_keychain(self.credentials()) as (keychain, api_key, identity): + temporary_path = keychain.parent + self.assertEqual(identity, FINGERPRINT) + self.assertTrue(api_key.is_file()) + raise RuntimeError("test signing failed") + self.assertFalse(temporary_path.exists()) + self.assertIn(["security", "list-keychains", "-d", "user", "-s", "/tmp/original.keychain-db"], calls) + self.assertTrue(any(call[:2] == ["security", "delete-keychain"] for call in calls)) + + def run_notary(self, status, returncode=0): + calls = [] + temporary = tempfile.TemporaryDirectory() + self.addCleanup(temporary.cleanup) + directory = Path(temporary.name) + app = directory / "ZoiteChat.app" + app.mkdir() + output = directory / "release.zip" + diagnostics = directory / "diagnostics" + def fake_execute(args, operation, **kwargs): + calls.append([str(value) for value in args]) + text = "" + code = 0 + if args[:3] == ["xcrun", "notarytool", "submit"]: + text = json.dumps({"id": SUBMISSION}) + elif args[:3] == ["xcrun", "notarytool", "wait"]: + text = json.dumps({"id": SUBMISSION, "status": status}) + code = returncode + elif args[:3] == ["xcrun", "notarytool", "log"]: + Path(args[-1]).write_text('{"issues": []}') + elif args[0] == "ditto": + Path(args[-1]).write_bytes(b"test-zip") + return subprocess.CompletedProcess(args, code, text, "") + with patch.object(release, "execute", side_effect=fake_execute), redirect_stdout(io.StringIO()): + if status == "Accepted" and not returncode: + release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m") + else: + with self.assertRaisesRegex(RuntimeError, "not accepted"): + release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m") + return calls, output, diagnostics + + def test_accepted_notarization_staples_and_checks_before_final_zip(self): + calls, output, diagnostics = self.run_notary("Accepted") + self.assertTrue(output.is_file()) + staple = next(i for i, call in enumerate(calls) if call[:3] == ["xcrun", "stapler", "staple"]) + assess = next(i for i, call in enumerate(calls) if call[0] == "spctl") + final_zip = max(i for i, call in enumerate(calls) if call[0] == "ditto") + self.assertLess(staple, assess) + self.assertLess(assess, final_zip) + self.assertEqual(json.loads((diagnostics / "status.json").read_text())["status"], "Accepted") + + def test_rejected_notarization_never_staples_or_publishes(self): + calls, output, diagnostics = self.run_notary("Invalid") + self.assertFalse(output.exists()) + self.assertTrue((diagnostics / "notary-log.json").is_file()) + self.assertFalse(any(call[:2] == ["xcrun", "stapler"] for call in calls)) + + def test_timeout_retains_submission_id_and_never_publishes(self): + calls, output, diagnostics = self.run_notary("In Progress", 1) + self.assertFalse(output.exists()) + self.assertEqual(json.loads((diagnostics / "submission.json").read_text())["id"], SUBMISSION) + + +if __name__ == "__main__": + unittest.main() diff --git a/src/common/macos.c b/src/common/macos.c new file mode 100644 index 00000000..c58607b6 --- /dev/null +++ b/src/common/macos.c @@ -0,0 +1,127 @@ +/* Relocate resources before GTK, Fontconfig, GIO or OpenSSL initialize. + * GPL-2.0-or-later; see COPYING. */ +#include "config.h" +#include "macos.h" +#include +#include +#include +#include +#include + +static char *locale_dir; + +static void +set_path (const char *variable, const char *base, const char *relative) +{ + char *path = g_build_filename (base, relative, NULL); + g_setenv (variable, path, TRUE); + g_free (path); +} + +static void +relocate_cache (const char *resources, const char *name, const char *variable) +{ + char *input = g_build_filename (resources, name, NULL); + char *contents = NULL; + GError *error = NULL; + + if (g_file_get_contents (input, &contents, NULL, &error)) + { + /* GTK cache files require absolute module paths. Write only data to + * the user cache, never into the signed/read-only application bundle. */ + char **parts = g_strsplit (contents, "@ZOITECHAT_RESOURCES@", -1); + char *escaped = g_strescape (resources, NULL); + char *relocated = g_strjoinv (escaped, parts); + g_free (escaped); + char *digest = g_compute_checksum_for_string (G_CHECKSUM_SHA256, relocated, -1); + char *directory = g_build_filename (g_get_user_cache_dir (), "zoitechat", "modules", digest, NULL); + char *output = g_build_filename (directory, name, NULL); + if (g_mkdir_with_parents (directory, 0700) == 0 && + g_file_set_contents (output, relocated, -1, &error)) + g_setenv (variable, output, TRUE); + else + g_warning ("Cannot relocate %s: %s", name, error ? error->message : "cannot create cache directory"); + g_free (output); + g_free (directory); + g_free (digest); + g_free (relocated); + g_strfreev (parts); + } + else + g_warning ("Cannot read %s: %s", input, error->message); + g_clear_error (&error); + g_free (contents); + g_free (input); +} + +void +zoitechat_macos_init (void) +{ + uint32_t size = 0; + char *raw, *executable, *macos, *contents, *resources, *marker; + char *ca; + GTlsDatabase *database; + GError *error = NULL; + + _NSGetExecutablePath (NULL, &size); + raw = g_malloc (size); + if (_NSGetExecutablePath (raw, &size) != 0) + { + g_free (raw); + return; + } + executable = realpath (raw, NULL); + g_free (raw); + if (!executable) + return; + macos = g_path_get_dirname (executable); + free (executable); + contents = g_path_get_dirname (macos); + resources = g_build_filename (contents, "Resources", NULL); + marker = g_build_filename (resources, "zoitechat-bundle", NULL); + g_free (macos); + g_free (contents); + if (!g_file_test (marker, G_FILE_TEST_IS_REGULAR)) + { + g_free (marker); + g_free (resources); + return; /* Ordinary Meson installs and build-tree runs retain their paths. */ + } + g_free (marker); + g_setenv ("GDK_BACKEND", "quartz", TRUE); + set_path ("ZOITECHAT_MACOS_SHARE", resources, "share"); + set_path ("XDG_DATA_DIRS", resources, "share"); + set_path ("GSETTINGS_SCHEMA_DIR", resources, "share/glib-2.0/schemas"); + set_path ("FONTCONFIG_FILE", resources, "fonts.conf"); + set_path ("GIO_EXTRA_MODULES", resources, "lib/gio/modules"); + set_path ("GIO_MODULE_DIR", resources, "lib/gio/modules"); + set_path ("ZOITECHAT_LIBDIR", resources, "lib/zoitechat/plugins"); + set_path ("ZOITECHAT_EMOJI_FONT", resources, "share/fonts/zoitechat/NotoColorEmoji.ttf"); + set_path ("ZOITECHAT_ENCHANT_LIBRARY", resources, "lib/libenchant-2.dylib"); + g_setenv ("ZOITECHAT_ENCHANT_PREFIX", resources, TRUE); + set_path ("SSL_CERT_FILE", resources, "certs/ca-bundle.crt"); + set_path ("OPENSSL_MODULES", resources, "lib/ossl-modules"); + locale_dir = g_build_filename (resources, "share/locale", NULL); + relocate_cache (resources, "pixbuf-loaders.cache", "GDK_PIXBUF_MODULE_FILE"); + relocate_cache (resources, "gtk-immodules.cache", "GTK_IM_MODULE_FILE"); + + /* HTTPS previews use GIO; IRC uses OpenSSL. Give both the same CA set. */ + ca = g_build_filename (resources, "certs/ca-bundle.crt", NULL); + database = g_tls_file_database_new (ca, &error); + if (database) + { + g_tls_backend_set_default_database (g_tls_backend_get_default (), database); + g_object_unref (database); + } + else + g_warning ("Cannot load bundled HTTPS trust database: %s", error->message); + g_clear_error (&error); + g_free (ca); + g_free (resources); +} + +const char * +zoitechat_macos_locale_dir (void) +{ + return locale_dir ? locale_dir : LOCALEDIR; +} diff --git a/src/common/macos.h b/src/common/macos.h new file mode 100644 index 00000000..4a4fa7b0 --- /dev/null +++ b/src/common/macos.h @@ -0,0 +1,6 @@ +/* macOS bundle runtime; GPL-2.0-or-later, see COPYING. */ +#ifndef ZOITECHAT_MACOS_H +#define ZOITECHAT_MACOS_H +void zoitechat_macos_init (void); +const char *zoitechat_macos_locale_dir (void); +#endif diff --git a/src/common/meson.build b/src/common/meson.build index e288d165..b7ca6afe 100644 --- a/src/common/meson.build +++ b/src/common/meson.build @@ -29,6 +29,10 @@ common_sources = [ 'util.c' ] +if host_machine.system() == 'darwin' + common_sources += 'macos.c' +endif + secretstore_sources = files('secretstore.c') common_sysinfo_deps = [] @@ -155,12 +159,19 @@ zoitechat_common = static_library('zoitechatcommon', pic: true ) +# zoitechat.h exposes OpenSSL types whenever TLS is enabled. Propagate its +# header requirements even to standalone consumers that do not call OpenSSL. +zoitechat_common_header_deps = [libgio_dep] +if libssl_dep.found() + zoitechat_common_header_deps += libssl_dep.partial_dependency(compile_args: true, includes: true) +endif + zoitechat_common_dep = declare_dependency( sources: [textevents, public_suffix_data] + marshal, link_with: zoitechat_common, include_directories: common_includes, compile_args: common_cflags, - dependencies: libgio_dep, + dependencies: zoitechat_common_header_deps, ) zoitechat_plugin_dep = declare_dependency( @@ -176,7 +187,7 @@ gtk3_theme_service_tests = executable('gtk3_theme_service_tests', 'gtk3-theme-service.c', ], include_directories: [config_h_include, include_directories('.')], - dependencies: [libgio_dep] + (libarchive_dep.found() ? [libarchive_dep] : []), + dependencies: zoitechat_common_header_deps + (libarchive_dep.found() ? [libarchive_dep] : []), ) test('GTK3 Theme Service Tests', gtk3_theme_service_tests, diff --git a/src/common/zoitechat.c b/src/common/zoitechat.c index 22d97dc5..af616c84 100644 --- a/src/common/zoitechat.c +++ b/src/common/zoitechat.c @@ -54,6 +54,9 @@ #include "text.h" #include "url.h" #include "zoitechatc.h" +#ifdef __APPLE__ +#include "macos.h" +#endif #if ! GLIB_CHECK_VERSION (2, 36, 0) #include /* for g_type_init() */ @@ -1172,6 +1175,10 @@ main (int argc, char *argv[]) int i; int ret; +#ifdef __APPLE__ + zoitechat_macos_init (); +#endif + #ifdef WIN32 HRESULT coinit_result; #endif diff --git a/src/fe-gtk/fe-gtk.c b/src/fe-gtk/fe-gtk.c index f4d38494..4a5d7fce 100644 --- a/src/fe-gtk/fe-gtk.c +++ b/src/fe-gtk/fe-gtk.c @@ -21,6 +21,9 @@ #include #include "fe-gtk.h" +#ifdef __APPLE__ +#include "../common/macos.h" +#endif #ifdef GDK_WINDOWING_WIN32 #include @@ -372,7 +375,13 @@ fe_args (int argc, char *argv[]) g_free (locale_path); g_free (base_path); #else - bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR); + bindtextdomain (GETTEXT_PACKAGE, +#ifdef __APPLE__ + zoitechat_macos_locale_dir () +#else + LOCALEDIR +#endif + ); #endif bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8"); textdomain (GETTEXT_PACKAGE); @@ -493,6 +502,15 @@ fe_args (int argc, char *argv[]) #endif gtk_init (&argc, &argv); +#ifdef __APPLE__ + if (g_getenv ("ZOITECHAT_MACOS_SHARE")) + { + char *icons = g_build_filename (g_getenv ("ZOITECHAT_MACOS_SHARE"), "icons", NULL); + gtk_icon_theme_prepend_search_path (gtk_icon_theme_get_default (), icons); + g_free (icons); + } +#endif + #ifdef WIN32 win32_configure_icon_theme (); #endif diff --git a/src/fe-gtk/meson.build b/src/fe-gtk/meson.build index 4f3d0aef..c4c3b2e0 100644 --- a/src/fe-gtk/meson.build +++ b/src/fe-gtk/meson.build @@ -53,6 +53,15 @@ zoitechat_gtk_deps = [ gtk_dep = dependency('gtk+-3.0', version: '>= 3.22') +# Standalone GTK tests also include the common application's headers. +gtk_dep = declare_dependency(dependencies: [gtk_dep] + zoitechat_common_header_deps) + +# fe-gtk.h exposes GtkosxApplication to every GTK consumer when enabled. +# Theme libraries and standalone UI tests need the same headers as the app. +if host_machine.system() == 'darwin' and gtk_mac_dep.found() + gtk_dep = declare_dependency(dependencies: [gtk_dep, gtk_mac_dep]) +endif + zoitechat_theme_deps = [gtk_dep, zoitechat_common_dep] if host_machine.system() != 'windows' @@ -91,12 +100,18 @@ if host_machine.system() != 'windows' endif zoitechat_gtk_ldflags = [] +zoitechat_gtk_objcflags = [] if host_machine.system() == 'windows' zoitechat_gtk_sources += 'notifications/notification-windows.c' zoitechat_gtk_deps += cc.find_library('dwmapi', required: true) zoitechat_theme_deps += cc.find_library('dwmapi', required: true) +elif host_machine.system() == 'darwin' + add_languages('objc', required: true) + zoitechat_gtk_sources += 'notifications/notification-osx.m' + zoitechat_gtk_deps += dependency('appleframeworks', modules: ['Cocoa', 'UserNotifications']) + zoitechat_gtk_objcflags += '-fobjc-arc' else zoitechat_gtk_sources += 'notifications/notification-freedesktop.c' endif @@ -137,6 +152,7 @@ executable('zoitechat', dependencies: zoitechat_gtk_deps, link_with: zoitechat_theme_lib, c_args: zoitechat_gtk_cflags, + objc_args: zoitechat_gtk_objcflags, link_args: zoitechat_gtk_ldflags, pie: true, install: true, diff --git a/src/fe-gtk/notifications/notification-osx.m b/src/fe-gtk/notifications/notification-osx.m index b54f62e5..24d01768 100644 --- a/src/fe-gtk/notifications/notification-osx.m +++ b/src/fe-gtk/notifications/notification-osx.m @@ -1,54 +1,67 @@ -/* ZoiteChat - * Copyright (C) 2015 Patrick Griffis. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA - */ - +/* Native macOS notifications; GPL-2.0-or-later, see COPYING. */ #import -#include +#import -void -notification_backend_show (const char *title, const char *text) +@interface ZoiteChatNotificationDelegate : NSObject +@end +@implementation ZoiteChatNotificationDelegate +- (void)userNotificationCenter:(UNUserNotificationCenter *)center + willPresentNotification:(UNNotification *)notification + withCompletionHandler:(void (^)(UNNotificationPresentationOptions))completionHandler { - NSString *str_title = [[NSString alloc] initWithUTF8String:title]; - NSString *str_text = [[NSString alloc] initWithUTF8String:text]; + completionHandler(UNNotificationPresentationOptionBanner | UNNotificationPresentationOptionSound); +} +@end - NSUserNotification *userNotification = [NSUserNotification new]; - userNotification.title = str_title; - userNotification.informativeText = str_text; +static ZoiteChatNotificationDelegate *notification_delegate; - NSUserNotificationCenter *center = [NSUserNotificationCenter defaultUserNotificationCenter]; - [center scheduleNotification:userNotification]; - - [str_title release]; - [str_text release]; +int +notification_backend_supported (void) +{ + return [[NSBundle mainBundle] bundleIdentifier] != nil; } int notification_backend_init (const char **error) { - return 1; + if (!notification_backend_supported ()) + { + *error = "macOS notifications require an application bundle"; + return 0; + } + notification_delegate = [ZoiteChatNotificationDelegate new]; + [UNUserNotificationCenter currentNotificationCenter].delegate = notification_delegate; + return 1; +} + +void +notification_backend_show (const char *title, const char *text) +{ + UNMutableNotificationContent *content = [UNMutableNotificationContent new]; + content.title = [NSString stringWithUTF8String:title] ?: @"ZoiteChat"; + content.body = [NSString stringWithUTF8String:text] ?: @""; + UNUserNotificationCenter *center = [UNUserNotificationCenter currentNotificationCenter]; + /* Ask only when the user first needs a notification, without blocking GTK. */ + [center requestAuthorizationWithOptions:UNAuthorizationOptionAlert | UNAuthorizationOptionSound + completionHandler:^(BOOL granted, NSError *error) { + if (granted) + { + UNNotificationRequest *request = [UNNotificationRequest + requestWithIdentifier:[[NSUUID UUID] UUIDString] content:content trigger:nil]; + [center addNotificationRequest:request withCompletionHandler:^(NSError *deliveryError) { + if (deliveryError) + NSLog(@"ZoiteChat notification failed: %@", deliveryError); + }]; + } + else if (error) + NSLog(@"ZoiteChat notification authorization failed: %@", error); + }]; } void notification_backend_deinit (void) { -} - -int -notification_backend_supported (void) -{ - return gtkosx_application_get_bundle_id () != NULL; + if (notification_delegate) + [UNUserNotificationCenter currentNotificationCenter].delegate = nil; + notification_delegate = nil; } diff --git a/src/fe-gtk/sexy-spell-entry.c b/src/fe-gtk/sexy-spell-entry.c index d583591f..34b0499d 100644 --- a/src/fe-gtk/sexy-spell-entry.c +++ b/src/fe-gtk/sexy-spell-entry.c @@ -215,7 +215,22 @@ initialize_enchant (void) #endif }; - for (i = 0; i < G_N_ELEMENTS(libnames); ++i) +#ifdef __APPLE__ + const char *bundled_enchant = g_getenv ("ZOITECHAT_ENCHANT_LIBRARY"); + if (bundled_enchant && *bundled_enchant) + { + enchant = g_module_open (bundled_enchant, 0); + if (enchant) + { + void (*set_prefix) (const char *) = NULL; + const char *prefix = g_getenv ("ZOITECHAT_ENCHANT_PREFIX"); + if (prefix && g_module_symbol (enchant, "enchant_set_prefix_dir", (gpointer *) &set_prefix)) + set_prefix (prefix); + have_enchant = TRUE; + } + } +#endif + for (i = 0; !have_enchant && i < G_N_ELEMENTS(libnames); ++i) { enchant = g_module_open(libnames[i], 0); if (enchant) diff --git a/src/fe-gtk/theme/tests/test-theme-application-input-style.c b/src/fe-gtk/theme/tests/test-theme-application-input-style.c index 91068d18..650abe3f 100644 --- a/src/fe-gtk/theme/tests/test-theme-application-input-style.c +++ b/src/fe-gtk/theme/tests/test-theme-application-input-style.c @@ -21,6 +21,7 @@ #include "../../fe-gtk.h" #include "../theme-application.h" +#include "../theme-css.h" #include "../theme-policy.h" #include "../../maingui.h" #include "../../../common/zoitechat.h" @@ -45,6 +46,13 @@ fe_message (char *msg, int flags) message_calls++; } +/* This test isolates input styling from the application's toplevel CSS. */ +char * +theme_css_build_toplevel_classes (void) +{ + return g_strdup (""); +} + void theme_css_reload_input_style (gboolean enabled, const PangoFontDescription *font_desc) { diff --git a/src/fe-text/fe-text.c b/src/fe-text/fe-text.c index d6855ce9..ffa962c7 100644 --- a/src/fe-text/fe-text.c +++ b/src/fe-text/fe-text.c @@ -43,6 +43,9 @@ #include "../common/util.h" #include "../common/fe.h" #include "fe-text.h" +#ifdef __APPLE__ +#include "../common/macos.h" +#endif static int done = FALSE; @@ -513,7 +516,13 @@ fe_args (int argc, char *argv[]) g_free (locale_path); g_free (base_path); #else - bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR); + bindtextdomain (GETTEXT_PACKAGE, +#ifdef __APPLE__ + zoitechat_macos_locale_dir () +#else + LOCALEDIR +#endif + ); #endif bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8"); textdomain (GETTEXT_PACKAGE);