mirror of
https://github.com/ZoiteChat/zoitechat.git
synced 2026-10-16 18:27:13 +00:00
rebuild macos build
This commit is contained in:
@@ -0,0 +1,358 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Build and audit a relocatable GTK3 application. No third-party Python packages."""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import platform
|
||||
import plistlib
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
MACH_MAGIC = {bytes.fromhex(h) for h in ("feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca")}
|
||||
SYSTEM_ROOTS = ("/usr/lib/", "/System/Library/")
|
||||
|
||||
|
||||
def run(*args: str | Path, env: dict[str, str] | None = None) -> str:
|
||||
return subprocess.check_output([str(arg) for arg in args], env=env, text=True).strip()
|
||||
|
||||
|
||||
def is_macho(path: Path) -> bool:
|
||||
if not path.is_file() or path.is_symlink():
|
||||
return False
|
||||
with path.open("rb") as stream:
|
||||
return stream.read(4) in MACH_MAGIC
|
||||
|
||||
|
||||
def dependencies(path: Path) -> list[str]:
|
||||
# Paths may contain spaces; splitting on whitespace would corrupt them.
|
||||
return re.findall(r"^\s+(.+?) \(compatibility version", run("otool", "-L", path), re.M)
|
||||
|
||||
|
||||
def rpaths(path: Path) -> list[str]:
|
||||
return re.findall(r"cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset", run("otool", "-l", path))
|
||||
|
||||
|
||||
def dylib_id(path: Path) -> str | None:
|
||||
lines = run("otool", "-D", path).splitlines()
|
||||
return lines[1].strip() if len(lines) > 1 else None
|
||||
|
||||
|
||||
def system_library(name: str) -> bool:
|
||||
return name.startswith(SYSTEM_ROOTS)
|
||||
|
||||
|
||||
def expand_path(name: str, loader: Path, executable: Path) -> Path:
|
||||
return Path(name.replace("@loader_path", str(loader.parent)).replace("@executable_path", str(executable.parent)))
|
||||
|
||||
|
||||
def resolve_dependency(name: str, loader: Path, executable: Path, search: list[Path]) -> Path:
|
||||
if name.startswith("@rpath/"):
|
||||
suffix = name[len("@rpath/"):]
|
||||
candidates = [directory / suffix for directory in search]
|
||||
else:
|
||||
candidates = [expand_path(name, loader, executable)]
|
||||
for candidate in candidates:
|
||||
if candidate.is_absolute() and candidate.is_file():
|
||||
return candidate.resolve()
|
||||
raise RuntimeError(f"Cannot resolve {name!r} from {loader}; searched {candidates}")
|
||||
|
||||
|
||||
class Relocator:
|
||||
def __init__(self, app: Path, executable: Path):
|
||||
self.app = app
|
||||
self.executable = executable
|
||||
self.frameworks = app / "Contents/Frameworks"
|
||||
self.frameworks.mkdir(parents=True)
|
||||
self.sources: dict[Path, Path] = {}
|
||||
self.names: dict[str, Path] = {}
|
||||
self.visited: set[Path] = set()
|
||||
|
||||
def copy_dependency(self, source: Path) -> Path:
|
||||
source = source.resolve()
|
||||
if ".framework/" in str(source):
|
||||
raise RuntimeError(f"Third-party frameworks require separate packaging support: {source}")
|
||||
if source in self.sources:
|
||||
return self.sources[source]
|
||||
existing = self.names.get(source.name)
|
||||
if existing and existing != source:
|
||||
raise RuntimeError(f"Conflicting library basename: {existing} and {source}")
|
||||
target = self.frameworks / source.name
|
||||
shutil.copy2(source, target)
|
||||
target.chmod(target.stat().st_mode | 0o200)
|
||||
self.sources[source] = target
|
||||
self.names[source.name] = source
|
||||
return target
|
||||
|
||||
def relocate(self, source: Path, target: Path, inherited: list[Path] | None = None) -> None:
|
||||
source = source.resolve()
|
||||
if target in self.visited:
|
||||
return
|
||||
self.visited.add(target)
|
||||
local = [expand_path(name, source, self.executable) for name in rpaths(source)]
|
||||
search = local + (inherited or [])
|
||||
identity = dylib_id(source)
|
||||
# Keep the existing signature allocation while editing: stripping it
|
||||
# first can leave __LINKEDIT padding that install_name_tool rejects.
|
||||
# The final inside-out codesign --force pass replaces stale signatures.
|
||||
edits: list[str | Path] = []
|
||||
for name in dependencies(source):
|
||||
if name == identity or system_library(name):
|
||||
continue
|
||||
dependency = resolve_dependency(name, source, self.executable, search)
|
||||
destination = self.copy_dependency(dependency)
|
||||
relative = os.path.relpath(destination, target.parent)
|
||||
edits += ["-change", name, "@loader_path/" + relative]
|
||||
self.relocate(dependency, destination, search)
|
||||
if identity:
|
||||
edits += ["-id", "@rpath/" + target.name]
|
||||
for name in sorted(set(rpaths(target))):
|
||||
edits += ["-delete_rpath", name]
|
||||
if edits:
|
||||
run("install_name_tool", *edits, target)
|
||||
|
||||
|
||||
def copy_tree(source: Path, target: Path) -> None:
|
||||
if source.is_dir():
|
||||
# Dereference symlinks: never leave links into the builder's Cellar.
|
||||
shutil.copytree(source, target, dirs_exist_ok=True, symlinks=False)
|
||||
|
||||
|
||||
def audit(app: Path) -> dict[str, object]:
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
architectures = set(run("lipo", "-archs", binary).split())
|
||||
minimum = (11, 0, 0)
|
||||
entries = []
|
||||
for path in sorted(app.rglob("*")):
|
||||
if path.is_symlink():
|
||||
resolved = path.resolve()
|
||||
if not resolved.is_relative_to(app.resolve()):
|
||||
raise RuntimeError(f"External symlink: {path} -> {resolved}")
|
||||
if not is_macho(path):
|
||||
continue
|
||||
if not architectures.issubset(set(run("lipo", "-archs", path).split())):
|
||||
raise RuntimeError(f"Architecture mismatch: {path}")
|
||||
identity = dylib_id(path)
|
||||
for name in dependencies(path):
|
||||
if name == identity or system_library(name):
|
||||
continue
|
||||
if not name.startswith("@loader_path/"):
|
||||
raise RuntimeError(f"Non-relocatable dependency: {path}: {name}")
|
||||
target = expand_path(name, path, binary).resolve()
|
||||
if not target.is_relative_to(app.resolve()) or not target.is_file():
|
||||
raise RuntimeError(f"Missing or external dependency: {path}: {name}")
|
||||
if rpaths(path):
|
||||
raise RuntimeError(f"Unexpected runtime search paths: {path}")
|
||||
load_commands = run("otool", "-l", path)
|
||||
versions = re.findall(r"\bminos (\d+(?:\.\d+){0,2})", load_commands)
|
||||
versions += re.findall(r"cmd LC_VERSION_MIN_MACOSX\s+cmdsize \d+\s+version (\d+(?:\.\d+){0,2})", load_commands)
|
||||
if not versions:
|
||||
raise RuntimeError(f"Missing deployment version: {path}")
|
||||
for version in versions:
|
||||
parts = tuple(int(value) for value in version.split("."))
|
||||
minimum = max(minimum, parts + (0,) * (3 - len(parts)))
|
||||
entries.append({"path": str(path.relative_to(app))})
|
||||
return {"architectures": sorted(architectures), "minimum_macos": ".".join(map(str, minimum if minimum[2] else minimum[:2])), "mach_o": entries}
|
||||
|
||||
|
||||
def package(stage: Path, app: Path, build_number: str) -> None:
|
||||
if not re.fullmatch(r"[1-9]\d*(?:\.\d+){0,2}", build_number):
|
||||
raise RuntimeError("Build number must be a positive Apple CFBundleVersion (for example 1 or 12.3)")
|
||||
if app.exists():
|
||||
raise RuntimeError(f"Output already exists; choose another --output or remove it explicitly: {app}")
|
||||
app.mkdir(parents=True)
|
||||
resources = app / "Contents/Resources"
|
||||
resources.mkdir(parents=True)
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
binary.parent.mkdir()
|
||||
shutil.copy2(stage / "bin/zoitechat", binary)
|
||||
copy_tree(stage / "share", resources / "share")
|
||||
copy_tree(stage / "lib/zoitechat/plugins", resources / "lib/zoitechat/plugins")
|
||||
relocator = Relocator(app, stage / "bin/zoitechat")
|
||||
seeds: list[tuple[Path, Path]] = [(stage / "bin/zoitechat", binary)]
|
||||
for source in (stage / "lib/zoitechat/plugins").glob("*"):
|
||||
if is_macho(source):
|
||||
seeds.append((source, resources / "lib/zoitechat/plugins" / source.name))
|
||||
|
||||
prefixes = {formula: Path(run("brew", "--prefix", formula)) for formula in (
|
||||
"gtk+3", "gdk-pixbuf", "glib", "glib-networking", "librsvg", "enchant", "adwaita-icon-theme", "hicolor-icon-theme", "gsettings-desktop-schemas", "ca-certificates", "openssl@3", "lua", "libarchive", "gtk-mac-integration")}
|
||||
# Runtime-loaded code is not visible in the main executable's otool output.
|
||||
module_groups = [
|
||||
(prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
|
||||
(prefixes["librsvg"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
|
||||
(prefixes["gtk+3"] / "lib/gtk-3.0/3.0.0/immodules", "lib/gtk-3.0/3.0.0/immodules"),
|
||||
(prefixes["glib-networking"] / "lib/gio/modules", "lib/gio/modules"),
|
||||
(prefixes["enchant"] / "lib/enchant-2", "lib/enchant-2"),
|
||||
(prefixes["openssl@3"] / "lib/ossl-modules", "lib/ossl-modules"),
|
||||
]
|
||||
for source_dir, relative in module_groups:
|
||||
target_dir = resources / relative
|
||||
target_dir.mkdir(parents=True, exist_ok=True)
|
||||
for source in sorted(source_dir.glob("*")):
|
||||
if source.suffix not in (".so", ".dylib") or not source.is_file():
|
||||
continue
|
||||
target = target_dir / source.name
|
||||
if target.exists() and target.read_bytes() != source.read_bytes():
|
||||
raise RuntimeError(f"Conflicting module: {target}")
|
||||
shutil.copy2(source.resolve(), target)
|
||||
seeds.append((source.resolve(), target))
|
||||
enchant = (prefixes["enchant"] / "lib/libenchant-2.dylib").resolve()
|
||||
# Register Enchant at Resources/lib so its public prefix relocation API
|
||||
# finds Resources/lib/enchant-2 and Resources/share/enchant.
|
||||
enchant_alias = resources / "lib/libenchant-2.dylib"
|
||||
shutil.copy2(enchant, enchant_alias)
|
||||
relocator.sources[enchant] = enchant_alias
|
||||
relocator.names[enchant.name] = enchant
|
||||
seeds.append((enchant, enchant_alias))
|
||||
for formula, prefix in prefixes.items():
|
||||
for name in ("icons", "glib-2.0/schemas", "locale", "enchant", "hunspell"):
|
||||
copy_tree(prefix / "share" / name, resources / "share" / name)
|
||||
ca = prefixes["ca-certificates"] / "share/ca-certificates/cacert.pem"
|
||||
if not ca.is_file():
|
||||
raise RuntimeError(f"CA bundle not found: {ca}")
|
||||
(resources / "certs").mkdir()
|
||||
shutil.copy2(ca, resources / "certs/ca-bundle.crt")
|
||||
schemas = resources / "share/glib-2.0/schemas"
|
||||
run(prefixes["glib"] / "bin/glib-compile-schemas", schemas)
|
||||
pixbuf_modules = sorted((resources / "lib/gdk-pixbuf-2.0/2.10.0/loaders").glob("*"))
|
||||
if not any("svg" in path.name for path in pixbuf_modules):
|
||||
raise RuntimeError("SVG loader missing: install librsvg")
|
||||
if list((resources / "lib/zoitechat/plugins").glob("fishlim.*")) and not list((resources / "lib/ossl-modules").glob("legacy.*")):
|
||||
raise RuntimeError("FiSH needs the OpenSSL legacy provider in the bundle")
|
||||
if not list((resources / "lib/gio/modules").glob("*tls*")):
|
||||
raise RuntimeError("GIO TLS backend missing: install glib-networking")
|
||||
# Query original binaries before relocation, then rewrite only the cached paths.
|
||||
pixbuf_query = prefixes["gdk-pixbuf"] / "bin/gdk-pixbuf-query-loaders"
|
||||
if not pixbuf_query.exists():
|
||||
pixbuf_query = prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
|
||||
for tool, module_dir, cache in (
|
||||
(pixbuf_query, "lib/gdk-pixbuf-2.0/2.10.0/loaders", "pixbuf-loaders.cache"),
|
||||
(prefixes["gtk+3"] / "bin/gtk-query-immodules-3.0", "lib/gtk-3.0/3.0.0/immodules", "gtk-immodules.cache"),
|
||||
):
|
||||
originals = [(source, target) for source, target in seeds if target.parent == resources / module_dir]
|
||||
# Never call a query tool with zero arguments: it would scan global modules.
|
||||
data = run(tool, *(source for source, _ in originals)) if originals else "# No external input-method modules\n"
|
||||
for source, target in originals:
|
||||
data = data.replace(str(source), "@ZOITECHAT_RESOURCES@/" + str(target.relative_to(resources)))
|
||||
(resources / cache).write_text(data + "\n")
|
||||
# The private font map loads the bundled Noto font; ordinary GTK fonts stay local.
|
||||
(resources / "fonts.conf").write_text('''<?xml version="1.0"?>
|
||||
<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
|
||||
<fontconfig>
|
||||
<dir>/System/Library/Fonts</dir><dir>/Library/Fonts</dir><dir>~/Library/Fonts</dir>
|
||||
<cachedir prefix="xdg">fontconfig</cachedir>
|
||||
<alias><family>sans-serif</family><prefer><family>Helvetica</family></prefer></alias>
|
||||
<alias><family>monospace</family><prefer><family>Menlo</family></prefer></alias>
|
||||
</fontconfig>
|
||||
''')
|
||||
(resources / "zoitechat-bundle").write_text("1\n")
|
||||
licenses = resources / "licenses"
|
||||
licenses.mkdir()
|
||||
shutil.copy2(ROOT / "COPYING", licenses / "ZoiteChat-COPYING")
|
||||
# Preserve the notices shipped with every installed Homebrew dependency.
|
||||
# brew deps traverses dependencies by default; --recursive is not an option.
|
||||
wanted = set(prefixes)
|
||||
for formula in prefixes:
|
||||
wanted.update(run("brew", "deps", "--formula", formula).splitlines())
|
||||
installed = [item for item in json.loads(run("brew", "info", "--json=v2", "--installed"))["formulae"]
|
||||
if item["name"] in wanted]
|
||||
for formula in installed:
|
||||
prefix = Path(run("brew", "--prefix", formula["name"]))
|
||||
notices = [p for p in prefix.iterdir() if p.is_file() and re.match(r"(?i)(copying|license|copyright|notice)", p.name)]
|
||||
if notices:
|
||||
target = licenses / formula["name"].replace("/", "-")
|
||||
target.mkdir(exist_ok=True)
|
||||
for notice in notices:
|
||||
shutil.copy2(notice, target / notice.name)
|
||||
(resources / "homebrew-dependencies.json").write_text(json.dumps(installed, indent=2) + "\n")
|
||||
for source, target in seeds:
|
||||
relocator.relocate(source, target)
|
||||
report = audit(app)
|
||||
(resources / "bundle-audit.json").write_text(json.dumps(report, indent=2) + "\n")
|
||||
# Use the actual highest deployment target of the executable and all dylibs.
|
||||
# Setting an older plist version cannot make newer Homebrew bottles compatible.
|
||||
version = (ROOT / "VERSION").read_text().strip()
|
||||
release = re.match(r"\d+\.\d+\.\d+", version)
|
||||
if not release:
|
||||
raise RuntimeError(f"Unsupported release version: {version}")
|
||||
plist = {
|
||||
"CFBundleIdentifier": "org.Zoitechat", "CFBundleExecutable": "zoitechat",
|
||||
"CFBundleName": "ZoiteChat", "CFBundleDisplayName": "ZoiteChat",
|
||||
"CFBundlePackageType": "APPL", "CFBundleShortVersionString": release.group(),
|
||||
"CFBundleVersion": build_number, "CFBundleIconFile": "ZoiteChat.icns",
|
||||
"LSMinimumSystemVersion": report["minimum_macos"], "NSHighResolutionCapable": True,
|
||||
"NSPrincipalClass": "NSApplication",
|
||||
"LSApplicationCategoryType": "public.app-category.social-networking",
|
||||
"DTSDKName": "macosx" + run("xcrun", "--sdk", "macosx", "--show-sdk-version"),
|
||||
"DTSDKBuild": run("xcrun", "--sdk", "macosx", "--show-sdk-build-version"),
|
||||
}
|
||||
with (app / "Contents/Info.plist").open("wb") as stream:
|
||||
plistlib.dump(plist, stream)
|
||||
iconset = app.parent / (app.stem + ".iconset")
|
||||
if iconset.exists():
|
||||
raise RuntimeError(f"Icon staging directory already exists: {iconset}")
|
||||
iconset.mkdir()
|
||||
try:
|
||||
# Rasterize the original vector at 1024px, then generate every icon size.
|
||||
large = iconset / "source.png"
|
||||
run(prefixes["librsvg"] / "bin/rsvg-convert", "-w", "1024", "-h", "1024", "-o", large, ROOT / "data/icons/zoitechat.svg")
|
||||
for size in (16, 32, 128, 256, 512):
|
||||
for scale in (1, 2):
|
||||
name = f"icon_{size}x{size}" + ("@2x" if scale == 2 else "") + ".png"
|
||||
run("sips", "-z", str(size * scale), str(size * scale), large, "--out", iconset / name)
|
||||
large.unlink()
|
||||
run("iconutil", "-c", "icns", iconset, "-o", resources / "ZoiteChat.icns")
|
||||
finally:
|
||||
shutil.rmtree(iconset)
|
||||
# Local builds need an ad-hoc signature after install_name_tool changes.
|
||||
sign(app, "-", None)
|
||||
print(f"Created {app}: {', '.join(report['architectures'])}, macOS {report['minimum_macos']}+")
|
||||
|
||||
|
||||
def sign(app: Path, identity: str, entitlements: Path | None, *, keychain: Path | None = None) -> None:
|
||||
audit(app)
|
||||
binaries = [p for p in app.rglob("*") if is_macho(p) and p != app / "Contents/MacOS/zoitechat"]
|
||||
options = [] if identity == "-" else ["--timestamp", "--options", "runtime"]
|
||||
if keychain is not None:
|
||||
options += ["--keychain", str(keychain)]
|
||||
for binary in sorted(binaries, key=lambda p: len(p.parts), reverse=True):
|
||||
run("codesign", "--force", "--sign", identity, *options, binary)
|
||||
main_options = ["--entitlements", str(entitlements)] if entitlements else []
|
||||
run("codesign", "--force", "--sign", identity, *options, *main_options, app)
|
||||
run("codesign", "--verify", "--deep", "--strict", "--verbose=2", app)
|
||||
|
||||
|
||||
def main() -> None:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
sub = parser.add_subparsers(dest="action", required=True)
|
||||
create = sub.add_parser("create")
|
||||
create.add_argument("--stage", type=Path, required=True)
|
||||
create.add_argument("--app", type=Path, required=True)
|
||||
create.add_argument("--build-number", default="1")
|
||||
verify = sub.add_parser("audit")
|
||||
verify.add_argument("app", type=Path)
|
||||
signing = sub.add_parser("sign")
|
||||
signing.add_argument("app", type=Path)
|
||||
signing.add_argument("--identity", required=True)
|
||||
signing.add_argument("--entitlements", type=Path)
|
||||
args = parser.parse_args()
|
||||
if platform.system() != "Darwin":
|
||||
parser.error("This tool requires macOS and the Xcode command-line tools")
|
||||
if args.action == "create":
|
||||
package(args.stage.resolve(), args.app.resolve(), args.build_number)
|
||||
elif args.action == "audit":
|
||||
print(json.dumps(audit(args.app.resolve()), indent=2))
|
||||
else:
|
||||
sign(args.app.resolve(), args.identity, args.entitlements)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
|
||||
sys.exit(f"macOS packaging failed: {error}")
|
||||
Reference in New Issue
Block a user