rebuild macos build

.github/workflows/macos-build.yml

@@ -0,0 +1,154 @@
+name: macOS build
+
+on:
+  workflow_dispatch:
+    inputs:
+      sign_and_notarize:
+        description: 'Sign with Developer ID and notarize using release credentials'
+        type: boolean
+        default: false
+  push:
+    branches: [master]
+    tags: ['v*']
+    paths:
+      - 'src/**'
+      - 'plugins/**'
+      - 'data/**'
+      - 'tools/**'
+      - 'po/**'
+      - 'meson*'
+      - 'VERSION'
+      - 'packaging/macos/**'
+      - '.github/workflows/macos-build.yml'
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'plugins/**'
+      - 'data/**'
+      - 'tools/**'
+      - 'po/**'
+      - 'meson*'
+      - 'VERSION'
+      - 'packaging/macos/**'
+      - '.github/workflows/macos-build.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' && !inputs.sign_and_notarize)
+    name: Native ${{ matrix.arch }} bundle
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    env:
+      HOMEBREW_NO_AUTO_UPDATE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Install native dependencies
+        run: brew bundle --file packaging/macos/Brewfile
+      - name: Test packaging logic
+        run: python3 -m unittest discover -s packaging/macos/tests -v
+      - name: Build and test application
+        run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
+      - name: Verify relocated startup
+        run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
+      - name: Create artifact preserving the application signature
+        run: ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-${{ matrix.arch }}.zip
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}
+          path: dist/ZoiteChat-${{ matrix.arch }}.zip
+          if-no-files-found: error
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-logs
+          path: build-macos/meson-logs/
+          if-no-files-found: ignore
+
+  release:
+    name: Signed and notarized ${{ matrix.arch }} release
+    if: >-
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
+      (github.event_name == 'workflow_dispatch' && inputs.sign_and_notarize && github.ref == 'refs/heads/master')
+    environment: macos-release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    env:
+      HOMEBREW_NO_AUTO_UPDATE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Validate release settings before building
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: python3 packaging/macos/release.py --check-config
+      - name: Install native dependencies
+        run: brew bundle --file packaging/macos/Brewfile
+      - name: Test packaging and release logic
+        run: python3 -m unittest discover -s packaging/macos/tests -v
+      - name: Build and test application
+        run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
+      - name: Verify relocated startup
+        run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
+      - name: Sign, notarize, staple and verify release
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: >-
+          python3 packaging/macos/release.py
+          --app dist/ZoiteChat.app
+          --output dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
+          --diagnostics dist/notarization
+          --notary-timeout 60m
+      - name: Upload signed and notarized application
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-signed-notarized
+          path: dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
+          if-no-files-found: error
+      - name: Upload notarization diagnostics
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-notarization-log
+          path: dist/notarization/*.json
+          if-no-files-found: ignore
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-release-build-logs
+          path: build-macos/meson-logs/
+          if-no-files-found: ignore

.gitignore

@@ -27,3 +27,9 @@ osx/.ZoiteChat.app
 *.dmg
 *.VC.db
 *.VC.opendb
+
+# Native macOS packaging output
+/build-macos*/
+/dist/
+/packaging/macos/__pycache__/
+/packaging/macos/tests/__pycache__/

meson.build

@@ -13,7 +13,9 @@ gnome = import('gnome')
 cc = meson.get_compiler('c')
 
 
-libgio_dep = dependency('gio-2.0', version: '>= 2.36.0')
+# The relocatable macOS runtime sets the GIO TLS database explicitly.
+libgio_dep = dependency('gio-2.0',
+  version: host_machine.system() == 'darwin' ? '>= 2.60.0' : '>= 2.36.0')
 libgmodule_dep = dependency('gmodule-2.0')
 
 libcanberra_dep = dependency('libcanberra', version: '>= 0.22',
@@ -29,7 +31,13 @@ else
                           required: get_option('tls'))
 endif
 
+gtk_mac_dep = disabler()
+if host_machine.system() == 'darwin' and get_option('gtk-frontend')
+  gtk_mac_dep = dependency('gtk-mac-integration-gtk3', required: get_option('mac-integration'))
+endif
+
 config_h = configuration_data()
+config_h.set('HAVE_GTK_MAC', host_machine.system() == 'darwin' and gtk_mac_dep.found())
 config_h.set_quoted('PACKAGE_VERSION', meson.project_version())
 config_h.set_quoted('PACKAGE_NAME', meson.project_name())
 config_h.set_quoted('GETTEXT_PACKAGE', 'zoitechat')
@@ -99,6 +107,12 @@ global_cflags = [
   '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_36',
   '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_36',
 ]
+if host_machine.system() == 'darwin'
+  global_cflags = [
+    '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_60',
+    '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_60',
+  ]
+endif
 test_cflags = [
   '-funsigned-char',
   '-Wno-conversion',
@@ -159,6 +173,10 @@ foreach ldflag : test_ldflags
     global_ldflags += ldflag
   endif
 endforeach
+if host_machine.system() == 'darwin'
+  # Leave room for install_name_tool to rewrite packaged dependencies.
+  global_ldflags += '-Wl,-headerpad_max_install_names'
+endif
 add_project_link_arguments(global_ldflags, language: 'c')
 
 subdir('src')

meson_options.txt

@@ -23,6 +23,10 @@ option('appindicator', type: 'feature', value: 'auto',
   description: 'Use Ayatana/AppIndicator-based tray backend for GTK frontend (non-Windows only)'
 )
 
+# macOS only; ignored by other platforms.
+option('mac-integration', type: 'feature', value: 'auto',
+  description: 'Native macOS menu bar, Dock and application lifecycle')
+
 # Install options
 option('dbus-service-use-appid', type: 'boolean', value: false,
   description: 'Rename dbus service to match app-id, required for Flatpak'

packaging/macos/Brewfile

@@ -0,0 +1,15 @@
+brew "meson"
+brew "ninja"
+brew "pkgconf"
+brew "python"
+brew "gettext"
+brew "gtk+3"
+brew "gtk-mac-integration"
+brew "libarchive"
+brew "openssl@3"
+brew "lua"
+brew "librsvg"
+brew "glib-networking"
+brew "adwaita-icon-theme"
+brew "enchant"
+brew "ca-certificates"

packaging/macos/README.md

@@ -0,0 +1,335 @@
+# Native macOS build and distribution
+
+This builds GTK3 with the native Quartz backend, macOS menus/Dock integration,
+UserNotifications, translations, bundled emoji, TLS, image loaders and supported
+native plugins. It creates a self-contained `ZoiteChat.app`; end users do not
+need Homebrew, XQuartz or Python. No system-wide ZoiteChat installation occurs.
+
+The source changes are conditional on Darwin. Windows and Linux retain their
+existing notification backends and feature defaults. This adds a separate
+macOS workflow; it does not replace existing workflows.
+
+## 1. Install build prerequisites
+
+Use a Mac with a currently supported macOS release and native Homebrew. On Apple
+Silicon, use ARM Homebrew (`/opt/homebrew`), not Intel Homebrew under Rosetta.
+Intel builds use Intel Homebrew (`/usr/local`). Install Xcode command-line tools
+and Homebrew from https://brew.sh if absent. Full current Xcode is recommended
+for distribution and needed to meet the current App Store submission SDK rules.
+
+```sh
+xcode-select --install
+# Run once if the command-line tools are not installed; let installation finish.
+
+cd /path/to/zoitechat
+brew bundle --file packaging/macos/Brewfile
+python3 packaging/macos/build.py
+open dist/ZoiteChat.app
+```
+
+The build compiles the app, runs its Meson tests, stages an installation within
+`build-macos/macos-stage`, bundles and rewrites every non-system Mach-O dependency,
+creates the icon and plist, audits the result, and signs it ad hoc for local use.
+It refuses to overwrite an existing output app. For another build, choose a new
+output path, or explicitly delete your old generated app before rebuilding:
+
+```sh
+python3 packaging/macos/build.py --output dist/ZoiteChat-test2.app --build-number 2
+```
+
+The same build directory can be reconfigured. Use a different build directory
+for another architecture or the experimental store variant. Do not change
+architectures within one Meson build directory.
+
+Homebrew packages change over time; this is a repeatable procedure, not a
+bit-for-bit reproducible dependency lock. The bundle records dependency versions
+in `Contents/Resources/homebrew-dependencies.json`. Retain that record and the
+release's source commit. For a reproducible release, archive the exact dependency
+sources and build them in a controlled prefix, or maintain pinned Homebrew formulae.
+
+## 2. Verify portability and behavior
+
+```sh
+python3 -m unittest discover -s packaging/macos/tests -v
+python3 packaging/macos/bundle.py audit dist/ZoiteChat.app
+python3 packaging/macos/smoke.py dist/ZoiteChat.app
+```
+
+The smoke check copies the app to a path containing spaces, verifies its signature,
+runs `--version`, and keeps an isolated GUI process alive for ten seconds without
+connecting to IRC. It tests startup, not interaction or long-running stability.
+
+The audit verifies the entire dependency closure, including GTK image/input
+modules, GIO TLS, Enchant providers, OpenSSL providers and ZoiteChat plugins. It
+fails on missing libraries, external symlinks/search paths, architecture mismatches
+or unresolved load commands. The minimum macOS version in the plist is derived
+from **all** bundled binaries, including Homebrew libraries. Lowering that plist
+value does not make newer dependency bottles run on an older Mac.
+
+Before releasing, test on a second Mac without Homebrew installed:
+
+- Launch from Finder and from a relocated/read-only location; verify Dock and
+  menu bar, preferences persistence, dark/light themes and normal shutdown.
+- Connect with verified TLS, exercise SASL authentication and reconnect.
+- Send Unicode/emoji, render SVG/PNG/JPEG icons/images, and test HTTPS image previews.
+- Verify clipboard shortcuts, input methods, notifications/permission denial,
+  detach/reattach tabs, focus changes, unread highlights and notification clicks.
+- Send/receive/resume DCC, write downloads and logs, import/export themes/settings.
+- Test FiSH, Lua and DCC checksum plugins in the direct build.
+- Exercise accessibility with VoiceOver and keyboard-only navigation.
+
+Direct builds include Lua, FiSH and checksum, and retain the plugin loader.
+Python/Perl are explicitly not bundled: reliable redistribution requires packaging
+and auditing their interpreter runtimes, standard libraries and extensions.
+Linux `/proc`/PCI sysinfo is not built on macOS. These are macOS build choices;
+other platforms' plugin defaults are unchanged. macOS uses the existing password
+storage fallback; this patch does not add a Keychain backend. Audit credentials
+storage before adopting a stronger macOS security claim.
+
+Desktop URL registration (`irc://` in Finder/browser) is not advertised by the
+plist; command-line IRC URLs continue to work. A native open-URL event handler
+and single-instance forwarding need separate integration before registering those
+schemes. AppIndicator and Linux D-Bus scripting/single-instance support are not
+used on macOS.
+
+## 3. Sign and notarize for direct downloads
+
+Local ad-hoc builds are for testing; they are not notarized releases. For public
+release, enroll in Apple's Developer Program, install your **Developer ID
+Application** certificate with its private key, then sign using that identity.
+Use your actual certificate identity in place of the example:
+
+```sh
+python3 packaging/macos/bundle.py sign dist/ZoiteChat.app \
+  --identity 'Developer ID Application: YOUR NAME (TEAMID)' \
+  --entitlements packaging/macos/direct.entitlements
+
+# Store credentials once in your login Keychain; enter your own values interactively.
+xcrun notarytool store-credentials ZoiteChat-notary
+
+ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-notarization.zip
+xcrun notarytool submit dist/ZoiteChat-notarization.zip \
+  --keychain-profile ZoiteChat-notary --wait
+
+# Only after notarization has succeeded:
+xcrun stapler staple dist/ZoiteChat.app
+xcrun stapler validate dist/ZoiteChat.app
+spctl --assess --type execute --verbose=2 dist/ZoiteChat.app
+
+ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-macos.zip
+```
+
+Signing runs inside-out, verifies the final bundle and enables hardened runtime.
+It does not use `codesign --deep` to sign. `--deep` is used only for verification.
+The direct entitlement allows users' independently signed native plugins; it
+relaxes library validation, not the entire hardened runtime. No JIT or executable
+memory entitlements are added. Do not change bundle contents after signing; signing
+again is required after any code/resource edit. Stapling is Apple's supported
+post-signing operation.
+
+Publish exact corresponding source for ZoiteChat and satisfy the applicable
+licenses of each bundled dependency. Notices and dependency metadata are included,
+but those alone do not satisfy every source-distribution obligation. Review the
+notarization log if rejected; the script does not silently bypass Gatekeeper.
+
+### Automate signing and notarization with GitHub Actions
+
+The workflow now has a separate signed/notarized release job for both
+architectures. It uses Developer ID distribution for direct downloads, not Mac
+App Store signing. You can manage it from Windows/Linux; GitHub's macOS runners
+perform all signing, notarization and stapling.
+
+Prepare these repository Actions secrets under **Settings → Secrets and
+variables → Actions**, or store them as environment secrets in **macos-release**.
+The certificate setting names are unchanged from the original instructions.
+The three `APPLE_API_*` settings are new notarization credentials:
+
+| Name | Type | Value |
+| --- | --- | --- |
+| `MACOS_CERTIFICATE_P12_BASE64` | Secret | Base64-encoded Developer ID Application `.p12`, including its private key |
+| `MACOS_CERTIFICATE_PASSWORD` | Secret | Password used to export that `.p12` |
+| `MACOS_SIGNING_IDENTITY` | Variable, or Secret | Exact `Developer ID Application: YOUR NAME (TEAMID)` identity; the matching certificate's SHA-1 fingerprint is also accepted |
+| `APPLE_API_KEY_P8` | Secret | Entire plain-text App Store Connect **Team API key** `.p8` file, including PEM header/footer and newlines |
+| `APPLE_API_KEY_ID` | Secret | That API key's Key ID |
+| `APPLE_API_ISSUER_ID` | Secret | The Team API key's Issuer ID UUID; this is **not** your Apple Team ID |
+
+Repository variables are under the **Variables** tab. If the identity is entered
+as both a variable and a secret, the variable takes precedence. No separate
+keychain password is needed; the job generates a temporary random password.
+The `.p8` is the notarization API key; it does not replace the signing `.p12`.
+No Apple ID password or app-specific password is used by this configuration.
+
+To obtain the API key, open **App Store Connect → Users and Access → Integrations
+→ App Store Connect API → Team Keys → Generate API Key**. Choose **Developer**
+access for notarization. If API access is not enabled, the Account Holder must
+request it first. Download the `.p8` and record the Key ID and Issuer ID. Use a
+**Team** key with this workflow: individual API keys use different authentication
+and are not supported by this issuer-based configuration. Apple allows the
+private key download only once, so retain your copy securely.
+
+For the certificate, export the Developer ID Application identity (certificate
+plus private key) from Keychain Access as a password-protected `.p12`.
+If you generated the CSR with OpenSSL on Linux/WSL, you can also create it there.
+Assuming Apple's downloaded DER certificate has been saved as
+`developerID_application.cer`, and you retained `zoitechat-signing.key`:
+
+```sh
+openssl x509 -inform DER -in developerID_application.cer \
+  -out zoitechat-signing.pem
+openssl pkcs12 -export -inkey zoitechat-signing.key \
+  -in zoitechat-signing.pem -out ZoiteChat-signing.p12
+
+# Enter the existing private-key password, then choose the .p12 export password.
+# Copy the resulting Base64 text into MACOS_CERTIFICATE_P12_BASE64:
+openssl base64 -A -in ZoiteChat-signing.p12 -out ZoiteChat-signing.p12.base64
+
+# Read the certificate's commonName to obtain MACOS_SIGNING_IDENTITY:
+openssl x509 -in zoitechat-signing.pem -noout -subject -nameopt multiline
+```
+
+Upload only the public CSR to Apple. Put the `.p12` Base64, export password and
+API credentials in GitHub settings, never in the repository or build artifacts.
+
+Once these patches are committed to `master` and the settings are ready:
+
+1. Open **Actions → macOS build → Run workflow**.
+2. Select **master** and enable **Sign with Developer ID and notarize using
+   release credentials**.
+3. Run the workflow. It creates separate Apple Silicon and Intel release jobs.
+4. After success, download `ZoiteChat-macos-arm64-signed-notarized` or
+   `ZoiteChat-macos-x86_64-signed-notarized`. The ZIP inside contains the signed,
+   stapled app. Actions artifacts wrap it in their own download archive.
+
+A push of a `v*` tag also triggers the signed release jobs automatically, so wait
+until credentials are configured before pushing a release tag. Normal branch
+pushes, pull requests and manual runs with the checkbox off continue to build
+ad-hoc test artifacts without any signing secrets. Manual credentialed releases
+are restricted to `master`; pull requests cannot invoke the release job.
+Missing/malformed release settings fail before the Homebrew/build steps rather
+than producing an unsigned artifact marked as a release.
+
+The release jobs use the GitHub environment **macos-release**. Repository secrets
+work with it; environment secrets can override them. Configure environment
+branch/tag restrictions or required reviewers if that fits your repository's
+release process. This workflow does not automatically create a GitHub Release,
+publish to zoitechat.org, or upload to App Store Connect; it produces downloadable
+signed/notarized artifacts for you to publish.
+
+The job imports the `.p12` into a temporary keychain, installs Apple's public
+Developer ID intermediate certificates, verifies a valid matching identity,
+and signs inside-out with hardened runtime and the direct plugin entitlement.
+It uses the existing bundle audit and then submits a ZIP with `notarytool`.
+After Apple reports **Accepted**, it staples the ticket to the `.app`, verifies
+stapling/signatures and Gatekeeper acceptance, and creates a **new** final ZIP.
+Private credential files and the temporary keychain are cleaned up on normal
+success/failure paths; hosted runner VMs are also discarded after the job.
+
+The default Apple wait limit is **60 minutes** within a **180-minute** release
+job. A rejected, failed or still-pending submission produces no final release
+ZIP. The `ZoiteChat-macos-<arch>-notarization-log` artifact retains the submission
+ID, status and Apple's available diagnostic log. First submissions can take
+longer; check the saved ID with `notarytool info` and your API credentials. An
+accepted submission still requires stapling and repackaging before publication;
+rerunning this workflow starts a new build and submission. To increase the wait
+limit, update `--notary-timeout` and allow adequate job timeout for build plus wait.
+
+Both architecture builds receive the same bundle build number for one workflow
+run. The API credentials are supplied only to the config-check/release steps,
+not to Homebrew, compiler tests, ordinary builds or pull-request jobs.
+
+## 4. Mac App Store: experimental groundwork, not submission-ready
+
+A working direct-download app is not sufficient for App Store submission. This
+repository inherits GPL-2.0-or-later code from XChat/HexChat and other contributors.
+App Store terms and GPL obligations require a licensing review; do not assume
+that signing, a custom EULA, or relicensing only your new changes resolves rights
+to inherited code. This patch changes no licenses or copyright permissions.
+
+An isolated sandbox-test build is provided:
+
+```sh
+python3 packaging/macos/build.py --store-experimental \
+  --build-dir build-macos-store --output dist/ZoiteChat-store-test.app \
+  --build-number 1
+
+# Local sandbox experimentation (not an uploadable distribution signature):
+python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
+  --identity - --entitlements packaging/macos/store-experimental.entitlements
+open dist/ZoiteChat-store-test.app
+```
+
+The separate store variant excludes loadable plugins and scripting runtimes.
+The template grants sandboxed client/server networking, user-selected files and
+Downloads. The direct version retains its plugin functionality. This is an
+explicit experimental variant, not a change to Windows/Linux or direct builds.
+
+Before a store package can be regarded as a release candidate:
+
+1. Resolve the inherited GPL/dependency-license distribution question and review
+   Apple's current SDK, content/chat moderation, privacy and accessibility rules.
+2. Register `org.Zoitechat` (or change the plist identifier consistently if already
+   owned by another developer), create App Store Connect metadata, and choose a
+   unique incrementing build number. Use a stable release, not a `-dev` snapshot.
+3. Test sandboxed settings/logs, notifications, SASL/TLS, HTTPS and DCC on a real
+   Mac. GTK dialogs are not assumed to grant Powerbox access. Add native
+   `NSOpenPanel`/`NSSavePanel` integration and security-scoped bookmarks for
+   persistent access to user-selected files. The entitlement template alone does
+   not solve persistent file access. `/EXEC`, custom external commands, user
+   plugin loading and arbitrary external paths cannot be promised under sandbox.
+4. Add required privacy manifest declarations based on an actual API audit of the
+   app and dependencies; do not submit an invented empty compliance declaration.
+5. Obtain matching App Store distribution application/installer certificates and
+   a matching provisioning profile. Generate team-specific signing entitlements
+   from the profile with Xcode; do not use Developer ID or the generic local-test
+   template as a store distribution identity/profile.
+6. Embed the matching profile as `Contents/embedded.provisionprofile` **before**
+   final signing. Sign embedded libraries with the distribution identity, then
+   the app with its profile-authorized entitlements (use `bundle.py sign` with
+   that identity and generated entitlement file). Package with Apple's
+   `productbuild`, validate and upload with Transporter/App Store Connect, then
+   test the App Store processed build via TestFlight before submission.
+
+Example **after those prerequisites are satisfied**:
+
+```sh
+# Use the actual prepared profile and team-specific entitlements:
+cp /path/to/ZoiteChat.provisionprofile \
+  dist/ZoiteChat-store-test.app/Contents/embedded.provisionprofile
+python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
+  --identity 'YOUR APP STORE APPLICATION CERTIFICATE IDENTITY' \
+  --entitlements /path/to/ZoiteChat-distribution.entitlements
+productbuild --component dist/ZoiteChat-store-test.app /Applications \
+  --sign 'YOUR APP STORE INSTALLER CERTIFICATE IDENTITY' dist/ZoiteChat-store.pkg
+```
+
+No App Store approval, sandbox compatibility or legal compatibility is asserted.
+For an initial macOS release, the signed/notarized direct build is the practical
+path while those issues are resolved.
+
+## 5. CI and architecture support
+
+`.github/workflows/macos-build.yml` adds independent Apple Silicon and Intel jobs.
+Ordinary jobs install prerequisites, run tests, create/audit/ad-hoc-sign the
+bundle, check relocated startup and upload test ZIPs. They need no Apple secrets.
+The separate release jobs add Developer ID signing, Apple notarization, stapling
+and final verification. Only their successful output is named signed/notarized.
+
+Homebrew may build unsupported Intel bottles from source; that can be slower.
+The workflow uses native runners and does not claim a universal application.
+Do not merge only the main executable with `lipo`: a universal release must merge
+and validate every bundled dylib, module and plugin plus matching resources.
+Signing must happen after that merge. Publish separate architecture downloads
+until a full universal dependency pipeline is available.
+
+## References
+
+- GTK on macOS: https://www.gtk.org/docs/installations/macos
+- GTK macOS backend: https://docs.gtk.org/gtk3/macos.html
+- Apple distribution signing: https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac
+- Apple packaging: https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution
+- GitHub certificate import: https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications
+- Apple notarization authentication: https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool
+- App Store Connect API keys: https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/
+- Apple review rules (especially 1.2 and 2.4.5): https://developer.apple.com/app-store/review/guidelines/
+- Apple sandbox file access: https://developer.apple.com/documentation/security/accessing-files-from-the-macos-app-sandbox
+- FSF discussion of GPL and App Store terms (historical, not a current legal determination): https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement

packaging/macos/build.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Compile, test, stage and package ZoiteChat on the host Mac."""
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import sys
+
+from bundle import ROOT, package, run
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--build-dir", type=Path, default=Path("build-macos"))
+    parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat.app"))
+    parser.add_argument("--build-number", default="1")
+    parser.add_argument("--store-experimental", action="store_true", help="Build a separate sandbox test variant without loadable plugins; not submission approval")
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("Build on macOS; cross-compiling from Linux is not supported")
+    if args.output.exists():
+        parser.error("Output already exists; use a new --output or explicitly remove the old app")
+    build = args.build_dir.resolve()
+    if build == ROOT or ROOT.is_relative_to(build):
+        parser.error("Build directory must not contain the source checkout")
+    run("xcrun", "--find", "clang")
+    env = os.environ.copy()
+    prefixes = [Path(run("brew", "--prefix", name)) for name in ("gettext", "openssl@3", "libarchive", "lua", "gtk+3", "gtk-mac-integration")]
+    brew = Path(run("brew", "--prefix"))
+    # Keg-only gettext, OpenSSL and libarchive are not necessarily in PATH/pkg-config.
+    env["PATH"] = os.pathsep.join([str(p / "bin") for p in prefixes] + [str(brew / "bin"), env.get("PATH", "")])
+    env["PKG_CONFIG_PATH"] = os.pathsep.join([str(p / "lib/pkgconfig") for p in prefixes] + [str(brew / "lib/pkgconfig"), str(brew / "share/pkgconfig"), env.get("PKG_CONFIG_PATH", "")])
+    # Native dependency bottles determine the true deployment target; the bundle
+    # auditor derives the final minimum rather than promising an arbitrary old OS.
+    env.setdefault("MACOSX_DEPLOYMENT_TARGET", "11.0")
+    backend = run("pkg-config", "--variable=targets", "gtk+-3.0", env=env).split()
+    if "quartz" not in backend:
+        parser.error(f"GTK must provide the native Quartz backend, got {backend}")
+    # Do not silently select an XQuartz GTK stack or mix Intel/ARM Homebrew prefixes.
+    machine = platform.machine()
+    if machine not in ("arm64", "x86_64"):
+        parser.error(f"Unsupported architecture: {machine}")
+    options = [
+        "--prefix=/", "--libdir=lib", "--buildtype=release", "-Dgtk-frontend=true",
+        "-Dtext-frontend=false", "-Dmac-integration=enabled", "-Ddbus=disabled",
+        "-Dlibcanberra=disabled", "-Dappindicator=disabled", "-Dinstall-appdata=false",
+        "-Dwith-sysinfo=false", "-Dwith-python=false", "-Dwith-perl=false",
+        "-Dwith-lua=lua", "-Dwith-fishlim=true", "-Dwith-checksum=true",
+        "-Dplugin=" + ("false" if args.store_experimental else "true"),
+    ]
+    if (build / "meson-private/coredata.dat").exists():
+        options.insert(0, "--reconfigure")
+    subprocess.run(["meson", "setup", str(build), str(ROOT), *options], env=env, check=True)
+    subprocess.run(["meson", "compile", "-C", str(build)], env=env, check=True)
+    subprocess.run(["meson", "test", "-C", str(build), "--print-errorlogs"], env=env, check=True)
+    stage = build / "macos-stage"
+    if stage.exists():
+        shutil.rmtree(stage)
+    subprocess.run(["meson", "install", "-C", str(build), "--destdir", str(stage)], env=env, check=True)
+    package(stage, args.output.resolve(), args.build_number)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
+        sys.exit(f"macOS build failed: {error}")

packaging/macos/bundle.py

@@ -0,0 +1,358 @@
+#!/usr/bin/env python3
+"""Build and audit a relocatable GTK3 application. No third-party Python packages."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import platform
+import plistlib
+import re
+import shutil
+import subprocess
+import sys
+
+ROOT = Path(__file__).resolve().parents[2]
+MACH_MAGIC = {bytes.fromhex(h) for h in ("feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca")}
+SYSTEM_ROOTS = ("/usr/lib/", "/System/Library/")
+
+
+def run(*args: str | Path, env: dict[str, str] | None = None) -> str:
+    return subprocess.check_output([str(arg) for arg in args], env=env, text=True).strip()
+
+
+def is_macho(path: Path) -> bool:
+    if not path.is_file() or path.is_symlink():
+        return False
+    with path.open("rb") as stream:
+        return stream.read(4) in MACH_MAGIC
+
+
+def dependencies(path: Path) -> list[str]:
+    # Paths may contain spaces; splitting on whitespace would corrupt them.
+    return re.findall(r"^\s+(.+?) \(compatibility version", run("otool", "-L", path), re.M)
+
+
+def rpaths(path: Path) -> list[str]:
+    return re.findall(r"cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset", run("otool", "-l", path))
+
+
+def dylib_id(path: Path) -> str | None:
+    lines = run("otool", "-D", path).splitlines()
+    return lines[1].strip() if len(lines) > 1 else None
+
+
+def system_library(name: str) -> bool:
+    return name.startswith(SYSTEM_ROOTS)
+
+
+def expand_path(name: str, loader: Path, executable: Path) -> Path:
+    return Path(name.replace("@loader_path", str(loader.parent)).replace("@executable_path", str(executable.parent)))
+
+
+def resolve_dependency(name: str, loader: Path, executable: Path, search: list[Path]) -> Path:
+    if name.startswith("@rpath/"):
+        suffix = name[len("@rpath/"):]
+        candidates = [directory / suffix for directory in search]
+    else:
+        candidates = [expand_path(name, loader, executable)]
+    for candidate in candidates:
+        if candidate.is_absolute() and candidate.is_file():
+            return candidate.resolve()
+    raise RuntimeError(f"Cannot resolve {name!r} from {loader}; searched {candidates}")
+
+
+class Relocator:
+    def __init__(self, app: Path, executable: Path):
+        self.app = app
+        self.executable = executable
+        self.frameworks = app / "Contents/Frameworks"
+        self.frameworks.mkdir(parents=True)
+        self.sources: dict[Path, Path] = {}
+        self.names: dict[str, Path] = {}
+        self.visited: set[Path] = set()
+
+    def copy_dependency(self, source: Path) -> Path:
+        source = source.resolve()
+        if ".framework/" in str(source):
+            raise RuntimeError(f"Third-party frameworks require separate packaging support: {source}")
+        if source in self.sources:
+            return self.sources[source]
+        existing = self.names.get(source.name)
+        if existing and existing != source:
+            raise RuntimeError(f"Conflicting library basename: {existing} and {source}")
+        target = self.frameworks / source.name
+        shutil.copy2(source, target)
+        target.chmod(target.stat().st_mode | 0o200)
+        self.sources[source] = target
+        self.names[source.name] = source
+        return target
+
+    def relocate(self, source: Path, target: Path, inherited: list[Path] | None = None) -> None:
+        source = source.resolve()
+        if target in self.visited:
+            return
+        self.visited.add(target)
+        local = [expand_path(name, source, self.executable) for name in rpaths(source)]
+        search = local + (inherited or [])
+        identity = dylib_id(source)
+        # Keep the existing signature allocation while editing: stripping it
+        # first can leave __LINKEDIT padding that install_name_tool rejects.
+        # The final inside-out codesign --force pass replaces stale signatures.
+        edits: list[str | Path] = []
+        for name in dependencies(source):
+            if name == identity or system_library(name):
+                continue
+            dependency = resolve_dependency(name, source, self.executable, search)
+            destination = self.copy_dependency(dependency)
+            relative = os.path.relpath(destination, target.parent)
+            edits += ["-change", name, "@loader_path/" + relative]
+            self.relocate(dependency, destination, search)
+        if identity:
+            edits += ["-id", "@rpath/" + target.name]
+        for name in sorted(set(rpaths(target))):
+            edits += ["-delete_rpath", name]
+        if edits:
+            run("install_name_tool", *edits, target)
+
+
+def copy_tree(source: Path, target: Path) -> None:
+    if source.is_dir():
+        # Dereference symlinks: never leave links into the builder's Cellar.
+        shutil.copytree(source, target, dirs_exist_ok=True, symlinks=False)
+
+
+def audit(app: Path) -> dict[str, object]:
+    binary = app / "Contents/MacOS/zoitechat"
+    architectures = set(run("lipo", "-archs", binary).split())
+    minimum = (11, 0, 0)
+    entries = []
+    for path in sorted(app.rglob("*")):
+        if path.is_symlink():
+            resolved = path.resolve()
+            if not resolved.is_relative_to(app.resolve()):
+                raise RuntimeError(f"External symlink: {path} -> {resolved}")
+        if not is_macho(path):
+            continue
+        if not architectures.issubset(set(run("lipo", "-archs", path).split())):
+            raise RuntimeError(f"Architecture mismatch: {path}")
+        identity = dylib_id(path)
+        for name in dependencies(path):
+            if name == identity or system_library(name):
+                continue
+            if not name.startswith("@loader_path/"):
+                raise RuntimeError(f"Non-relocatable dependency: {path}: {name}")
+            target = expand_path(name, path, binary).resolve()
+            if not target.is_relative_to(app.resolve()) or not target.is_file():
+                raise RuntimeError(f"Missing or external dependency: {path}: {name}")
+        if rpaths(path):
+            raise RuntimeError(f"Unexpected runtime search paths: {path}")
+        load_commands = run("otool", "-l", path)
+        versions = re.findall(r"\bminos (\d+(?:\.\d+){0,2})", load_commands)
+        versions += re.findall(r"cmd LC_VERSION_MIN_MACOSX\s+cmdsize \d+\s+version (\d+(?:\.\d+){0,2})", load_commands)
+        if not versions:
+            raise RuntimeError(f"Missing deployment version: {path}")
+        for version in versions:
+            parts = tuple(int(value) for value in version.split("."))
+            minimum = max(minimum, parts + (0,) * (3 - len(parts)))
+        entries.append({"path": str(path.relative_to(app))})
+    return {"architectures": sorted(architectures), "minimum_macos": ".".join(map(str, minimum if minimum[2] else minimum[:2])), "mach_o": entries}
+
+
+def package(stage: Path, app: Path, build_number: str) -> None:
+    if not re.fullmatch(r"[1-9]\d*(?:\.\d+){0,2}", build_number):
+        raise RuntimeError("Build number must be a positive Apple CFBundleVersion (for example 1 or 12.3)")
+    if app.exists():
+        raise RuntimeError(f"Output already exists; choose another --output or remove it explicitly: {app}")
+    app.mkdir(parents=True)
+    resources = app / "Contents/Resources"
+    resources.mkdir(parents=True)
+    binary = app / "Contents/MacOS/zoitechat"
+    binary.parent.mkdir()
+    shutil.copy2(stage / "bin/zoitechat", binary)
+    copy_tree(stage / "share", resources / "share")
+    copy_tree(stage / "lib/zoitechat/plugins", resources / "lib/zoitechat/plugins")
+    relocator = Relocator(app, stage / "bin/zoitechat")
+    seeds: list[tuple[Path, Path]] = [(stage / "bin/zoitechat", binary)]
+    for source in (stage / "lib/zoitechat/plugins").glob("*"):
+        if is_macho(source):
+            seeds.append((source, resources / "lib/zoitechat/plugins" / source.name))
+
+    prefixes = {formula: Path(run("brew", "--prefix", formula)) for formula in (
+        "gtk+3", "gdk-pixbuf", "glib", "glib-networking", "librsvg", "enchant", "adwaita-icon-theme", "hicolor-icon-theme", "gsettings-desktop-schemas", "ca-certificates", "openssl@3", "lua", "libarchive", "gtk-mac-integration")}
+    # Runtime-loaded code is not visible in the main executable's otool output.
+    module_groups = [
+        (prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
+        (prefixes["librsvg"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
+        (prefixes["gtk+3"] / "lib/gtk-3.0/3.0.0/immodules", "lib/gtk-3.0/3.0.0/immodules"),
+        (prefixes["glib-networking"] / "lib/gio/modules", "lib/gio/modules"),
+        (prefixes["enchant"] / "lib/enchant-2", "lib/enchant-2"),
+        (prefixes["openssl@3"] / "lib/ossl-modules", "lib/ossl-modules"),
+    ]
+    for source_dir, relative in module_groups:
+        target_dir = resources / relative
+        target_dir.mkdir(parents=True, exist_ok=True)
+        for source in sorted(source_dir.glob("*")):
+            if source.suffix not in (".so", ".dylib") or not source.is_file():
+                continue
+            target = target_dir / source.name
+            if target.exists() and target.read_bytes() != source.read_bytes():
+                raise RuntimeError(f"Conflicting module: {target}")
+            shutil.copy2(source.resolve(), target)
+            seeds.append((source.resolve(), target))
+    enchant = (prefixes["enchant"] / "lib/libenchant-2.dylib").resolve()
+    # Register Enchant at Resources/lib so its public prefix relocation API
+    # finds Resources/lib/enchant-2 and Resources/share/enchant.
+    enchant_alias = resources / "lib/libenchant-2.dylib"
+    shutil.copy2(enchant, enchant_alias)
+    relocator.sources[enchant] = enchant_alias
+    relocator.names[enchant.name] = enchant
+    seeds.append((enchant, enchant_alias))
+    for formula, prefix in prefixes.items():
+        for name in ("icons", "glib-2.0/schemas", "locale", "enchant", "hunspell"):
+            copy_tree(prefix / "share" / name, resources / "share" / name)
+    ca = prefixes["ca-certificates"] / "share/ca-certificates/cacert.pem"
+    if not ca.is_file():
+        raise RuntimeError(f"CA bundle not found: {ca}")
+    (resources / "certs").mkdir()
+    shutil.copy2(ca, resources / "certs/ca-bundle.crt")
+    schemas = resources / "share/glib-2.0/schemas"
+    run(prefixes["glib"] / "bin/glib-compile-schemas", schemas)
+    pixbuf_modules = sorted((resources / "lib/gdk-pixbuf-2.0/2.10.0/loaders").glob("*"))
+    if not any("svg" in path.name for path in pixbuf_modules):
+        raise RuntimeError("SVG loader missing: install librsvg")
+    if list((resources / "lib/zoitechat/plugins").glob("fishlim.*")) and not list((resources / "lib/ossl-modules").glob("legacy.*")):
+        raise RuntimeError("FiSH needs the OpenSSL legacy provider in the bundle")
+    if not list((resources / "lib/gio/modules").glob("*tls*")):
+        raise RuntimeError("GIO TLS backend missing: install glib-networking")
+    # Query original binaries before relocation, then rewrite only the cached paths.
+    pixbuf_query = prefixes["gdk-pixbuf"] / "bin/gdk-pixbuf-query-loaders"
+    if not pixbuf_query.exists():
+        pixbuf_query = prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
+    for tool, module_dir, cache in (
+        (pixbuf_query, "lib/gdk-pixbuf-2.0/2.10.0/loaders", "pixbuf-loaders.cache"),
+        (prefixes["gtk+3"] / "bin/gtk-query-immodules-3.0", "lib/gtk-3.0/3.0.0/immodules", "gtk-immodules.cache"),
+    ):
+        originals = [(source, target) for source, target in seeds if target.parent == resources / module_dir]
+        # Never call a query tool with zero arguments: it would scan global modules.
+        data = run(tool, *(source for source, _ in originals)) if originals else "# No external input-method modules\n"
+        for source, target in originals:
+            data = data.replace(str(source), "@ZOITECHAT_RESOURCES@/" + str(target.relative_to(resources)))
+        (resources / cache).write_text(data + "\n")
+    # The private font map loads the bundled Noto font; ordinary GTK fonts stay local.
+    (resources / "fonts.conf").write_text('''<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+<fontconfig>
+  <dir>/System/Library/Fonts</dir><dir>/Library/Fonts</dir><dir>~/Library/Fonts</dir>
+  <cachedir prefix="xdg">fontconfig</cachedir>
+  <alias><family>sans-serif</family><prefer><family>Helvetica</family></prefer></alias>
+  <alias><family>monospace</family><prefer><family>Menlo</family></prefer></alias>
+</fontconfig>
+''')
+    (resources / "zoitechat-bundle").write_text("1\n")
+    licenses = resources / "licenses"
+    licenses.mkdir()
+    shutil.copy2(ROOT / "COPYING", licenses / "ZoiteChat-COPYING")
+    # Preserve the notices shipped with every installed Homebrew dependency.
+    # brew deps traverses dependencies by default; --recursive is not an option.
+    wanted = set(prefixes)
+    for formula in prefixes:
+        wanted.update(run("brew", "deps", "--formula", formula).splitlines())
+    installed = [item for item in json.loads(run("brew", "info", "--json=v2", "--installed"))["formulae"]
+                 if item["name"] in wanted]
+    for formula in installed:
+        prefix = Path(run("brew", "--prefix", formula["name"]))
+        notices = [p for p in prefix.iterdir() if p.is_file() and re.match(r"(?i)(copying|license|copyright|notice)", p.name)]
+        if notices:
+            target = licenses / formula["name"].replace("/", "-")
+            target.mkdir(exist_ok=True)
+            for notice in notices:
+                shutil.copy2(notice, target / notice.name)
+    (resources / "homebrew-dependencies.json").write_text(json.dumps(installed, indent=2) + "\n")
+    for source, target in seeds:
+        relocator.relocate(source, target)
+    report = audit(app)
+    (resources / "bundle-audit.json").write_text(json.dumps(report, indent=2) + "\n")
+    # Use the actual highest deployment target of the executable and all dylibs.
+    # Setting an older plist version cannot make newer Homebrew bottles compatible.
+    version = (ROOT / "VERSION").read_text().strip()
+    release = re.match(r"\d+\.\d+\.\d+", version)
+    if not release:
+        raise RuntimeError(f"Unsupported release version: {version}")
+    plist = {
+        "CFBundleIdentifier": "org.Zoitechat", "CFBundleExecutable": "zoitechat",
+        "CFBundleName": "ZoiteChat", "CFBundleDisplayName": "ZoiteChat",
+        "CFBundlePackageType": "APPL", "CFBundleShortVersionString": release.group(),
+        "CFBundleVersion": build_number, "CFBundleIconFile": "ZoiteChat.icns",
+        "LSMinimumSystemVersion": report["minimum_macos"], "NSHighResolutionCapable": True,
+        "NSPrincipalClass": "NSApplication",
+        "LSApplicationCategoryType": "public.app-category.social-networking",
+        "DTSDKName": "macosx" + run("xcrun", "--sdk", "macosx", "--show-sdk-version"),
+        "DTSDKBuild": run("xcrun", "--sdk", "macosx", "--show-sdk-build-version"),
+    }
+    with (app / "Contents/Info.plist").open("wb") as stream:
+        plistlib.dump(plist, stream)
+    iconset = app.parent / (app.stem + ".iconset")
+    if iconset.exists():
+        raise RuntimeError(f"Icon staging directory already exists: {iconset}")
+    iconset.mkdir()
+    try:
+        # Rasterize the original vector at 1024px, then generate every icon size.
+        large = iconset / "source.png"
+        run(prefixes["librsvg"] / "bin/rsvg-convert", "-w", "1024", "-h", "1024", "-o", large, ROOT / "data/icons/zoitechat.svg")
+        for size in (16, 32, 128, 256, 512):
+            for scale in (1, 2):
+                name = f"icon_{size}x{size}" + ("@2x" if scale == 2 else "") + ".png"
+                run("sips", "-z", str(size * scale), str(size * scale), large, "--out", iconset / name)
+        large.unlink()
+        run("iconutil", "-c", "icns", iconset, "-o", resources / "ZoiteChat.icns")
+    finally:
+        shutil.rmtree(iconset)
+    # Local builds need an ad-hoc signature after install_name_tool changes.
+    sign(app, "-", None)
+    print(f"Created {app}: {', '.join(report['architectures'])}, macOS {report['minimum_macos']}+")
+
+
+def sign(app: Path, identity: str, entitlements: Path | None, *, keychain: Path | None = None) -> None:
+    audit(app)
+    binaries = [p for p in app.rglob("*") if is_macho(p) and p != app / "Contents/MacOS/zoitechat"]
+    options = [] if identity == "-" else ["--timestamp", "--options", "runtime"]
+    if keychain is not None:
+        options += ["--keychain", str(keychain)]
+    for binary in sorted(binaries, key=lambda p: len(p.parts), reverse=True):
+        run("codesign", "--force", "--sign", identity, *options, binary)
+    main_options = ["--entitlements", str(entitlements)] if entitlements else []
+    run("codesign", "--force", "--sign", identity, *options, *main_options, app)
+    run("codesign", "--verify", "--deep", "--strict", "--verbose=2", app)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="action", required=True)
+    create = sub.add_parser("create")
+    create.add_argument("--stage", type=Path, required=True)
+    create.add_argument("--app", type=Path, required=True)
+    create.add_argument("--build-number", default="1")
+    verify = sub.add_parser("audit")
+    verify.add_argument("app", type=Path)
+    signing = sub.add_parser("sign")
+    signing.add_argument("app", type=Path)
+    signing.add_argument("--identity", required=True)
+    signing.add_argument("--entitlements", type=Path)
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("This tool requires macOS and the Xcode command-line tools")
+    if args.action == "create":
+        package(args.stage.resolve(), args.app.resolve(), args.build_number)
+    elif args.action == "audit":
+        print(json.dumps(audit(args.app.resolve()), indent=2))
+    else:
+        sign(args.app.resolve(), args.identity, args.entitlements)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
+        sys.exit(f"macOS packaging failed: {error}")

packaging/macos/direct.entitlements

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <!-- User-installed native plugins need library validation disabled. -->
+  <key>com.apple.security.cs.disable-library-validation</key><true/>
+</dict></plist>

packaging/macos/release.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Developer ID sign, notarize and staple a built app using CI environment secrets."""
+from __future__ import annotations
+
+import argparse
+import base64
+import binascii
+from contextlib import contextmanager
+from dataclasses import dataclass
+import json
+import os
+from pathlib import Path
+import platform
+import re
+import secrets
+import shlex
+import subprocess
+import sys
+import tempfile
+import urllib.request
+import uuid
+
+from bundle import sign
+
+REQUIRED = (
+    "MACOS_CERTIFICATE_P12_BASE64", "MACOS_CERTIFICATE_PASSWORD",
+    "MACOS_SIGNING_IDENTITY", "APPLE_API_KEY_P8", "APPLE_API_KEY_ID", "APPLE_API_ISSUER_ID",
+)
+
+
+@dataclass(repr=False)
+class Credentials:
+    certificate: bytes
+    password: str
+    identity: str
+    api_key: str
+    key_id: str
+    issuer: str
+
+    @classmethod
+    def from_environment(cls) -> Credentials:
+        missing = [name for name in REQUIRED if not os.environ.get(name, "").strip()]
+        if missing:
+            raise RuntimeError("Missing release settings: " + ", ".join(missing))
+        try:
+            certificate = base64.b64decode("".join(os.environ[REQUIRED[0]].split()), validate=True)
+        except (binascii.Error, ValueError):
+            raise RuntimeError("MACOS_CERTIFICATE_P12_BASE64 must contain Base64-encoded .p12 bytes") from None
+        if not certificate:
+            raise RuntimeError("Signing certificate is empty")
+        identity = os.environ["MACOS_SIGNING_IDENTITY"].strip()
+        if not (identity.startswith("Developer ID Application:") or re.fullmatch(r"[a-fA-F0-9]{40}", identity)):
+            raise RuntimeError("MACOS_SIGNING_IDENTITY must identify a Developer ID Application certificate")
+        api_key = os.environ["APPLE_API_KEY_P8"].strip()
+        if not (api_key.startswith("-----BEGIN PRIVATE KEY-----") and api_key.endswith("-----END PRIVATE KEY-----")):
+            raise RuntimeError("APPLE_API_KEY_P8 must contain the complete, plain-text .p8 private key")
+        key_id = os.environ["APPLE_API_KEY_ID"].strip()
+        if not re.fullmatch(r"[A-Za-z0-9]{6,32}", key_id):
+            raise RuntimeError("APPLE_API_KEY_ID must be an App Store Connect key ID")
+        try:
+            issuer = str(uuid.UUID(os.environ["APPLE_API_ISSUER_ID"].strip()))
+        except ValueError:
+            raise RuntimeError("APPLE_API_ISSUER_ID must be the Team API key issuer UUID") from None
+        return cls(certificate, os.environ["MACOS_CERTIFICATE_PASSWORD"], identity, api_key, key_id, issuer)
+
+
+def execute(args: list[str | Path], operation: str, *, check: bool = True) -> subprocess.CompletedProcess[str]:
+    # Do not print argv or CalledProcessError: security commands contain passwords.
+    try:
+        result = subprocess.run([str(arg) for arg in args], capture_output=True, text=True, check=False)
+    except OSError:
+        raise RuntimeError(f"{operation}: could not start the required tool") from None
+    if check and result.returncode != 0:
+        raise RuntimeError(f"{operation} failed (exit {result.returncode})")
+    return result
+
+
+def write_private(path: Path, data: bytes) -> None:
+    with path.open("xb") as stream:
+        path.chmod(0o600)
+        stream.write(data)
+
+
+def resolve_identity(output: str, requested: str) -> str:
+    for fingerprint, name in re.findall(r'\b([A-Fa-f0-9]{40})\s+"([^"\n]+)"', output):
+        if name.startswith("Developer ID Application:") and (requested == name or requested.upper() == fingerprint.upper()):
+            return fingerprint
+    raise RuntimeError("Imported .p12 has no valid Developer ID Application identity matching MACOS_SIGNING_IDENTITY; check its private key, password, expiry and certificate chain")
+
+
+@contextmanager
+def signing_keychain(credentials: Credentials):
+    original = shlex.split(execute(["security", "list-keychains", "-d", "user"], "Read keychain search list").stdout)
+    with tempfile.TemporaryDirectory(prefix="zoitechat-signing-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
+        directory = Path(temporary)
+        keychain = directory / "signing.keychain-db"
+        keychain_password = secrets.token_urlsafe(32)
+        certificate = directory / "signing.p12"
+        api_key = directory / "notary.p8"
+        write_private(certificate, credentials.certificate)
+        write_private(api_key, (credentials.api_key + "\n").encode())
+        try:
+            execute(["security", "create-keychain", "-p", keychain_password, keychain], "Create signing keychain")
+            execute(["security", "set-keychain-settings", "-lut", "21600", keychain], "Configure signing keychain")
+            execute(["security", "unlock-keychain", "-p", keychain_password, keychain], "Unlock signing keychain")
+            # Include both public Developer ID intermediates so signing does not
+            # depend on the runner having cached the leaf certificate's issuer.
+            for name in ("DeveloperIDCA.cer", "DeveloperIDG2CA.cer"):
+                intermediate = directory / name
+                try:
+                    with urllib.request.urlopen("https://www.apple.com/certificateauthority/" + name, timeout=60) as response:
+                        write_private(intermediate, response.read())
+                except OSError:
+                    raise RuntimeError("Download of Apple's public Developer ID intermediate failed") from None
+                execute(["security", "import", intermediate, "-k", keychain], "Import Developer ID intermediate")
+            execute(["security", "import", certificate, "-P", credentials.password,
+                     "-k", keychain, "-T", "/usr/bin/codesign", "-T", "/usr/bin/security"], "Import signing .p12")
+            execute(["security", "set-key-partition-list", "-S", "apple-tool:,apple:",
+                     "-k", keychain_password, keychain], "Allow non-interactive code signing")
+            execute(["security", "list-keychains", "-d", "user", "-s", keychain, *original], "Add temporary signing keychain")
+            identities = execute(["security", "find-identity", "-v", "-p", "codesigning", keychain], "Find signing identity").stdout
+            yield keychain, api_key, resolve_identity(identities, credentials.identity)
+        finally:
+            # Hosted runners are discarded too, but clean up on every ordinary
+            # success/failure path and restore the original search list.
+            execute(["security", "list-keychains", "-d", "user", "-s", *original], "Restore keychain search list", check=False)
+            if keychain.exists():
+                result = execute(["security", "delete-keychain", keychain], "Delete signing keychain", check=False)
+                if result.returncode:
+                    print("Warning: keychain deletion failed; temporary files will still be removed.", file=sys.stderr)
+
+
+def decode_response(result: subprocess.CompletedProcess[str], operation: str) -> dict:
+    try:
+        response = json.loads(result.stdout)
+    except (json.JSONDecodeError, TypeError):
+        raise RuntimeError(f"{operation} did not return valid JSON (exit {result.returncode})") from None
+    if not isinstance(response, dict):
+        raise RuntimeError(f"{operation} returned an unexpected response")
+    return response
+
+
+def save_json(path: Path, response: dict) -> None:
+    path.write_text(json.dumps(response, indent=2) + "\n")
+
+
+def notarize(app: Path, output: Path, diagnostics: Path, credentials: Credentials, api_key: Path, timeout: str) -> None:
+    diagnostics.mkdir(parents=True, exist_ok=True)
+    authentication = ["--key", str(api_key), "--key-id", credentials.key_id, "--issuer", credentials.issuer]
+    with tempfile.TemporaryDirectory(prefix="zoitechat-notary-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
+        submission_zip = Path(temporary) / "ZoiteChat-submission.zip"
+        execute(["ditto", "-c", "-k", "--keepParent", app, submission_zip], "Package notarization submission")
+        result = execute(["xcrun", "notarytool", "submit", submission_zip, *authentication,
+                          "--output-format", "json"], "Submit notarization", check=False)
+        submission = decode_response(result, "Notarization submission")
+        save_json(diagnostics / "submission.json", submission)
+        if result.returncode or not submission.get("id"):
+            raise RuntimeError("Apple rejected the notarization submission; see submission.json")
+        try:
+            submission_id = str(uuid.UUID(submission["id"]))
+        except (ValueError, TypeError, AttributeError):
+            raise RuntimeError("Apple returned an invalid notarization submission ID") from None
+        print(f"Notarization submitted: {submission_id}", flush=True)
+        waited = execute(["xcrun", "notarytool", "wait", submission_id, *authentication,
+                          "--timeout", timeout, "--output-format", "json"], "Wait for notarization", check=False)
+        try:
+            status = decode_response(waited, "Notarization wait")
+        except RuntimeError:
+            status = {"id": submission_id, "status": "Unknown", "exit_code": waited.returncode}
+        save_json(diagnostics / "status.json", status)
+        # Apple can provide a diagnostic log after processing. Fetch it for both
+        # successful and rejected submissions; never include credential files.
+        execute(["xcrun", "notarytool", "log", submission_id, *authentication,
+                 diagnostics / "notary-log.json"], "Fetch notarization log", check=False)
+        if waited.returncode or status.get("status") != "Accepted":
+            raise RuntimeError("Notarization was not accepted or exceeded the wait limit; see the notarization diagnostic artifact. No release ZIP will be published")
+        execute(["xcrun", "stapler", "staple", app], "Staple notarization ticket")
+        execute(["xcrun", "stapler", "validate", app], "Validate notarization ticket")
+        execute(["codesign", "--verify", "--deep", "--strict", "--verbose=2", app], "Verify stapled app signature")
+        execute(["spctl", "--assess", "--type", "execute", "--verbose=2", app], "Assess Gatekeeper acceptance")
+        output.parent.mkdir(parents=True, exist_ok=True)
+        # Repack only after stapling. The submission ZIP is not the distributable ZIP.
+        execute(["ditto", "-c", "-k", "--keepParent", app, output], "Package notarized release")
+    print(f"Signed and notarized release: {output}", flush=True)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--check-config", action="store_true", help="Validate release settings without accessing Apple or a keychain")
+    parser.add_argument("--app", type=Path, default=Path("dist/ZoiteChat.app"))
+    parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat-signed-notarized.zip"))
+    parser.add_argument("--diagnostics", type=Path, default=Path("dist/notarization"))
+    parser.add_argument("--notary-timeout", default="60m")
+    args = parser.parse_args()
+    credentials = Credentials.from_environment()
+    if args.check_config:
+        print("Release signing and notarization settings are present and correctly formatted.")
+        return
+    if platform.system() != "Darwin":
+        parser.error("Signing/notarization requires the macOS runner and Xcode command-line tools")
+    if not args.app.is_dir() or args.output.exists():
+        parser.error("Provide a built .app and an output ZIP path that does not already exist")
+    if not re.fullmatch(r"[1-9]\d*[smh]", args.notary_timeout):
+        parser.error("Use a positive notarization timeout, such as 60m")
+    with signing_keychain(credentials) as (keychain, api_key, identity):
+        sign(args.app.resolve(), identity, Path(__file__).with_name("direct.entitlements"), keychain=keychain)
+        notarize(args.app.resolve(), args.output.resolve(), args.diagnostics.resolve(), credentials, api_key, args.notary_timeout)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, OSError):
+        # RuntimeError messages are authored above and do not contain secret argv.
+        error = sys.exc_info()[1]
+        if isinstance(error, RuntimeError):
+            sys.exit(f"macOS release failed: {error}")
+        sys.exit("macOS release failed: file or network operation failed")
+    except subprocess.CalledProcessError:
+        sys.exit("macOS release failed: code signing or bundle audit failed")

packaging/macos/smoke.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Run the relocated bundle with temporary settings and no IRC auto-connect."""
+from __future__ import annotations
+import argparse
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("app", type=Path)
+    args = parser.parse_args()
+    with tempfile.TemporaryDirectory(prefix="zoitechat-macos-smoke-") as directory:
+        # Include spaces to exercise dyld and GTK module-cache path handling.
+        app = Path(directory) / "Relocated App" / "ZoiteChat.app"
+        shutil.copytree(args.app.resolve(), app)
+        binary = app / "Contents/MacOS/zoitechat"
+        subprocess.run(["codesign", "--verify", "--deep", "--strict", str(app)], check=True)
+        subprocess.run([str(binary), "--version"], check=True, timeout=30)
+        config = Path(directory) / "test-config"
+        with (Path(directory) / "startup.log").open("w+") as log:
+            process = subprocess.Popen([str(binary), "--no-auto", "--cfgdir", str(config)], stdout=log, stderr=log)
+            try:
+                process.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                # Stop the isolated process after checking for early startup failure.
+                process.terminate()
+                try:
+                    process.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    process.kill()
+                    process.wait()
+                    raise RuntimeError("GUI startup process did not terminate")
+            else:
+                log.seek(0)
+                raise RuntimeError(f"GUI exited before smoke interval (code {process.returncode}):\n{log.read()}")
+            log.seek(0)
+            messages = log.read()
+            print(messages)
+            for failure in ("Library not loaded:", "Symbol not found:", "cannot open display", "Cannot load bundled HTTPS trust database", "Bundled emoji font is missing", "Cannot relocate", "Error loading plugin:"):
+                if failure.lower() in messages.lower():
+                    raise RuntimeError(f"Startup failure found: {failure}")
+        print("Relocated bundle stayed running for 10 seconds; manual interaction testing is still required.")
+
+
+if __name__ == "__main__":
+    main()

packaging/macos/store-experimental.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>com.apple.security.app-sandbox</key><true/>
+  <key>com.apple.security.network.client</key><true/>
+  <!-- DCC listening sockets and the optional ident service. -->
+  <key>com.apple.security.network.server</key><true/>
+  <key>com.apple.security.files.user-selected.read-write</key><true/>
+  <key>com.apple.security.files.downloads.read-write</key><true/>
+</dict></plist>

packaging/macos/tests/test_bundle.py

@@ -0,0 +1,125 @@
+"""Dependency parsing, relocation guards and release audit tests without a Mac SDK."""
+from pathlib import Path
+import shutil
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import bundle
+
+
+class BundleTests(unittest.TestCase):
+    @unittest.skipUnless(sys.platform == "darwin", "requires Apple's Mach-O tools")
+    def test_signed_binary_relocation_and_resigning(self):
+        with tempfile.TemporaryDirectory(prefix="zoitechat relocation ") as temporary:
+            directory = Path(temporary)
+            library_source = directory / "answer.c"
+            library_source.write_text("int answer(void) { return 42; }\n")
+            library = directory / "libanswer.dylib"
+            main_source = directory / "main.c"
+            main_source.write_text(
+                "#include <stdio.h>\n"
+                "extern int answer(void);\n"
+                "int main(void) { printf(\"%d\\n\", answer()); return 0; }\n"
+            )
+            executable = directory / "original"
+            bundle.run("xcrun", "clang", "-dynamiclib", "-Wl,-headerpad_max_install_names",
+                       "-Wl,-install_name," + str(library), library_source, "-o", library)
+            bundle.run("xcrun", "clang", "-Wl,-headerpad_max_install_names",
+                       "-Wl,-rpath," + str(directory), main_source, library, "-o", executable)
+            for binary in (library, executable):
+                bundle.run("codesign", "--force", "--sign", "-", binary)
+            app = directory / "Test.app"
+            target = app / "Contents/MacOS/zoitechat"
+            target.parent.mkdir(parents=True)
+            shutil.copy2(executable, target)
+            relocator = bundle.Relocator(app, executable)
+            relocator.relocate(executable, target)
+            # Remove the original dependency so execution proves relocation.
+            library.unlink()
+            for binary in (app / "Contents/Frameworks/libanswer.dylib", target):
+                bundle.run("codesign", "--force", "--sign", "-", binary)
+                bundle.run("codesign", "--verify", "--strict", binary)
+            self.assertEqual(bundle.run(target), "42")
+            self.assertEqual(len(bundle.audit(app)["mach_o"]), 2)
+
+    def test_otool_preserves_paths_with_spaces(self):
+        output = "app:\n\t/opt/Build Dependencies/lib/liba.dylib (compatibility version 1.0.0, current version 1.0.0)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1.0.0)"
+        with patch.object(bundle, "run", return_value=output):
+            self.assertEqual(bundle.dependencies(Path("app")), ["/opt/Build Dependencies/lib/liba.dylib", "/usr/lib/libSystem.B.dylib"])
+
+    def test_lc_rpaths_preserve_spaces(self):
+        with patch.object(bundle, "run", return_value="cmd LC_RPATH\n cmdsize 48\n path @loader_path/../Build Dependencies (offset 12)\n"):
+            self.assertEqual(bundle.rpaths(Path("app")), ["@loader_path/../Build Dependencies"])
+
+    def test_inherited_rpath_resolution(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            library = directory / "with spaces/libtest.dylib"
+            library.parent.mkdir()
+            library.write_bytes(b"library")
+            self.assertEqual(bundle.resolve_dependency("@rpath/libtest.dylib", directory / "libparent.dylib", directory / "app", [library.parent]), library.resolve())
+
+    def test_unresolved_rpath_fails(self):
+        with self.assertRaisesRegex(RuntimeError, "Cannot resolve"):
+            bundle.resolve_dependency("@rpath/missing.dylib", Path("/tmp/parent"), Path("/tmp/app"), [])
+
+    def test_conflicting_basename_fails(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            sources = [directory / name / "libtest.dylib" for name in ("one", "two")]
+            for source in sources:
+                source.parent.mkdir()
+                source.write_bytes(b"library")
+            relocator = bundle.Relocator(directory / "App.app", directory / "executable")
+            relocator.copy_dependency(sources[0])
+            with self.assertRaisesRegex(RuntimeError, "Conflicting library basename"):
+                relocator.copy_dependency(sources[1])
+
+    def test_audit_rejects_external_symlink(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            app.mkdir()
+            (app / "outside").symlink_to("/usr/lib")
+            with patch.object(bundle, "run", return_value="arm64"), self.assertRaisesRegex(RuntimeError, "External symlink"):
+                bundle.audit(app)
+
+    def test_audit_raises_minimum_for_dependencies(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            binary = app / "Contents/MacOS/zoitechat"
+            library = app / "Contents/Frameworks/libtest.dylib"
+            for path in (binary, library):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(bytes.fromhex("cffaedfe") + b"payload")
+            def fake_run(*args):
+                if args[0] == "lipo":
+                    return "arm64"
+                if args[1] == "-D":
+                    return str(args[2]) + ("\n@rpath/libtest.dylib" if args[2] == library else "")
+                if args[1] == "-L":
+                    name = "@loader_path/../Frameworks/libtest.dylib" if args[2] == binary else "@rpath/libtest.dylib"
+                    return f"{args[2]}:\n\t{name} (compatibility version 1.0.0, current version 1.0.0)"
+                return "cmd LC_BUILD_VERSION\n cmdsize 32\n platform 1\n minos " + ("15.0.1" if args[2] == library else "11.0")
+            with patch.object(bundle, "run", side_effect=fake_run):
+                report = bundle.audit(app)
+            self.assertEqual(report["minimum_macos"], "15.0.1")
+            self.assertEqual(report["architectures"], ["arm64"])
+            self.assertEqual(len(report["mach_o"]), 2)
+
+    def test_audit_rejects_wrong_architecture(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            binary = app / "Contents/MacOS/zoitechat"
+            library = app / "Contents/Frameworks/libtest.dylib"
+            for path in (binary, library):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(bytes.fromhex("cffaedfe"))
+            with patch.object(bundle, "run", side_effect=["arm64", "x86_64"]), self.assertRaisesRegex(RuntimeError, "Architecture mismatch"):
+                bundle.audit(app)
+
+
+if __name__ == "__main__":
+    unittest.main()

packaging/macos/tests/test_release.py

@@ -0,0 +1,153 @@
+"""Release failure gates, private-key handling and notarization result checks."""
+from contextlib import redirect_stdout
+import base64
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import release
+
+FINGERPRINT = "A" * 40
+IDENTITY = "Developer ID Application: Test Only (NOTAREALID)"
+SUBMISSION = "a8c9438a-b972-455e-aedc-278070349394"
+ENVIRONMENT = {
+    "MACOS_CERTIFICATE_P12_BASE64": base64.b64encode(b"not-a-real-certificate").decode(),
+    "MACOS_CERTIFICATE_PASSWORD": "unit-test-password",
+    "MACOS_SIGNING_IDENTITY": IDENTITY,
+    "APPLE_API_KEY_P8": "-----BEGIN PRIVATE KEY-----\nunit-test-only\n-----END PRIVATE KEY-----",
+    "APPLE_API_KEY_ID": "TESTKEY123",
+    "APPLE_API_ISSUER_ID": SUBMISSION,
+}
+
+
+class ReleaseTests(unittest.TestCase):
+    def credentials(self):
+        with patch.dict(os.environ, ENVIRONMENT, clear=True):
+            return release.Credentials.from_environment()
+
+    def test_config_reports_names_and_never_values(self):
+        with patch.dict(os.environ, {}, clear=True), self.assertRaisesRegex(RuntimeError, "MACOS_CERTIFICATE_P12_BASE64"):
+            release.Credentials.from_environment()
+
+    def test_config_accepts_multiline_certificate_base64(self):
+        env = ENVIRONMENT.copy()
+        text = env["MACOS_CERTIFICATE_P12_BASE64"]
+        env["MACOS_CERTIFICATE_P12_BASE64"] = text[:10] + "\n" + text[10:]
+        with patch.dict(os.environ, env, clear=True):
+            self.assertEqual(release.Credentials.from_environment().certificate, b"not-a-real-certificate")
+
+    def test_config_rejects_development_certificate(self):
+        env = {**ENVIRONMENT, "MACOS_SIGNING_IDENTITY": "Apple Development: Test"}
+        with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "Developer ID Application"):
+            release.Credentials.from_environment()
+
+    def test_config_rejects_base64_instead_of_plain_p8(self):
+        env = {**ENVIRONMENT, "APPLE_API_KEY_P8": "not-the-pem-contents"}
+        with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "complete, plain-text"):
+            release.Credentials.from_environment()
+
+    def test_execute_does_not_expose_secret_argv_or_stderr(self):
+        result = subprocess.CompletedProcess([], 1, stdout="", stderr="secret-password")
+        with patch.object(release.subprocess, "run", return_value=result):
+            with self.assertRaises(RuntimeError) as error:
+                release.execute(["security", "import", "-P", "secret-password"], "Import certificate")
+        self.assertNotIn("secret-password", str(error.exception))
+
+    def test_matching_identity_requires_developer_id_and_private_key(self):
+        output = f'  1) {FINGERPRINT} "{IDENTITY}"\n'
+        self.assertEqual(release.resolve_identity(output, IDENTITY), FINGERPRINT)
+        with self.assertRaisesRegex(RuntimeError, "no valid Developer ID"):
+            release.resolve_identity("0 valid identities found", IDENTITY)
+
+    def test_private_files_have_restricted_permissions(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "private.p8"
+            release.write_private(path, b"test-only")
+            self.assertEqual(path.stat().st_mode & 0o777, 0o600)
+
+    def test_keychain_and_private_files_are_cleaned_up_after_signing_failure(self):
+        calls = []
+        def fake_execute(args, operation, **kwargs):
+            calls.append([str(value) for value in args])
+            output = ''
+            if args[:3] == ["security", "list-keychains", "-d"] and len(args) == 4:
+                output = '"/tmp/original.keychain-db"\n'
+            if args[:2] == ["security", "create-keychain"]:
+                Path(args[-1]).touch()
+            if args[:2] == ["security", "find-identity"]:
+                output = f'  1) {FINGERPRINT} "{IDENTITY}"\n'
+            return subprocess.CompletedProcess(args, 0, output, "")
+        temporary_path = None
+        with patch.object(release, "execute", side_effect=fake_execute), patch.object(release.urllib.request, "urlopen", side_effect=lambda *args, **kwargs: io.BytesIO(b"public-test-ca")):
+            with self.assertRaisesRegex(RuntimeError, "test signing failed"):
+                with release.signing_keychain(self.credentials()) as (keychain, api_key, identity):
+                    temporary_path = keychain.parent
+                    self.assertEqual(identity, FINGERPRINT)
+                    self.assertTrue(api_key.is_file())
+                    raise RuntimeError("test signing failed")
+        self.assertFalse(temporary_path.exists())
+        self.assertIn(["security", "list-keychains", "-d", "user", "-s", "/tmp/original.keychain-db"], calls)
+        self.assertTrue(any(call[:2] == ["security", "delete-keychain"] for call in calls))
+
+    def run_notary(self, status, returncode=0):
+        calls = []
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        directory = Path(temporary.name)
+        app = directory / "ZoiteChat.app"
+        app.mkdir()
+        output = directory / "release.zip"
+        diagnostics = directory / "diagnostics"
+        def fake_execute(args, operation, **kwargs):
+            calls.append([str(value) for value in args])
+            text = ""
+            code = 0
+            if args[:3] == ["xcrun", "notarytool", "submit"]:
+                text = json.dumps({"id": SUBMISSION})
+            elif args[:3] == ["xcrun", "notarytool", "wait"]:
+                text = json.dumps({"id": SUBMISSION, "status": status})
+                code = returncode
+            elif args[:3] == ["xcrun", "notarytool", "log"]:
+                Path(args[-1]).write_text('{"issues": []}')
+            elif args[0] == "ditto":
+                Path(args[-1]).write_bytes(b"test-zip")
+            return subprocess.CompletedProcess(args, code, text, "")
+        with patch.object(release, "execute", side_effect=fake_execute), redirect_stdout(io.StringIO()):
+            if status == "Accepted" and not returncode:
+                release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
+            else:
+                with self.assertRaisesRegex(RuntimeError, "not accepted"):
+                    release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
+        return calls, output, diagnostics
+
+    def test_accepted_notarization_staples_and_checks_before_final_zip(self):
+        calls, output, diagnostics = self.run_notary("Accepted")
+        self.assertTrue(output.is_file())
+        staple = next(i for i, call in enumerate(calls) if call[:3] == ["xcrun", "stapler", "staple"])
+        assess = next(i for i, call in enumerate(calls) if call[0] == "spctl")
+        final_zip = max(i for i, call in enumerate(calls) if call[0] == "ditto")
+        self.assertLess(staple, assess)
+        self.assertLess(assess, final_zip)
+        self.assertEqual(json.loads((diagnostics / "status.json").read_text())["status"], "Accepted")
+
+    def test_rejected_notarization_never_staples_or_publishes(self):
+        calls, output, diagnostics = self.run_notary("Invalid")
+        self.assertFalse(output.exists())
+        self.assertTrue((diagnostics / "notary-log.json").is_file())
+        self.assertFalse(any(call[:2] == ["xcrun", "stapler"] for call in calls))
+
+    def test_timeout_retains_submission_id_and_never_publishes(self):
+        calls, output, diagnostics = self.run_notary("In Progress", 1)
+        self.assertFalse(output.exists())
+        self.assertEqual(json.loads((diagnostics / "submission.json").read_text())["id"], SUBMISSION)
+
+
+if __name__ == "__main__":
+    unittest.main()

src/common/macos.c

@@ -0,0 +1,127 @@
+/* Relocate resources before GTK, Fontconfig, GIO or OpenSSL initialize.
+ * GPL-2.0-or-later; see COPYING. */
+#include "config.h"
+#include "macos.h"
+#include <gio/gio.h>
+#include <mach-o/dyld.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *locale_dir;
+
+static void
+set_path (const char *variable, const char *base, const char *relative)
+{
+    char *path = g_build_filename (base, relative, NULL);
+    g_setenv (variable, path, TRUE);
+    g_free (path);
+}
+
+static void
+relocate_cache (const char *resources, const char *name, const char *variable)
+{
+    char *input = g_build_filename (resources, name, NULL);
+    char *contents = NULL;
+    GError *error = NULL;
+
+    if (g_file_get_contents (input, &contents, NULL, &error))
+    {
+        /* GTK cache files require absolute module paths. Write only data to
+         * the user cache, never into the signed/read-only application bundle. */
+        char **parts = g_strsplit (contents, "@ZOITECHAT_RESOURCES@", -1);
+        char *escaped = g_strescape (resources, NULL);
+        char *relocated = g_strjoinv (escaped, parts);
+        g_free (escaped);
+        char *digest = g_compute_checksum_for_string (G_CHECKSUM_SHA256, relocated, -1);
+        char *directory = g_build_filename (g_get_user_cache_dir (), "zoitechat", "modules", digest, NULL);
+        char *output = g_build_filename (directory, name, NULL);
+        if (g_mkdir_with_parents (directory, 0700) == 0 &&
+            g_file_set_contents (output, relocated, -1, &error))
+            g_setenv (variable, output, TRUE);
+        else
+            g_warning ("Cannot relocate %s: %s", name, error ? error->message : "cannot create cache directory");
+        g_free (output);
+        g_free (directory);
+        g_free (digest);
+        g_free (relocated);
+        g_strfreev (parts);
+    }
+    else
+        g_warning ("Cannot read %s: %s", input, error->message);
+    g_clear_error (&error);
+    g_free (contents);
+    g_free (input);
+}
+
+void
+zoitechat_macos_init (void)
+{
+    uint32_t size = 0;
+    char *raw, *executable, *macos, *contents, *resources, *marker;
+    char *ca;
+    GTlsDatabase *database;
+    GError *error = NULL;
+
+    _NSGetExecutablePath (NULL, &size);
+    raw = g_malloc (size);
+    if (_NSGetExecutablePath (raw, &size) != 0)
+    {
+        g_free (raw);
+        return;
+    }
+    executable = realpath (raw, NULL);
+    g_free (raw);
+    if (!executable)
+        return;
+    macos = g_path_get_dirname (executable);
+    free (executable);
+    contents = g_path_get_dirname (macos);
+    resources = g_build_filename (contents, "Resources", NULL);
+    marker = g_build_filename (resources, "zoitechat-bundle", NULL);
+    g_free (macos);
+    g_free (contents);
+    if (!g_file_test (marker, G_FILE_TEST_IS_REGULAR))
+    {
+        g_free (marker);
+        g_free (resources);
+        return; /* Ordinary Meson installs and build-tree runs retain their paths. */
+    }
+    g_free (marker);
+    g_setenv ("GDK_BACKEND", "quartz", TRUE);
+    set_path ("ZOITECHAT_MACOS_SHARE", resources, "share");
+    set_path ("XDG_DATA_DIRS", resources, "share");
+    set_path ("GSETTINGS_SCHEMA_DIR", resources, "share/glib-2.0/schemas");
+    set_path ("FONTCONFIG_FILE", resources, "fonts.conf");
+    set_path ("GIO_EXTRA_MODULES", resources, "lib/gio/modules");
+    set_path ("GIO_MODULE_DIR", resources, "lib/gio/modules");
+    set_path ("ZOITECHAT_LIBDIR", resources, "lib/zoitechat/plugins");
+    set_path ("ZOITECHAT_EMOJI_FONT", resources, "share/fonts/zoitechat/NotoColorEmoji.ttf");
+    set_path ("ZOITECHAT_ENCHANT_LIBRARY", resources, "lib/libenchant-2.dylib");
+    g_setenv ("ZOITECHAT_ENCHANT_PREFIX", resources, TRUE);
+    set_path ("SSL_CERT_FILE", resources, "certs/ca-bundle.crt");
+    set_path ("OPENSSL_MODULES", resources, "lib/ossl-modules");
+    locale_dir = g_build_filename (resources, "share/locale", NULL);
+    relocate_cache (resources, "pixbuf-loaders.cache", "GDK_PIXBUF_MODULE_FILE");
+    relocate_cache (resources, "gtk-immodules.cache", "GTK_IM_MODULE_FILE");
+
+    /* HTTPS previews use GIO; IRC uses OpenSSL. Give both the same CA set. */
+    ca = g_build_filename (resources, "certs/ca-bundle.crt", NULL);
+    database = g_tls_file_database_new (ca, &error);
+    if (database)
+    {
+        g_tls_backend_set_default_database (g_tls_backend_get_default (), database);
+        g_object_unref (database);
+    }
+    else
+        g_warning ("Cannot load bundled HTTPS trust database: %s", error->message);
+    g_clear_error (&error);
+    g_free (ca);
+    g_free (resources);
+}
+
+const char *
+zoitechat_macos_locale_dir (void)
+{
+    return locale_dir ? locale_dir : LOCALEDIR;
+}

src/common/macos.h

@@ -0,0 +1,6 @@
+/* macOS bundle runtime; GPL-2.0-or-later, see COPYING. */
+#ifndef ZOITECHAT_MACOS_H
+#define ZOITECHAT_MACOS_H
+void zoitechat_macos_init (void);
+const char *zoitechat_macos_locale_dir (void);
+#endif

src/common/meson.build

@@ -29,6 +29,10 @@ common_sources = [
   'util.c'
 ]
 
+if host_machine.system() == 'darwin'
+  common_sources += 'macos.c'
+endif
+
 secretstore_sources = files('secretstore.c')
 
 common_sysinfo_deps = []
@@ -155,12 +159,19 @@ zoitechat_common = static_library('zoitechatcommon',
   pic: true
 )
 
+# zoitechat.h exposes OpenSSL types whenever TLS is enabled. Propagate its
+# header requirements even to standalone consumers that do not call OpenSSL.
+zoitechat_common_header_deps = [libgio_dep]
+if libssl_dep.found()
+  zoitechat_common_header_deps += libssl_dep.partial_dependency(compile_args: true, includes: true)
+endif
+
 zoitechat_common_dep = declare_dependency(
   sources: [textevents, public_suffix_data] + marshal,
   link_with: zoitechat_common,
   include_directories: common_includes,
   compile_args: common_cflags,
-  dependencies: libgio_dep,
+  dependencies: zoitechat_common_header_deps,
 )
 
 zoitechat_plugin_dep = declare_dependency(
@@ -176,7 +187,7 @@ gtk3_theme_service_tests = executable('gtk3_theme_service_tests',
     'gtk3-theme-service.c',
   ],
   include_directories: [config_h_include, include_directories('.')],
-  dependencies: [libgio_dep] + (libarchive_dep.found() ? [libarchive_dep] : []),
+  dependencies: zoitechat_common_header_deps + (libarchive_dep.found() ? [libarchive_dep] : []),
 )
 
 test('GTK3 Theme Service Tests', gtk3_theme_service_tests,

src/common/zoitechat.c

@@ -54,6 +54,9 @@
 #include "text.h"
 #include "url.h"
 #include "zoitechatc.h"
+#ifdef __APPLE__
+#include "macos.h"
+#endif
 
 #if ! GLIB_CHECK_VERSION (2, 36, 0)
 #include <glib-object.h>			/* for g_type_init() */
@@ -1172,6 +1175,10 @@ main (int argc, char *argv[])
 	int i;
 	int ret;
 
+#ifdef __APPLE__
+	zoitechat_macos_init ();
+#endif
+
 #ifdef WIN32
 	HRESULT coinit_result;
 #endif

src/fe-gtk/fe-gtk.c

@@ -21,6 +21,9 @@
 #include <stdlib.h>
 
 #include "fe-gtk.h"
+#ifdef __APPLE__
+#include "../common/macos.h"
+#endif
 
 #ifdef GDK_WINDOWING_WIN32
 #include <gdk/gdkwin32.h>
@@ -372,7 +375,13 @@ fe_args (int argc, char *argv[])
 	g_free (locale_path);
 	g_free (base_path);
 #else
-	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
+	bindtextdomain (GETTEXT_PACKAGE,
+#ifdef __APPLE__
+		zoitechat_macos_locale_dir ()
+#else
+		LOCALEDIR
+#endif
+	);
 #endif
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
 	textdomain (GETTEXT_PACKAGE);
@@ -493,6 +502,15 @@ fe_args (int argc, char *argv[])
 #endif
 	gtk_init (&argc, &argv);
 
+#ifdef __APPLE__
+	if (g_getenv ("ZOITECHAT_MACOS_SHARE"))
+	{
+		char *icons = g_build_filename (g_getenv ("ZOITECHAT_MACOS_SHARE"), "icons", NULL);
+		gtk_icon_theme_prepend_search_path (gtk_icon_theme_get_default (), icons);
+		g_free (icons);
+	}
+#endif
+
 #ifdef WIN32
 	win32_configure_icon_theme ();
 #endif

src/fe-gtk/meson.build

@@ -53,6 +53,15 @@ zoitechat_gtk_deps = [
 
 gtk_dep = dependency('gtk+-3.0', version: '>= 3.22')
 
+# Standalone GTK tests also include the common application's headers.
+gtk_dep = declare_dependency(dependencies: [gtk_dep] + zoitechat_common_header_deps)
+
+# fe-gtk.h exposes GtkosxApplication to every GTK consumer when enabled.
+# Theme libraries and standalone UI tests need the same headers as the app.
+if host_machine.system() == 'darwin' and gtk_mac_dep.found()
+  gtk_dep = declare_dependency(dependencies: [gtk_dep, gtk_mac_dep])
+endif
+
 zoitechat_theme_deps = [gtk_dep, zoitechat_common_dep]
 
 if host_machine.system() != 'windows'
@@ -91,12 +100,18 @@ if host_machine.system() != 'windows'
 endif
 
 zoitechat_gtk_ldflags = []
+zoitechat_gtk_objcflags = []
 
 if host_machine.system() == 'windows'
   zoitechat_gtk_sources += 'notifications/notification-windows.c'
   zoitechat_gtk_deps += cc.find_library('dwmapi', required: true)
   zoitechat_theme_deps += cc.find_library('dwmapi', required: true)
 
+elif host_machine.system() == 'darwin'
+  add_languages('objc', required: true)
+  zoitechat_gtk_sources += 'notifications/notification-osx.m'
+  zoitechat_gtk_deps += dependency('appleframeworks', modules: ['Cocoa', 'UserNotifications'])
+  zoitechat_gtk_objcflags += '-fobjc-arc'
 else
   zoitechat_gtk_sources += 'notifications/notification-freedesktop.c'
 endif
@@ -137,6 +152,7 @@ executable('zoitechat',
   dependencies: zoitechat_gtk_deps,
   link_with: zoitechat_theme_lib,
   c_args: zoitechat_gtk_cflags,
+  objc_args: zoitechat_gtk_objcflags,
   link_args: zoitechat_gtk_ldflags,
   pie: true,
   install: true,

src/fe-gtk/notifications/notification-osx.m

@@ -1,54 +1,67 @@
-/* ZoiteChat
+/* Native macOS notifications; GPL-2.0-or-later, see COPYING. */
- * Copyright (C) 2015 Patrick Griffis.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
 #import <Cocoa/Cocoa.h>
-#include <gtkosxapplication.h>
+#import <UserNotifications/UserNotifications.h>
 
-void
+@interface ZoiteChatNotificationDelegate : NSObject <UNUserNotificationCenterDelegate>
-notification_backend_show (const char *title, const char *text)
+@end
+@implementation ZoiteChatNotificationDelegate
+- (void)userNotificationCenter:(UNUserNotificationCenter *)center
+      willPresentNotification:(UNNotification *)notification
+        withCompletionHandler:(void (^)(UNNotificationPresentationOptions))completionHandler
 {
-	NSString *str_title = [[NSString alloc] initWithUTF8String:title];
+    completionHandler(UNNotificationPresentationOptionBanner | UNNotificationPresentationOptionSound);
-	NSString *str_text = [[NSString alloc] initWithUTF8String:text];
+}
+@end
 
-	NSUserNotification *userNotification = [NSUserNotification new];
+static ZoiteChatNotificationDelegate *notification_delegate;
-	userNotification.title = str_title;
-	userNotification.informativeText = str_text;
 
-	NSUserNotificationCenter *center = [NSUserNotificationCenter defaultUserNotificationCenter];
+int
-	[center scheduleNotification:userNotification];
+notification_backend_supported (void)
-
+{
-	[str_title release];
+    return [[NSBundle mainBundle] bundleIdentifier] != nil;
-	[str_text release];
 }
 
 int
 notification_backend_init (const char **error)
 {
-	return 1;
+    if (!notification_backend_supported ())
+    {
+        *error = "macOS notifications require an application bundle";
+        return 0;
+    }
+    notification_delegate = [ZoiteChatNotificationDelegate new];
+    [UNUserNotificationCenter currentNotificationCenter].delegate = notification_delegate;
+    return 1;
+}
+
+void
+notification_backend_show (const char *title, const char *text)
+{
+    UNMutableNotificationContent *content = [UNMutableNotificationContent new];
+    content.title = [NSString stringWithUTF8String:title] ?: @"ZoiteChat";
+    content.body = [NSString stringWithUTF8String:text] ?: @"";
+    UNUserNotificationCenter *center = [UNUserNotificationCenter currentNotificationCenter];
+    /* Ask only when the user first needs a notification, without blocking GTK. */
+    [center requestAuthorizationWithOptions:UNAuthorizationOptionAlert | UNAuthorizationOptionSound
+        completionHandler:^(BOOL granted, NSError *error) {
+            if (granted)
+            {
+                UNNotificationRequest *request = [UNNotificationRequest
+                    requestWithIdentifier:[[NSUUID UUID] UUIDString] content:content trigger:nil];
+                [center addNotificationRequest:request withCompletionHandler:^(NSError *deliveryError) {
+                    if (deliveryError)
+                        NSLog(@"ZoiteChat notification failed: %@", deliveryError);
+                }];
+            }
+            else if (error)
+                NSLog(@"ZoiteChat notification authorization failed: %@", error);
+        }];
 }
 
 void
 notification_backend_deinit (void)
 {
-}
+    if (notification_delegate)
-
+        [UNUserNotificationCenter currentNotificationCenter].delegate = nil;
-int
+    notification_delegate = nil;
-notification_backend_supported (void)
-{
-	return gtkosx_application_get_bundle_id () != NULL;
 }

src/fe-gtk/sexy-spell-entry.c

@@ -215,7 +215,22 @@ initialize_enchant (void)
 #endif
     };
 
-    for (i = 0; i < G_N_ELEMENTS(libnames); ++i)
+#ifdef __APPLE__
+    const char *bundled_enchant = g_getenv ("ZOITECHAT_ENCHANT_LIBRARY");
+    if (bundled_enchant && *bundled_enchant)
+    {
+        enchant = g_module_open (bundled_enchant, 0);
+        if (enchant)
+        {
+            void (*set_prefix) (const char *) = NULL;
+            const char *prefix = g_getenv ("ZOITECHAT_ENCHANT_PREFIX");
+            if (prefix && g_module_symbol (enchant, "enchant_set_prefix_dir", (gpointer *) &set_prefix))
+                set_prefix (prefix);
+            have_enchant = TRUE;
+        }
+    }
+#endif
+    for (i = 0; !have_enchant && i < G_N_ELEMENTS(libnames); ++i)
     {
         enchant = g_module_open(libnames[i], 0);
         if (enchant)

src/fe-gtk/theme/tests/test-theme-application-input-style.c

@@ -21,6 +21,7 @@
 #include "../../fe-gtk.h"
 
 #include "../theme-application.h"
+#include "../theme-css.h"
 #include "../theme-policy.h"
 #include "../../maingui.h"
 #include "../../../common/zoitechat.h"
@@ -45,6 +46,13 @@ fe_message (char *msg, int flags)
 	message_calls++;
 }
 
+/* This test isolates input styling from the application's toplevel CSS. */
+char *
+theme_css_build_toplevel_classes (void)
+{
+	return g_strdup ("");
+}
+
 void
 theme_css_reload_input_style (gboolean enabled, const PangoFontDescription *font_desc)
 {

src/fe-text/fe-text.c

@@ -43,6 +43,9 @@
 #include "../common/util.h"
 #include "../common/fe.h"
 #include "fe-text.h"
+#ifdef __APPLE__
+#include "../common/macos.h"
+#endif
 
 
 static int done = FALSE;
@@ -513,7 +516,13 @@ fe_args (int argc, char *argv[])
 	g_free (locale_path);
 	g_free (base_path);
 #else
-	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
+	bindtextdomain (GETTEXT_PACKAGE,
+#ifdef __APPLE__
+		zoitechat_macos_locale_dir ()
+#else
+		LOCALEDIR
+#endif
+	);
 #endif
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
 	textdomain (GETTEXT_PACKAGE);