mirror of
https://github.com/ZoiteChat/zoitechat.git
synced 2026-10-16 02:07:13 +00:00
Compare commits
1
Commits
master
...
macos-build
| Author | SHA1 | Date | |
|---|---|---|---|
 deepend
|
4302a30647 |
@@ -0,0 +1,154 @@
|
||||
name: macOS build
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
sign_and_notarize:
|
||||
description: 'Sign with Developer ID and notarize using release credentials'
|
||||
type: boolean
|
||||
default: false
|
||||
push:
|
||||
branches: [master]
|
||||
tags: ['v*']
|
||||
paths:
|
||||
- 'src/**'
|
||||
- 'plugins/**'
|
||||
- 'data/**'
|
||||
- 'tools/**'
|
||||
- 'po/**'
|
||||
- 'meson*'
|
||||
- 'VERSION'
|
||||
- 'packaging/macos/**'
|
||||
- '.github/workflows/macos-build.yml'
|
||||
pull_request:
|
||||
paths:
|
||||
- 'src/**'
|
||||
- 'plugins/**'
|
||||
- 'data/**'
|
||||
- 'tools/**'
|
||||
- 'po/**'
|
||||
- 'meson*'
|
||||
- 'VERSION'
|
||||
- 'packaging/macos/**'
|
||||
- '.github/workflows/macos-build.yml'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
if: >-
|
||||
github.event_name == 'pull_request' ||
|
||||
(github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
|
||||
(github.event_name == 'workflow_dispatch' && !inputs.sign_and_notarize)
|
||||
name: Native ${{ matrix.arch }} bundle
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- runner: macos-15
|
||||
arch: arm64
|
||||
- runner: macos-15-intel
|
||||
arch: x86_64
|
||||
runs-on: ${{ matrix.runner }}
|
||||
timeout-minutes: 90
|
||||
env:
|
||||
HOMEBREW_NO_AUTO_UPDATE: '1'
|
||||
steps:
|
||||
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
||||
- name: Install native dependencies
|
||||
run: brew bundle --file packaging/macos/Brewfile
|
||||
- name: Test packaging logic
|
||||
run: python3 -m unittest discover -s packaging/macos/tests -v
|
||||
- name: Build and test application
|
||||
run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
|
||||
- name: Verify relocated startup
|
||||
run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
|
||||
- name: Create artifact preserving the application signature
|
||||
run: ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-${{ matrix.arch }}.zip
|
||||
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
||||
with:
|
||||
name: ZoiteChat-macos-${{ matrix.arch }}
|
||||
path: dist/ZoiteChat-${{ matrix.arch }}.zip
|
||||
if-no-files-found: error
|
||||
- name: Upload build logs on failure
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
||||
with:
|
||||
name: ZoiteChat-macos-${{ matrix.arch }}-logs
|
||||
path: build-macos/meson-logs/
|
||||
if-no-files-found: ignore
|
||||
|
||||
release:
|
||||
name: Signed and notarized ${{ matrix.arch }} release
|
||||
if: >-
|
||||
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
|
||||
(github.event_name == 'workflow_dispatch' && inputs.sign_and_notarize && github.ref == 'refs/heads/master')
|
||||
environment: macos-release
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- runner: macos-15
|
||||
arch: arm64
|
||||
- runner: macos-15-intel
|
||||
arch: x86_64
|
||||
runs-on: ${{ matrix.runner }}
|
||||
timeout-minutes: 180
|
||||
env:
|
||||
HOMEBREW_NO_AUTO_UPDATE: '1'
|
||||
steps:
|
||||
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Validate release settings before building
|
||||
env:
|
||||
MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
|
||||
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
||||
MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
|
||||
APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
|
||||
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
||||
APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
|
||||
run: python3 packaging/macos/release.py --check-config
|
||||
- name: Install native dependencies
|
||||
run: brew bundle --file packaging/macos/Brewfile
|
||||
- name: Test packaging and release logic
|
||||
run: python3 -m unittest discover -s packaging/macos/tests -v
|
||||
- name: Build and test application
|
||||
run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
|
||||
- name: Verify relocated startup
|
||||
run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
|
||||
- name: Sign, notarize, staple and verify release
|
||||
env:
|
||||
MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
|
||||
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
||||
MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
|
||||
APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
|
||||
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
||||
APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
|
||||
run: >-
|
||||
python3 packaging/macos/release.py
|
||||
--app dist/ZoiteChat.app
|
||||
--output dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
|
||||
--diagnostics dist/notarization
|
||||
--notary-timeout 60m
|
||||
- name: Upload signed and notarized application
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
||||
with:
|
||||
name: ZoiteChat-macos-${{ matrix.arch }}-signed-notarized
|
||||
path: dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
|
||||
if-no-files-found: error
|
||||
- name: Upload notarization diagnostics
|
||||
if: always()
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
||||
with:
|
||||
name: ZoiteChat-macos-${{ matrix.arch }}-notarization-log
|
||||
path: dist/notarization/*.json
|
||||
if-no-files-found: ignore
|
||||
- name: Upload build logs on failure
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
||||
with:
|
||||
name: ZoiteChat-macos-${{ matrix.arch }}-release-build-logs
|
||||
path: build-macos/meson-logs/
|
||||
if-no-files-found: ignore
|
||||
@@ -27,3 +27,9 @@ osx/.ZoiteChat.app
|
||||
*.dmg
|
||||
*.VC.db
|
||||
*.VC.opendb
|
||||
|
||||
# Native macOS packaging output
|
||||
/build-macos*/
|
||||
/dist/
|
||||
/packaging/macos/__pycache__/
|
||||
/packaging/macos/tests/__pycache__/
|
||||
|
||||
+19
-1
@@ -13,7 +13,9 @@ gnome = import('gnome')
|
||||
cc = meson.get_compiler('c')
|
||||
|
||||
|
||||
libgio_dep = dependency('gio-2.0', version: '>= 2.36.0')
|
||||
# The relocatable macOS runtime sets the GIO TLS database explicitly.
|
||||
libgio_dep = dependency('gio-2.0',
|
||||
version: host_machine.system() == 'darwin' ? '>= 2.60.0' : '>= 2.36.0')
|
||||
libgmodule_dep = dependency('gmodule-2.0')
|
||||
|
||||
libcanberra_dep = dependency('libcanberra', version: '>= 0.22',
|
||||
@@ -29,7 +31,13 @@ else
|
||||
required: get_option('tls'))
|
||||
endif
|
||||
|
||||
gtk_mac_dep = disabler()
|
||||
if host_machine.system() == 'darwin' and get_option('gtk-frontend')
|
||||
gtk_mac_dep = dependency('gtk-mac-integration-gtk3', required: get_option('mac-integration'))
|
||||
endif
|
||||
|
||||
config_h = configuration_data()
|
||||
config_h.set('HAVE_GTK_MAC', host_machine.system() == 'darwin' and gtk_mac_dep.found())
|
||||
config_h.set_quoted('PACKAGE_VERSION', meson.project_version())
|
||||
config_h.set_quoted('PACKAGE_NAME', meson.project_name())
|
||||
config_h.set_quoted('GETTEXT_PACKAGE', 'zoitechat')
|
||||
@@ -99,6 +107,12 @@ global_cflags = [
|
||||
'-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_36',
|
||||
'-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_36',
|
||||
]
|
||||
if host_machine.system() == 'darwin'
|
||||
global_cflags = [
|
||||
'-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_60',
|
||||
'-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_60',
|
||||
]
|
||||
endif
|
||||
test_cflags = [
|
||||
'-funsigned-char',
|
||||
'-Wno-conversion',
|
||||
@@ -159,6 +173,10 @@ foreach ldflag : test_ldflags
|
||||
global_ldflags += ldflag
|
||||
endif
|
||||
endforeach
|
||||
if host_machine.system() == 'darwin'
|
||||
# Leave room for install_name_tool to rewrite packaged dependencies.
|
||||
global_ldflags += '-Wl,-headerpad_max_install_names'
|
||||
endif
|
||||
add_project_link_arguments(global_ldflags, language: 'c')
|
||||
|
||||
subdir('src')
|
||||
|
||||
@@ -23,6 +23,10 @@ option('appindicator', type: 'feature', value: 'auto',
|
||||
description: 'Use Ayatana/AppIndicator-based tray backend for GTK frontend (non-Windows only)'
|
||||
)
|
||||
|
||||
# macOS only; ignored by other platforms.
|
||||
option('mac-integration', type: 'feature', value: 'auto',
|
||||
description: 'Native macOS menu bar, Dock and application lifecycle')
|
||||
|
||||
# Install options
|
||||
option('dbus-service-use-appid', type: 'boolean', value: false,
|
||||
description: 'Rename dbus service to match app-id, required for Flatpak'
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
brew "meson"
|
||||
brew "ninja"
|
||||
brew "pkgconf"
|
||||
brew "python"
|
||||
brew "gettext"
|
||||
brew "gtk+3"
|
||||
brew "gtk-mac-integration"
|
||||
brew "libarchive"
|
||||
brew "openssl@3"
|
||||
brew "lua"
|
||||
brew "librsvg"
|
||||
brew "glib-networking"
|
||||
brew "adwaita-icon-theme"
|
||||
brew "enchant"
|
||||
brew "ca-certificates"
|
||||
@@ -0,0 +1,335 @@
|
||||
# Native macOS build and distribution
|
||||
|
||||
This builds GTK3 with the native Quartz backend, macOS menus/Dock integration,
|
||||
UserNotifications, translations, bundled emoji, TLS, image loaders and supported
|
||||
native plugins. It creates a self-contained `ZoiteChat.app`; end users do not
|
||||
need Homebrew, XQuartz or Python. No system-wide ZoiteChat installation occurs.
|
||||
|
||||
The source changes are conditional on Darwin. Windows and Linux retain their
|
||||
existing notification backends and feature defaults. This adds a separate
|
||||
macOS workflow; it does not replace existing workflows.
|
||||
|
||||
## 1. Install build prerequisites
|
||||
|
||||
Use a Mac with a currently supported macOS release and native Homebrew. On Apple
|
||||
Silicon, use ARM Homebrew (`/opt/homebrew`), not Intel Homebrew under Rosetta.
|
||||
Intel builds use Intel Homebrew (`/usr/local`). Install Xcode command-line tools
|
||||
and Homebrew from https://brew.sh if absent. Full current Xcode is recommended
|
||||
for distribution and needed to meet the current App Store submission SDK rules.
|
||||
|
||||
```sh
|
||||
xcode-select --install
|
||||
# Run once if the command-line tools are not installed; let installation finish.
|
||||
|
||||
cd /path/to/zoitechat
|
||||
brew bundle --file packaging/macos/Brewfile
|
||||
python3 packaging/macos/build.py
|
||||
open dist/ZoiteChat.app
|
||||
```
|
||||
|
||||
The build compiles the app, runs its Meson tests, stages an installation within
|
||||
`build-macos/macos-stage`, bundles and rewrites every non-system Mach-O dependency,
|
||||
creates the icon and plist, audits the result, and signs it ad hoc for local use.
|
||||
It refuses to overwrite an existing output app. For another build, choose a new
|
||||
output path, or explicitly delete your old generated app before rebuilding:
|
||||
|
||||
```sh
|
||||
python3 packaging/macos/build.py --output dist/ZoiteChat-test2.app --build-number 2
|
||||
```
|
||||
|
||||
The same build directory can be reconfigured. Use a different build directory
|
||||
for another architecture or the experimental store variant. Do not change
|
||||
architectures within one Meson build directory.
|
||||
|
||||
Homebrew packages change over time; this is a repeatable procedure, not a
|
||||
bit-for-bit reproducible dependency lock. The bundle records dependency versions
|
||||
in `Contents/Resources/homebrew-dependencies.json`. Retain that record and the
|
||||
release's source commit. For a reproducible release, archive the exact dependency
|
||||
sources and build them in a controlled prefix, or maintain pinned Homebrew formulae.
|
||||
|
||||
## 2. Verify portability and behavior
|
||||
|
||||
```sh
|
||||
python3 -m unittest discover -s packaging/macos/tests -v
|
||||
python3 packaging/macos/bundle.py audit dist/ZoiteChat.app
|
||||
python3 packaging/macos/smoke.py dist/ZoiteChat.app
|
||||
```
|
||||
|
||||
The smoke check copies the app to a path containing spaces, verifies its signature,
|
||||
runs `--version`, and keeps an isolated GUI process alive for ten seconds without
|
||||
connecting to IRC. It tests startup, not interaction or long-running stability.
|
||||
|
||||
The audit verifies the entire dependency closure, including GTK image/input
|
||||
modules, GIO TLS, Enchant providers, OpenSSL providers and ZoiteChat plugins. It
|
||||
fails on missing libraries, external symlinks/search paths, architecture mismatches
|
||||
or unresolved load commands. The minimum macOS version in the plist is derived
|
||||
from **all** bundled binaries, including Homebrew libraries. Lowering that plist
|
||||
value does not make newer dependency bottles run on an older Mac.
|
||||
|
||||
Before releasing, test on a second Mac without Homebrew installed:
|
||||
|
||||
- Launch from Finder and from a relocated/read-only location; verify Dock and
|
||||
menu bar, preferences persistence, dark/light themes and normal shutdown.
|
||||
- Connect with verified TLS, exercise SASL authentication and reconnect.
|
||||
- Send Unicode/emoji, render SVG/PNG/JPEG icons/images, and test HTTPS image previews.
|
||||
- Verify clipboard shortcuts, input methods, notifications/permission denial,
|
||||
detach/reattach tabs, focus changes, unread highlights and notification clicks.
|
||||
- Send/receive/resume DCC, write downloads and logs, import/export themes/settings.
|
||||
- Test FiSH, Lua and DCC checksum plugins in the direct build.
|
||||
- Exercise accessibility with VoiceOver and keyboard-only navigation.
|
||||
|
||||
Direct builds include Lua, FiSH and checksum, and retain the plugin loader.
|
||||
Python/Perl are explicitly not bundled: reliable redistribution requires packaging
|
||||
and auditing their interpreter runtimes, standard libraries and extensions.
|
||||
Linux `/proc`/PCI sysinfo is not built on macOS. These are macOS build choices;
|
||||
other platforms' plugin defaults are unchanged. macOS uses the existing password
|
||||
storage fallback; this patch does not add a Keychain backend. Audit credentials
|
||||
storage before adopting a stronger macOS security claim.
|
||||
|
||||
Desktop URL registration (`irc://` in Finder/browser) is not advertised by the
|
||||
plist; command-line IRC URLs continue to work. A native open-URL event handler
|
||||
and single-instance forwarding need separate integration before registering those
|
||||
schemes. AppIndicator and Linux D-Bus scripting/single-instance support are not
|
||||
used on macOS.
|
||||
|
||||
## 3. Sign and notarize for direct downloads
|
||||
|
||||
Local ad-hoc builds are for testing; they are not notarized releases. For public
|
||||
release, enroll in Apple's Developer Program, install your **Developer ID
|
||||
Application** certificate with its private key, then sign using that identity.
|
||||
Use your actual certificate identity in place of the example:
|
||||
|
||||
```sh
|
||||
python3 packaging/macos/bundle.py sign dist/ZoiteChat.app \
|
||||
--identity 'Developer ID Application: YOUR NAME (TEAMID)' \
|
||||
--entitlements packaging/macos/direct.entitlements
|
||||
|
||||
# Store credentials once in your login Keychain; enter your own values interactively.
|
||||
xcrun notarytool store-credentials ZoiteChat-notary
|
||||
|
||||
ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-notarization.zip
|
||||
xcrun notarytool submit dist/ZoiteChat-notarization.zip \
|
||||
--keychain-profile ZoiteChat-notary --wait
|
||||
|
||||
# Only after notarization has succeeded:
|
||||
xcrun stapler staple dist/ZoiteChat.app
|
||||
xcrun stapler validate dist/ZoiteChat.app
|
||||
spctl --assess --type execute --verbose=2 dist/ZoiteChat.app
|
||||
|
||||
ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-macos.zip
|
||||
```
|
||||
|
||||
Signing runs inside-out, verifies the final bundle and enables hardened runtime.
|
||||
It does not use `codesign --deep` to sign. `--deep` is used only for verification.
|
||||
The direct entitlement allows users' independently signed native plugins; it
|
||||
relaxes library validation, not the entire hardened runtime. No JIT or executable
|
||||
memory entitlements are added. Do not change bundle contents after signing; signing
|
||||
again is required after any code/resource edit. Stapling is Apple's supported
|
||||
post-signing operation.
|
||||
|
||||
Publish exact corresponding source for ZoiteChat and satisfy the applicable
|
||||
licenses of each bundled dependency. Notices and dependency metadata are included,
|
||||
but those alone do not satisfy every source-distribution obligation. Review the
|
||||
notarization log if rejected; the script does not silently bypass Gatekeeper.
|
||||
|
||||
### Automate signing and notarization with GitHub Actions
|
||||
|
||||
The workflow now has a separate signed/notarized release job for both
|
||||
architectures. It uses Developer ID distribution for direct downloads, not Mac
|
||||
App Store signing. You can manage it from Windows/Linux; GitHub's macOS runners
|
||||
perform all signing, notarization and stapling.
|
||||
|
||||
Prepare these repository Actions secrets under **Settings → Secrets and
|
||||
variables → Actions**, or store them as environment secrets in **macos-release**.
|
||||
The certificate setting names are unchanged from the original instructions.
|
||||
The three `APPLE_API_*` settings are new notarization credentials:
|
||||
|
||||
| Name | Type | Value |
|
||||
| --- | --- | --- |
|
||||
| `MACOS_CERTIFICATE_P12_BASE64` | Secret | Base64-encoded Developer ID Application `.p12`, including its private key |
|
||||
| `MACOS_CERTIFICATE_PASSWORD` | Secret | Password used to export that `.p12` |
|
||||
| `MACOS_SIGNING_IDENTITY` | Variable, or Secret | Exact `Developer ID Application: YOUR NAME (TEAMID)` identity; the matching certificate's SHA-1 fingerprint is also accepted |
|
||||
| `APPLE_API_KEY_P8` | Secret | Entire plain-text App Store Connect **Team API key** `.p8` file, including PEM header/footer and newlines |
|
||||
| `APPLE_API_KEY_ID` | Secret | That API key's Key ID |
|
||||
| `APPLE_API_ISSUER_ID` | Secret | The Team API key's Issuer ID UUID; this is **not** your Apple Team ID |
|
||||
|
||||
Repository variables are under the **Variables** tab. If the identity is entered
|
||||
as both a variable and a secret, the variable takes precedence. No separate
|
||||
keychain password is needed; the job generates a temporary random password.
|
||||
The `.p8` is the notarization API key; it does not replace the signing `.p12`.
|
||||
No Apple ID password or app-specific password is used by this configuration.
|
||||
|
||||
To obtain the API key, open **App Store Connect → Users and Access → Integrations
|
||||
→ App Store Connect API → Team Keys → Generate API Key**. Choose **Developer**
|
||||
access for notarization. If API access is not enabled, the Account Holder must
|
||||
request it first. Download the `.p8` and record the Key ID and Issuer ID. Use a
|
||||
**Team** key with this workflow: individual API keys use different authentication
|
||||
and are not supported by this issuer-based configuration. Apple allows the
|
||||
private key download only once, so retain your copy securely.
|
||||
|
||||
For the certificate, export the Developer ID Application identity (certificate
|
||||
plus private key) from Keychain Access as a password-protected `.p12`.
|
||||
If you generated the CSR with OpenSSL on Linux/WSL, you can also create it there.
|
||||
Assuming Apple's downloaded DER certificate has been saved as
|
||||
`developerID_application.cer`, and you retained `zoitechat-signing.key`:
|
||||
|
||||
```sh
|
||||
openssl x509 -inform DER -in developerID_application.cer \
|
||||
-out zoitechat-signing.pem
|
||||
openssl pkcs12 -export -inkey zoitechat-signing.key \
|
||||
-in zoitechat-signing.pem -out ZoiteChat-signing.p12
|
||||
|
||||
# Enter the existing private-key password, then choose the .p12 export password.
|
||||
# Copy the resulting Base64 text into MACOS_CERTIFICATE_P12_BASE64:
|
||||
openssl base64 -A -in ZoiteChat-signing.p12 -out ZoiteChat-signing.p12.base64
|
||||
|
||||
# Read the certificate's commonName to obtain MACOS_SIGNING_IDENTITY:
|
||||
openssl x509 -in zoitechat-signing.pem -noout -subject -nameopt multiline
|
||||
```
|
||||
|
||||
Upload only the public CSR to Apple. Put the `.p12` Base64, export password and
|
||||
API credentials in GitHub settings, never in the repository or build artifacts.
|
||||
|
||||
Once these patches are committed to `master` and the settings are ready:
|
||||
|
||||
1. Open **Actions → macOS build → Run workflow**.
|
||||
2. Select **master** and enable **Sign with Developer ID and notarize using
|
||||
release credentials**.
|
||||
3. Run the workflow. It creates separate Apple Silicon and Intel release jobs.
|
||||
4. After success, download `ZoiteChat-macos-arm64-signed-notarized` or
|
||||
`ZoiteChat-macos-x86_64-signed-notarized`. The ZIP inside contains the signed,
|
||||
stapled app. Actions artifacts wrap it in their own download archive.
|
||||
|
||||
A push of a `v*` tag also triggers the signed release jobs automatically, so wait
|
||||
until credentials are configured before pushing a release tag. Normal branch
|
||||
pushes, pull requests and manual runs with the checkbox off continue to build
|
||||
ad-hoc test artifacts without any signing secrets. Manual credentialed releases
|
||||
are restricted to `master`; pull requests cannot invoke the release job.
|
||||
Missing/malformed release settings fail before the Homebrew/build steps rather
|
||||
than producing an unsigned artifact marked as a release.
|
||||
|
||||
The release jobs use the GitHub environment **macos-release**. Repository secrets
|
||||
work with it; environment secrets can override them. Configure environment
|
||||
branch/tag restrictions or required reviewers if that fits your repository's
|
||||
release process. This workflow does not automatically create a GitHub Release,
|
||||
publish to zoitechat.org, or upload to App Store Connect; it produces downloadable
|
||||
signed/notarized artifacts for you to publish.
|
||||
|
||||
The job imports the `.p12` into a temporary keychain, installs Apple's public
|
||||
Developer ID intermediate certificates, verifies a valid matching identity,
|
||||
and signs inside-out with hardened runtime and the direct plugin entitlement.
|
||||
It uses the existing bundle audit and then submits a ZIP with `notarytool`.
|
||||
After Apple reports **Accepted**, it staples the ticket to the `.app`, verifies
|
||||
stapling/signatures and Gatekeeper acceptance, and creates a **new** final ZIP.
|
||||
Private credential files and the temporary keychain are cleaned up on normal
|
||||
success/failure paths; hosted runner VMs are also discarded after the job.
|
||||
|
||||
The default Apple wait limit is **60 minutes** within a **180-minute** release
|
||||
job. A rejected, failed or still-pending submission produces no final release
|
||||
ZIP. The `ZoiteChat-macos-<arch>-notarization-log` artifact retains the submission
|
||||
ID, status and Apple's available diagnostic log. First submissions can take
|
||||
longer; check the saved ID with `notarytool info` and your API credentials. An
|
||||
accepted submission still requires stapling and repackaging before publication;
|
||||
rerunning this workflow starts a new build and submission. To increase the wait
|
||||
limit, update `--notary-timeout` and allow adequate job timeout for build plus wait.
|
||||
|
||||
Both architecture builds receive the same bundle build number for one workflow
|
||||
run. The API credentials are supplied only to the config-check/release steps,
|
||||
not to Homebrew, compiler tests, ordinary builds or pull-request jobs.
|
||||
|
||||
## 4. Mac App Store: experimental groundwork, not submission-ready
|
||||
|
||||
A working direct-download app is not sufficient for App Store submission. This
|
||||
repository inherits GPL-2.0-or-later code from XChat/HexChat and other contributors.
|
||||
App Store terms and GPL obligations require a licensing review; do not assume
|
||||
that signing, a custom EULA, or relicensing only your new changes resolves rights
|
||||
to inherited code. This patch changes no licenses or copyright permissions.
|
||||
|
||||
An isolated sandbox-test build is provided:
|
||||
|
||||
```sh
|
||||
python3 packaging/macos/build.py --store-experimental \
|
||||
--build-dir build-macos-store --output dist/ZoiteChat-store-test.app \
|
||||
--build-number 1
|
||||
|
||||
# Local sandbox experimentation (not an uploadable distribution signature):
|
||||
python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
|
||||
--identity - --entitlements packaging/macos/store-experimental.entitlements
|
||||
open dist/ZoiteChat-store-test.app
|
||||
```
|
||||
|
||||
The separate store variant excludes loadable plugins and scripting runtimes.
|
||||
The template grants sandboxed client/server networking, user-selected files and
|
||||
Downloads. The direct version retains its plugin functionality. This is an
|
||||
explicit experimental variant, not a change to Windows/Linux or direct builds.
|
||||
|
||||
Before a store package can be regarded as a release candidate:
|
||||
|
||||
1. Resolve the inherited GPL/dependency-license distribution question and review
|
||||
Apple's current SDK, content/chat moderation, privacy and accessibility rules.
|
||||
2. Register `org.Zoitechat` (or change the plist identifier consistently if already
|
||||
owned by another developer), create App Store Connect metadata, and choose a
|
||||
unique incrementing build number. Use a stable release, not a `-dev` snapshot.
|
||||
3. Test sandboxed settings/logs, notifications, SASL/TLS, HTTPS and DCC on a real
|
||||
Mac. GTK dialogs are not assumed to grant Powerbox access. Add native
|
||||
`NSOpenPanel`/`NSSavePanel` integration and security-scoped bookmarks for
|
||||
persistent access to user-selected files. The entitlement template alone does
|
||||
not solve persistent file access. `/EXEC`, custom external commands, user
|
||||
plugin loading and arbitrary external paths cannot be promised under sandbox.
|
||||
4. Add required privacy manifest declarations based on an actual API audit of the
|
||||
app and dependencies; do not submit an invented empty compliance declaration.
|
||||
5. Obtain matching App Store distribution application/installer certificates and
|
||||
a matching provisioning profile. Generate team-specific signing entitlements
|
||||
from the profile with Xcode; do not use Developer ID or the generic local-test
|
||||
template as a store distribution identity/profile.
|
||||
6. Embed the matching profile as `Contents/embedded.provisionprofile` **before**
|
||||
final signing. Sign embedded libraries with the distribution identity, then
|
||||
the app with its profile-authorized entitlements (use `bundle.py sign` with
|
||||
that identity and generated entitlement file). Package with Apple's
|
||||
`productbuild`, validate and upload with Transporter/App Store Connect, then
|
||||
test the App Store processed build via TestFlight before submission.
|
||||
|
||||
Example **after those prerequisites are satisfied**:
|
||||
|
||||
```sh
|
||||
# Use the actual prepared profile and team-specific entitlements:
|
||||
cp /path/to/ZoiteChat.provisionprofile \
|
||||
dist/ZoiteChat-store-test.app/Contents/embedded.provisionprofile
|
||||
python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
|
||||
--identity 'YOUR APP STORE APPLICATION CERTIFICATE IDENTITY' \
|
||||
--entitlements /path/to/ZoiteChat-distribution.entitlements
|
||||
productbuild --component dist/ZoiteChat-store-test.app /Applications \
|
||||
--sign 'YOUR APP STORE INSTALLER CERTIFICATE IDENTITY' dist/ZoiteChat-store.pkg
|
||||
```
|
||||
|
||||
No App Store approval, sandbox compatibility or legal compatibility is asserted.
|
||||
For an initial macOS release, the signed/notarized direct build is the practical
|
||||
path while those issues are resolved.
|
||||
|
||||
## 5. CI and architecture support
|
||||
|
||||
`.github/workflows/macos-build.yml` adds independent Apple Silicon and Intel jobs.
|
||||
Ordinary jobs install prerequisites, run tests, create/audit/ad-hoc-sign the
|
||||
bundle, check relocated startup and upload test ZIPs. They need no Apple secrets.
|
||||
The separate release jobs add Developer ID signing, Apple notarization, stapling
|
||||
and final verification. Only their successful output is named signed/notarized.
|
||||
|
||||
Homebrew may build unsupported Intel bottles from source; that can be slower.
|
||||
The workflow uses native runners and does not claim a universal application.
|
||||
Do not merge only the main executable with `lipo`: a universal release must merge
|
||||
and validate every bundled dylib, module and plugin plus matching resources.
|
||||
Signing must happen after that merge. Publish separate architecture downloads
|
||||
until a full universal dependency pipeline is available.
|
||||
|
||||
## References
|
||||
|
||||
- GTK on macOS: https://www.gtk.org/docs/installations/macos
|
||||
- GTK macOS backend: https://docs.gtk.org/gtk3/macos.html
|
||||
- Apple distribution signing: https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac
|
||||
- Apple packaging: https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution
|
||||
- GitHub certificate import: https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications
|
||||
- Apple notarization authentication: https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool
|
||||
- App Store Connect API keys: https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/
|
||||
- Apple review rules (especially 1.2 and 2.4.5): https://developer.apple.com/app-store/review/guidelines/
|
||||
- Apple sandbox file access: https://developer.apple.com/documentation/security/accessing-files-from-the-macos-app-sandbox
|
||||
- FSF discussion of GPL and App Store terms (historical, not a current legal determination): https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement
|
||||
@@ -0,0 +1,71 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Compile, test, stage and package ZoiteChat on the host Mac."""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import os
|
||||
from pathlib import Path
|
||||
import platform
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
from bundle import ROOT, package, run
|
||||
|
||||
|
||||
def main() -> None:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--build-dir", type=Path, default=Path("build-macos"))
|
||||
parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat.app"))
|
||||
parser.add_argument("--build-number", default="1")
|
||||
parser.add_argument("--store-experimental", action="store_true", help="Build a separate sandbox test variant without loadable plugins; not submission approval")
|
||||
args = parser.parse_args()
|
||||
if platform.system() != "Darwin":
|
||||
parser.error("Build on macOS; cross-compiling from Linux is not supported")
|
||||
if args.output.exists():
|
||||
parser.error("Output already exists; use a new --output or explicitly remove the old app")
|
||||
build = args.build_dir.resolve()
|
||||
if build == ROOT or ROOT.is_relative_to(build):
|
||||
parser.error("Build directory must not contain the source checkout")
|
||||
run("xcrun", "--find", "clang")
|
||||
env = os.environ.copy()
|
||||
prefixes = [Path(run("brew", "--prefix", name)) for name in ("gettext", "openssl@3", "libarchive", "lua", "gtk+3", "gtk-mac-integration")]
|
||||
brew = Path(run("brew", "--prefix"))
|
||||
# Keg-only gettext, OpenSSL and libarchive are not necessarily in PATH/pkg-config.
|
||||
env["PATH"] = os.pathsep.join([str(p / "bin") for p in prefixes] + [str(brew / "bin"), env.get("PATH", "")])
|
||||
env["PKG_CONFIG_PATH"] = os.pathsep.join([str(p / "lib/pkgconfig") for p in prefixes] + [str(brew / "lib/pkgconfig"), str(brew / "share/pkgconfig"), env.get("PKG_CONFIG_PATH", "")])
|
||||
# Native dependency bottles determine the true deployment target; the bundle
|
||||
# auditor derives the final minimum rather than promising an arbitrary old OS.
|
||||
env.setdefault("MACOSX_DEPLOYMENT_TARGET", "11.0")
|
||||
backend = run("pkg-config", "--variable=targets", "gtk+-3.0", env=env).split()
|
||||
if "quartz" not in backend:
|
||||
parser.error(f"GTK must provide the native Quartz backend, got {backend}")
|
||||
# Do not silently select an XQuartz GTK stack or mix Intel/ARM Homebrew prefixes.
|
||||
machine = platform.machine()
|
||||
if machine not in ("arm64", "x86_64"):
|
||||
parser.error(f"Unsupported architecture: {machine}")
|
||||
options = [
|
||||
"--prefix=/", "--libdir=lib", "--buildtype=release", "-Dgtk-frontend=true",
|
||||
"-Dtext-frontend=false", "-Dmac-integration=enabled", "-Ddbus=disabled",
|
||||
"-Dlibcanberra=disabled", "-Dappindicator=disabled", "-Dinstall-appdata=false",
|
||||
"-Dwith-sysinfo=false", "-Dwith-python=false", "-Dwith-perl=false",
|
||||
"-Dwith-lua=lua", "-Dwith-fishlim=true", "-Dwith-checksum=true",
|
||||
"-Dplugin=" + ("false" if args.store_experimental else "true"),
|
||||
]
|
||||
if (build / "meson-private/coredata.dat").exists():
|
||||
options.insert(0, "--reconfigure")
|
||||
subprocess.run(["meson", "setup", str(build), str(ROOT), *options], env=env, check=True)
|
||||
subprocess.run(["meson", "compile", "-C", str(build)], env=env, check=True)
|
||||
subprocess.run(["meson", "test", "-C", str(build), "--print-errorlogs"], env=env, check=True)
|
||||
stage = build / "macos-stage"
|
||||
if stage.exists():
|
||||
shutil.rmtree(stage)
|
||||
subprocess.run(["meson", "install", "-C", str(build), "--destdir", str(stage)], env=env, check=True)
|
||||
package(stage, args.output.resolve(), args.build_number)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
|
||||
sys.exit(f"macOS build failed: {error}")
|
||||
@@ -0,0 +1,358 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Build and audit a relocatable GTK3 application. No third-party Python packages."""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import platform
|
||||
import plistlib
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
MACH_MAGIC = {bytes.fromhex(h) for h in ("feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca")}
|
||||
SYSTEM_ROOTS = ("/usr/lib/", "/System/Library/")
|
||||
|
||||
|
||||
def run(*args: str | Path, env: dict[str, str] | None = None) -> str:
|
||||
return subprocess.check_output([str(arg) for arg in args], env=env, text=True).strip()
|
||||
|
||||
|
||||
def is_macho(path: Path) -> bool:
|
||||
if not path.is_file() or path.is_symlink():
|
||||
return False
|
||||
with path.open("rb") as stream:
|
||||
return stream.read(4) in MACH_MAGIC
|
||||
|
||||
|
||||
def dependencies(path: Path) -> list[str]:
|
||||
# Paths may contain spaces; splitting on whitespace would corrupt them.
|
||||
return re.findall(r"^\s+(.+?) \(compatibility version", run("otool", "-L", path), re.M)
|
||||
|
||||
|
||||
def rpaths(path: Path) -> list[str]:
|
||||
return re.findall(r"cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset", run("otool", "-l", path))
|
||||
|
||||
|
||||
def dylib_id(path: Path) -> str | None:
|
||||
lines = run("otool", "-D", path).splitlines()
|
||||
return lines[1].strip() if len(lines) > 1 else None
|
||||
|
||||
|
||||
def system_library(name: str) -> bool:
|
||||
return name.startswith(SYSTEM_ROOTS)
|
||||
|
||||
|
||||
def expand_path(name: str, loader: Path, executable: Path) -> Path:
|
||||
return Path(name.replace("@loader_path", str(loader.parent)).replace("@executable_path", str(executable.parent)))
|
||||
|
||||
|
||||
def resolve_dependency(name: str, loader: Path, executable: Path, search: list[Path]) -> Path:
|
||||
if name.startswith("@rpath/"):
|
||||
suffix = name[len("@rpath/"):]
|
||||
candidates = [directory / suffix for directory in search]
|
||||
else:
|
||||
candidates = [expand_path(name, loader, executable)]
|
||||
for candidate in candidates:
|
||||
if candidate.is_absolute() and candidate.is_file():
|
||||
return candidate.resolve()
|
||||
raise RuntimeError(f"Cannot resolve {name!r} from {loader}; searched {candidates}")
|
||||
|
||||
|
||||
class Relocator:
|
||||
def __init__(self, app: Path, executable: Path):
|
||||
self.app = app
|
||||
self.executable = executable
|
||||
self.frameworks = app / "Contents/Frameworks"
|
||||
self.frameworks.mkdir(parents=True)
|
||||
self.sources: dict[Path, Path] = {}
|
||||
self.names: dict[str, Path] = {}
|
||||
self.visited: set[Path] = set()
|
||||
|
||||
def copy_dependency(self, source: Path) -> Path:
|
||||
source = source.resolve()
|
||||
if ".framework/" in str(source):
|
||||
raise RuntimeError(f"Third-party frameworks require separate packaging support: {source}")
|
||||
if source in self.sources:
|
||||
return self.sources[source]
|
||||
existing = self.names.get(source.name)
|
||||
if existing and existing != source:
|
||||
raise RuntimeError(f"Conflicting library basename: {existing} and {source}")
|
||||
target = self.frameworks / source.name
|
||||
shutil.copy2(source, target)
|
||||
target.chmod(target.stat().st_mode | 0o200)
|
||||
self.sources[source] = target
|
||||
self.names[source.name] = source
|
||||
return target
|
||||
|
||||
def relocate(self, source: Path, target: Path, inherited: list[Path] | None = None) -> None:
|
||||
source = source.resolve()
|
||||
if target in self.visited:
|
||||
return
|
||||
self.visited.add(target)
|
||||
local = [expand_path(name, source, self.executable) for name in rpaths(source)]
|
||||
search = local + (inherited or [])
|
||||
identity = dylib_id(source)
|
||||
# Keep the existing signature allocation while editing: stripping it
|
||||
# first can leave __LINKEDIT padding that install_name_tool rejects.
|
||||
# The final inside-out codesign --force pass replaces stale signatures.
|
||||
edits: list[str | Path] = []
|
||||
for name in dependencies(source):
|
||||
if name == identity or system_library(name):
|
||||
continue
|
||||
dependency = resolve_dependency(name, source, self.executable, search)
|
||||
destination = self.copy_dependency(dependency)
|
||||
relative = os.path.relpath(destination, target.parent)
|
||||
edits += ["-change", name, "@loader_path/" + relative]
|
||||
self.relocate(dependency, destination, search)
|
||||
if identity:
|
||||
edits += ["-id", "@rpath/" + target.name]
|
||||
for name in sorted(set(rpaths(target))):
|
||||
edits += ["-delete_rpath", name]
|
||||
if edits:
|
||||
run("install_name_tool", *edits, target)
|
||||
|
||||
|
||||
def copy_tree(source: Path, target: Path) -> None:
|
||||
if source.is_dir():
|
||||
# Dereference symlinks: never leave links into the builder's Cellar.
|
||||
shutil.copytree(source, target, dirs_exist_ok=True, symlinks=False)
|
||||
|
||||
|
||||
def audit(app: Path) -> dict[str, object]:
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
architectures = set(run("lipo", "-archs", binary).split())
|
||||
minimum = (11, 0, 0)
|
||||
entries = []
|
||||
for path in sorted(app.rglob("*")):
|
||||
if path.is_symlink():
|
||||
resolved = path.resolve()
|
||||
if not resolved.is_relative_to(app.resolve()):
|
||||
raise RuntimeError(f"External symlink: {path} -> {resolved}")
|
||||
if not is_macho(path):
|
||||
continue
|
||||
if not architectures.issubset(set(run("lipo", "-archs", path).split())):
|
||||
raise RuntimeError(f"Architecture mismatch: {path}")
|
||||
identity = dylib_id(path)
|
||||
for name in dependencies(path):
|
||||
if name == identity or system_library(name):
|
||||
continue
|
||||
if not name.startswith("@loader_path/"):
|
||||
raise RuntimeError(f"Non-relocatable dependency: {path}: {name}")
|
||||
target = expand_path(name, path, binary).resolve()
|
||||
if not target.is_relative_to(app.resolve()) or not target.is_file():
|
||||
raise RuntimeError(f"Missing or external dependency: {path}: {name}")
|
||||
if rpaths(path):
|
||||
raise RuntimeError(f"Unexpected runtime search paths: {path}")
|
||||
load_commands = run("otool", "-l", path)
|
||||
versions = re.findall(r"\bminos (\d+(?:\.\d+){0,2})", load_commands)
|
||||
versions += re.findall(r"cmd LC_VERSION_MIN_MACOSX\s+cmdsize \d+\s+version (\d+(?:\.\d+){0,2})", load_commands)
|
||||
if not versions:
|
||||
raise RuntimeError(f"Missing deployment version: {path}")
|
||||
for version in versions:
|
||||
parts = tuple(int(value) for value in version.split("."))
|
||||
minimum = max(minimum, parts + (0,) * (3 - len(parts)))
|
||||
entries.append({"path": str(path.relative_to(app))})
|
||||
return {"architectures": sorted(architectures), "minimum_macos": ".".join(map(str, minimum if minimum[2] else minimum[:2])), "mach_o": entries}
|
||||
|
||||
|
||||
def package(stage: Path, app: Path, build_number: str) -> None:
|
||||
if not re.fullmatch(r"[1-9]\d*(?:\.\d+){0,2}", build_number):
|
||||
raise RuntimeError("Build number must be a positive Apple CFBundleVersion (for example 1 or 12.3)")
|
||||
if app.exists():
|
||||
raise RuntimeError(f"Output already exists; choose another --output or remove it explicitly: {app}")
|
||||
app.mkdir(parents=True)
|
||||
resources = app / "Contents/Resources"
|
||||
resources.mkdir(parents=True)
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
binary.parent.mkdir()
|
||||
shutil.copy2(stage / "bin/zoitechat", binary)
|
||||
copy_tree(stage / "share", resources / "share")
|
||||
copy_tree(stage / "lib/zoitechat/plugins", resources / "lib/zoitechat/plugins")
|
||||
relocator = Relocator(app, stage / "bin/zoitechat")
|
||||
seeds: list[tuple[Path, Path]] = [(stage / "bin/zoitechat", binary)]
|
||||
for source in (stage / "lib/zoitechat/plugins").glob("*"):
|
||||
if is_macho(source):
|
||||
seeds.append((source, resources / "lib/zoitechat/plugins" / source.name))
|
||||
|
||||
prefixes = {formula: Path(run("brew", "--prefix", formula)) for formula in (
|
||||
"gtk+3", "gdk-pixbuf", "glib", "glib-networking", "librsvg", "enchant", "adwaita-icon-theme", "hicolor-icon-theme", "gsettings-desktop-schemas", "ca-certificates", "openssl@3", "lua", "libarchive", "gtk-mac-integration")}
|
||||
# Runtime-loaded code is not visible in the main executable's otool output.
|
||||
module_groups = [
|
||||
(prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
|
||||
(prefixes["librsvg"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
|
||||
(prefixes["gtk+3"] / "lib/gtk-3.0/3.0.0/immodules", "lib/gtk-3.0/3.0.0/immodules"),
|
||||
(prefixes["glib-networking"] / "lib/gio/modules", "lib/gio/modules"),
|
||||
(prefixes["enchant"] / "lib/enchant-2", "lib/enchant-2"),
|
||||
(prefixes["openssl@3"] / "lib/ossl-modules", "lib/ossl-modules"),
|
||||
]
|
||||
for source_dir, relative in module_groups:
|
||||
target_dir = resources / relative
|
||||
target_dir.mkdir(parents=True, exist_ok=True)
|
||||
for source in sorted(source_dir.glob("*")):
|
||||
if source.suffix not in (".so", ".dylib") or not source.is_file():
|
||||
continue
|
||||
target = target_dir / source.name
|
||||
if target.exists() and target.read_bytes() != source.read_bytes():
|
||||
raise RuntimeError(f"Conflicting module: {target}")
|
||||
shutil.copy2(source.resolve(), target)
|
||||
seeds.append((source.resolve(), target))
|
||||
enchant = (prefixes["enchant"] / "lib/libenchant-2.dylib").resolve()
|
||||
# Register Enchant at Resources/lib so its public prefix relocation API
|
||||
# finds Resources/lib/enchant-2 and Resources/share/enchant.
|
||||
enchant_alias = resources / "lib/libenchant-2.dylib"
|
||||
shutil.copy2(enchant, enchant_alias)
|
||||
relocator.sources[enchant] = enchant_alias
|
||||
relocator.names[enchant.name] = enchant
|
||||
seeds.append((enchant, enchant_alias))
|
||||
for formula, prefix in prefixes.items():
|
||||
for name in ("icons", "glib-2.0/schemas", "locale", "enchant", "hunspell"):
|
||||
copy_tree(prefix / "share" / name, resources / "share" / name)
|
||||
ca = prefixes["ca-certificates"] / "share/ca-certificates/cacert.pem"
|
||||
if not ca.is_file():
|
||||
raise RuntimeError(f"CA bundle not found: {ca}")
|
||||
(resources / "certs").mkdir()
|
||||
shutil.copy2(ca, resources / "certs/ca-bundle.crt")
|
||||
schemas = resources / "share/glib-2.0/schemas"
|
||||
run(prefixes["glib"] / "bin/glib-compile-schemas", schemas)
|
||||
pixbuf_modules = sorted((resources / "lib/gdk-pixbuf-2.0/2.10.0/loaders").glob("*"))
|
||||
if not any("svg" in path.name for path in pixbuf_modules):
|
||||
raise RuntimeError("SVG loader missing: install librsvg")
|
||||
if list((resources / "lib/zoitechat/plugins").glob("fishlim.*")) and not list((resources / "lib/ossl-modules").glob("legacy.*")):
|
||||
raise RuntimeError("FiSH needs the OpenSSL legacy provider in the bundle")
|
||||
if not list((resources / "lib/gio/modules").glob("*tls*")):
|
||||
raise RuntimeError("GIO TLS backend missing: install glib-networking")
|
||||
# Query original binaries before relocation, then rewrite only the cached paths.
|
||||
pixbuf_query = prefixes["gdk-pixbuf"] / "bin/gdk-pixbuf-query-loaders"
|
||||
if not pixbuf_query.exists():
|
||||
pixbuf_query = prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
|
||||
for tool, module_dir, cache in (
|
||||
(pixbuf_query, "lib/gdk-pixbuf-2.0/2.10.0/loaders", "pixbuf-loaders.cache"),
|
||||
(prefixes["gtk+3"] / "bin/gtk-query-immodules-3.0", "lib/gtk-3.0/3.0.0/immodules", "gtk-immodules.cache"),
|
||||
):
|
||||
originals = [(source, target) for source, target in seeds if target.parent == resources / module_dir]
|
||||
# Never call a query tool with zero arguments: it would scan global modules.
|
||||
data = run(tool, *(source for source, _ in originals)) if originals else "# No external input-method modules\n"
|
||||
for source, target in originals:
|
||||
data = data.replace(str(source), "@ZOITECHAT_RESOURCES@/" + str(target.relative_to(resources)))
|
||||
(resources / cache).write_text(data + "\n")
|
||||
# The private font map loads the bundled Noto font; ordinary GTK fonts stay local.
|
||||
(resources / "fonts.conf").write_text('''<?xml version="1.0"?>
|
||||
<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
|
||||
<fontconfig>
|
||||
<dir>/System/Library/Fonts</dir><dir>/Library/Fonts</dir><dir>~/Library/Fonts</dir>
|
||||
<cachedir prefix="xdg">fontconfig</cachedir>
|
||||
<alias><family>sans-serif</family><prefer><family>Helvetica</family></prefer></alias>
|
||||
<alias><family>monospace</family><prefer><family>Menlo</family></prefer></alias>
|
||||
</fontconfig>
|
||||
''')
|
||||
(resources / "zoitechat-bundle").write_text("1\n")
|
||||
licenses = resources / "licenses"
|
||||
licenses.mkdir()
|
||||
shutil.copy2(ROOT / "COPYING", licenses / "ZoiteChat-COPYING")
|
||||
# Preserve the notices shipped with every installed Homebrew dependency.
|
||||
# brew deps traverses dependencies by default; --recursive is not an option.
|
||||
wanted = set(prefixes)
|
||||
for formula in prefixes:
|
||||
wanted.update(run("brew", "deps", "--formula", formula).splitlines())
|
||||
installed = [item for item in json.loads(run("brew", "info", "--json=v2", "--installed"))["formulae"]
|
||||
if item["name"] in wanted]
|
||||
for formula in installed:
|
||||
prefix = Path(run("brew", "--prefix", formula["name"]))
|
||||
notices = [p for p in prefix.iterdir() if p.is_file() and re.match(r"(?i)(copying|license|copyright|notice)", p.name)]
|
||||
if notices:
|
||||
target = licenses / formula["name"].replace("/", "-")
|
||||
target.mkdir(exist_ok=True)
|
||||
for notice in notices:
|
||||
shutil.copy2(notice, target / notice.name)
|
||||
(resources / "homebrew-dependencies.json").write_text(json.dumps(installed, indent=2) + "\n")
|
||||
for source, target in seeds:
|
||||
relocator.relocate(source, target)
|
||||
report = audit(app)
|
||||
(resources / "bundle-audit.json").write_text(json.dumps(report, indent=2) + "\n")
|
||||
# Use the actual highest deployment target of the executable and all dylibs.
|
||||
# Setting an older plist version cannot make newer Homebrew bottles compatible.
|
||||
version = (ROOT / "VERSION").read_text().strip()
|
||||
release = re.match(r"\d+\.\d+\.\d+", version)
|
||||
if not release:
|
||||
raise RuntimeError(f"Unsupported release version: {version}")
|
||||
plist = {
|
||||
"CFBundleIdentifier": "org.Zoitechat", "CFBundleExecutable": "zoitechat",
|
||||
"CFBundleName": "ZoiteChat", "CFBundleDisplayName": "ZoiteChat",
|
||||
"CFBundlePackageType": "APPL", "CFBundleShortVersionString": release.group(),
|
||||
"CFBundleVersion": build_number, "CFBundleIconFile": "ZoiteChat.icns",
|
||||
"LSMinimumSystemVersion": report["minimum_macos"], "NSHighResolutionCapable": True,
|
||||
"NSPrincipalClass": "NSApplication",
|
||||
"LSApplicationCategoryType": "public.app-category.social-networking",
|
||||
"DTSDKName": "macosx" + run("xcrun", "--sdk", "macosx", "--show-sdk-version"),
|
||||
"DTSDKBuild": run("xcrun", "--sdk", "macosx", "--show-sdk-build-version"),
|
||||
}
|
||||
with (app / "Contents/Info.plist").open("wb") as stream:
|
||||
plistlib.dump(plist, stream)
|
||||
iconset = app.parent / (app.stem + ".iconset")
|
||||
if iconset.exists():
|
||||
raise RuntimeError(f"Icon staging directory already exists: {iconset}")
|
||||
iconset.mkdir()
|
||||
try:
|
||||
# Rasterize the original vector at 1024px, then generate every icon size.
|
||||
large = iconset / "source.png"
|
||||
run(prefixes["librsvg"] / "bin/rsvg-convert", "-w", "1024", "-h", "1024", "-o", large, ROOT / "data/icons/zoitechat.svg")
|
||||
for size in (16, 32, 128, 256, 512):
|
||||
for scale in (1, 2):
|
||||
name = f"icon_{size}x{size}" + ("@2x" if scale == 2 else "") + ".png"
|
||||
run("sips", "-z", str(size * scale), str(size * scale), large, "--out", iconset / name)
|
||||
large.unlink()
|
||||
run("iconutil", "-c", "icns", iconset, "-o", resources / "ZoiteChat.icns")
|
||||
finally:
|
||||
shutil.rmtree(iconset)
|
||||
# Local builds need an ad-hoc signature after install_name_tool changes.
|
||||
sign(app, "-", None)
|
||||
print(f"Created {app}: {', '.join(report['architectures'])}, macOS {report['minimum_macos']}+")
|
||||
|
||||
|
||||
def sign(app: Path, identity: str, entitlements: Path | None, *, keychain: Path | None = None) -> None:
|
||||
audit(app)
|
||||
binaries = [p for p in app.rglob("*") if is_macho(p) and p != app / "Contents/MacOS/zoitechat"]
|
||||
options = [] if identity == "-" else ["--timestamp", "--options", "runtime"]
|
||||
if keychain is not None:
|
||||
options += ["--keychain", str(keychain)]
|
||||
for binary in sorted(binaries, key=lambda p: len(p.parts), reverse=True):
|
||||
run("codesign", "--force", "--sign", identity, *options, binary)
|
||||
main_options = ["--entitlements", str(entitlements)] if entitlements else []
|
||||
run("codesign", "--force", "--sign", identity, *options, *main_options, app)
|
||||
run("codesign", "--verify", "--deep", "--strict", "--verbose=2", app)
|
||||
|
||||
|
||||
def main() -> None:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
sub = parser.add_subparsers(dest="action", required=True)
|
||||
create = sub.add_parser("create")
|
||||
create.add_argument("--stage", type=Path, required=True)
|
||||
create.add_argument("--app", type=Path, required=True)
|
||||
create.add_argument("--build-number", default="1")
|
||||
verify = sub.add_parser("audit")
|
||||
verify.add_argument("app", type=Path)
|
||||
signing = sub.add_parser("sign")
|
||||
signing.add_argument("app", type=Path)
|
||||
signing.add_argument("--identity", required=True)
|
||||
signing.add_argument("--entitlements", type=Path)
|
||||
args = parser.parse_args()
|
||||
if platform.system() != "Darwin":
|
||||
parser.error("This tool requires macOS and the Xcode command-line tools")
|
||||
if args.action == "create":
|
||||
package(args.stage.resolve(), args.app.resolve(), args.build_number)
|
||||
elif args.action == "audit":
|
||||
print(json.dumps(audit(args.app.resolve()), indent=2))
|
||||
else:
|
||||
sign(args.app.resolve(), args.identity, args.entitlements)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
|
||||
sys.exit(f"macOS packaging failed: {error}")
|
||||
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0"><dict>
|
||||
<!-- User-installed native plugins need library validation disabled. -->
|
||||
<key>com.apple.security.cs.disable-library-validation</key><true/>
|
||||
</dict></plist>
|
||||
@@ -0,0 +1,220 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Developer ID sign, notarize and staple a built app using CI environment secrets."""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import base64
|
||||
import binascii
|
||||
from contextlib import contextmanager
|
||||
from dataclasses import dataclass
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import platform
|
||||
import re
|
||||
import secrets
|
||||
import shlex
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import urllib.request
|
||||
import uuid
|
||||
|
||||
from bundle import sign
|
||||
|
||||
REQUIRED = (
|
||||
"MACOS_CERTIFICATE_P12_BASE64", "MACOS_CERTIFICATE_PASSWORD",
|
||||
"MACOS_SIGNING_IDENTITY", "APPLE_API_KEY_P8", "APPLE_API_KEY_ID", "APPLE_API_ISSUER_ID",
|
||||
)
|
||||
|
||||
|
||||
@dataclass(repr=False)
|
||||
class Credentials:
|
||||
certificate: bytes
|
||||
password: str
|
||||
identity: str
|
||||
api_key: str
|
||||
key_id: str
|
||||
issuer: str
|
||||
|
||||
@classmethod
|
||||
def from_environment(cls) -> Credentials:
|
||||
missing = [name for name in REQUIRED if not os.environ.get(name, "").strip()]
|
||||
if missing:
|
||||
raise RuntimeError("Missing release settings: " + ", ".join(missing))
|
||||
try:
|
||||
certificate = base64.b64decode("".join(os.environ[REQUIRED[0]].split()), validate=True)
|
||||
except (binascii.Error, ValueError):
|
||||
raise RuntimeError("MACOS_CERTIFICATE_P12_BASE64 must contain Base64-encoded .p12 bytes") from None
|
||||
if not certificate:
|
||||
raise RuntimeError("Signing certificate is empty")
|
||||
identity = os.environ["MACOS_SIGNING_IDENTITY"].strip()
|
||||
if not (identity.startswith("Developer ID Application:") or re.fullmatch(r"[a-fA-F0-9]{40}", identity)):
|
||||
raise RuntimeError("MACOS_SIGNING_IDENTITY must identify a Developer ID Application certificate")
|
||||
api_key = os.environ["APPLE_API_KEY_P8"].strip()
|
||||
if not (api_key.startswith("-----BEGIN PRIVATE KEY-----") and api_key.endswith("-----END PRIVATE KEY-----")):
|
||||
raise RuntimeError("APPLE_API_KEY_P8 must contain the complete, plain-text .p8 private key")
|
||||
key_id = os.environ["APPLE_API_KEY_ID"].strip()
|
||||
if not re.fullmatch(r"[A-Za-z0-9]{6,32}", key_id):
|
||||
raise RuntimeError("APPLE_API_KEY_ID must be an App Store Connect key ID")
|
||||
try:
|
||||
issuer = str(uuid.UUID(os.environ["APPLE_API_ISSUER_ID"].strip()))
|
||||
except ValueError:
|
||||
raise RuntimeError("APPLE_API_ISSUER_ID must be the Team API key issuer UUID") from None
|
||||
return cls(certificate, os.environ["MACOS_CERTIFICATE_PASSWORD"], identity, api_key, key_id, issuer)
|
||||
|
||||
|
||||
def execute(args: list[str | Path], operation: str, *, check: bool = True) -> subprocess.CompletedProcess[str]:
|
||||
# Do not print argv or CalledProcessError: security commands contain passwords.
|
||||
try:
|
||||
result = subprocess.run([str(arg) for arg in args], capture_output=True, text=True, check=False)
|
||||
except OSError:
|
||||
raise RuntimeError(f"{operation}: could not start the required tool") from None
|
||||
if check and result.returncode != 0:
|
||||
raise RuntimeError(f"{operation} failed (exit {result.returncode})")
|
||||
return result
|
||||
|
||||
|
||||
def write_private(path: Path, data: bytes) -> None:
|
||||
with path.open("xb") as stream:
|
||||
path.chmod(0o600)
|
||||
stream.write(data)
|
||||
|
||||
|
||||
def resolve_identity(output: str, requested: str) -> str:
|
||||
for fingerprint, name in re.findall(r'\b([A-Fa-f0-9]{40})\s+"([^"\n]+)"', output):
|
||||
if name.startswith("Developer ID Application:") and (requested == name or requested.upper() == fingerprint.upper()):
|
||||
return fingerprint
|
||||
raise RuntimeError("Imported .p12 has no valid Developer ID Application identity matching MACOS_SIGNING_IDENTITY; check its private key, password, expiry and certificate chain")
|
||||
|
||||
|
||||
@contextmanager
|
||||
def signing_keychain(credentials: Credentials):
|
||||
original = shlex.split(execute(["security", "list-keychains", "-d", "user"], "Read keychain search list").stdout)
|
||||
with tempfile.TemporaryDirectory(prefix="zoitechat-signing-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
|
||||
directory = Path(temporary)
|
||||
keychain = directory / "signing.keychain-db"
|
||||
keychain_password = secrets.token_urlsafe(32)
|
||||
certificate = directory / "signing.p12"
|
||||
api_key = directory / "notary.p8"
|
||||
write_private(certificate, credentials.certificate)
|
||||
write_private(api_key, (credentials.api_key + "\n").encode())
|
||||
try:
|
||||
execute(["security", "create-keychain", "-p", keychain_password, keychain], "Create signing keychain")
|
||||
execute(["security", "set-keychain-settings", "-lut", "21600", keychain], "Configure signing keychain")
|
||||
execute(["security", "unlock-keychain", "-p", keychain_password, keychain], "Unlock signing keychain")
|
||||
# Include both public Developer ID intermediates so signing does not
|
||||
# depend on the runner having cached the leaf certificate's issuer.
|
||||
for name in ("DeveloperIDCA.cer", "DeveloperIDG2CA.cer"):
|
||||
intermediate = directory / name
|
||||
try:
|
||||
with urllib.request.urlopen("https://www.apple.com/certificateauthority/" + name, timeout=60) as response:
|
||||
write_private(intermediate, response.read())
|
||||
except OSError:
|
||||
raise RuntimeError("Download of Apple's public Developer ID intermediate failed") from None
|
||||
execute(["security", "import", intermediate, "-k", keychain], "Import Developer ID intermediate")
|
||||
execute(["security", "import", certificate, "-P", credentials.password,
|
||||
"-k", keychain, "-T", "/usr/bin/codesign", "-T", "/usr/bin/security"], "Import signing .p12")
|
||||
execute(["security", "set-key-partition-list", "-S", "apple-tool:,apple:",
|
||||
"-k", keychain_password, keychain], "Allow non-interactive code signing")
|
||||
execute(["security", "list-keychains", "-d", "user", "-s", keychain, *original], "Add temporary signing keychain")
|
||||
identities = execute(["security", "find-identity", "-v", "-p", "codesigning", keychain], "Find signing identity").stdout
|
||||
yield keychain, api_key, resolve_identity(identities, credentials.identity)
|
||||
finally:
|
||||
# Hosted runners are discarded too, but clean up on every ordinary
|
||||
# success/failure path and restore the original search list.
|
||||
execute(["security", "list-keychains", "-d", "user", "-s", *original], "Restore keychain search list", check=False)
|
||||
if keychain.exists():
|
||||
result = execute(["security", "delete-keychain", keychain], "Delete signing keychain", check=False)
|
||||
if result.returncode:
|
||||
print("Warning: keychain deletion failed; temporary files will still be removed.", file=sys.stderr)
|
||||
|
||||
|
||||
def decode_response(result: subprocess.CompletedProcess[str], operation: str) -> dict:
|
||||
try:
|
||||
response = json.loads(result.stdout)
|
||||
except (json.JSONDecodeError, TypeError):
|
||||
raise RuntimeError(f"{operation} did not return valid JSON (exit {result.returncode})") from None
|
||||
if not isinstance(response, dict):
|
||||
raise RuntimeError(f"{operation} returned an unexpected response")
|
||||
return response
|
||||
|
||||
|
||||
def save_json(path: Path, response: dict) -> None:
|
||||
path.write_text(json.dumps(response, indent=2) + "\n")
|
||||
|
||||
|
||||
def notarize(app: Path, output: Path, diagnostics: Path, credentials: Credentials, api_key: Path, timeout: str) -> None:
|
||||
diagnostics.mkdir(parents=True, exist_ok=True)
|
||||
authentication = ["--key", str(api_key), "--key-id", credentials.key_id, "--issuer", credentials.issuer]
|
||||
with tempfile.TemporaryDirectory(prefix="zoitechat-notary-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
|
||||
submission_zip = Path(temporary) / "ZoiteChat-submission.zip"
|
||||
execute(["ditto", "-c", "-k", "--keepParent", app, submission_zip], "Package notarization submission")
|
||||
result = execute(["xcrun", "notarytool", "submit", submission_zip, *authentication,
|
||||
"--output-format", "json"], "Submit notarization", check=False)
|
||||
submission = decode_response(result, "Notarization submission")
|
||||
save_json(diagnostics / "submission.json", submission)
|
||||
if result.returncode or not submission.get("id"):
|
||||
raise RuntimeError("Apple rejected the notarization submission; see submission.json")
|
||||
try:
|
||||
submission_id = str(uuid.UUID(submission["id"]))
|
||||
except (ValueError, TypeError, AttributeError):
|
||||
raise RuntimeError("Apple returned an invalid notarization submission ID") from None
|
||||
print(f"Notarization submitted: {submission_id}", flush=True)
|
||||
waited = execute(["xcrun", "notarytool", "wait", submission_id, *authentication,
|
||||
"--timeout", timeout, "--output-format", "json"], "Wait for notarization", check=False)
|
||||
try:
|
||||
status = decode_response(waited, "Notarization wait")
|
||||
except RuntimeError:
|
||||
status = {"id": submission_id, "status": "Unknown", "exit_code": waited.returncode}
|
||||
save_json(diagnostics / "status.json", status)
|
||||
# Apple can provide a diagnostic log after processing. Fetch it for both
|
||||
# successful and rejected submissions; never include credential files.
|
||||
execute(["xcrun", "notarytool", "log", submission_id, *authentication,
|
||||
diagnostics / "notary-log.json"], "Fetch notarization log", check=False)
|
||||
if waited.returncode or status.get("status") != "Accepted":
|
||||
raise RuntimeError("Notarization was not accepted or exceeded the wait limit; see the notarization diagnostic artifact. No release ZIP will be published")
|
||||
execute(["xcrun", "stapler", "staple", app], "Staple notarization ticket")
|
||||
execute(["xcrun", "stapler", "validate", app], "Validate notarization ticket")
|
||||
execute(["codesign", "--verify", "--deep", "--strict", "--verbose=2", app], "Verify stapled app signature")
|
||||
execute(["spctl", "--assess", "--type", "execute", "--verbose=2", app], "Assess Gatekeeper acceptance")
|
||||
output.parent.mkdir(parents=True, exist_ok=True)
|
||||
# Repack only after stapling. The submission ZIP is not the distributable ZIP.
|
||||
execute(["ditto", "-c", "-k", "--keepParent", app, output], "Package notarized release")
|
||||
print(f"Signed and notarized release: {output}", flush=True)
|
||||
|
||||
|
||||
def main() -> None:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--check-config", action="store_true", help="Validate release settings without accessing Apple or a keychain")
|
||||
parser.add_argument("--app", type=Path, default=Path("dist/ZoiteChat.app"))
|
||||
parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat-signed-notarized.zip"))
|
||||
parser.add_argument("--diagnostics", type=Path, default=Path("dist/notarization"))
|
||||
parser.add_argument("--notary-timeout", default="60m")
|
||||
args = parser.parse_args()
|
||||
credentials = Credentials.from_environment()
|
||||
if args.check_config:
|
||||
print("Release signing and notarization settings are present and correctly formatted.")
|
||||
return
|
||||
if platform.system() != "Darwin":
|
||||
parser.error("Signing/notarization requires the macOS runner and Xcode command-line tools")
|
||||
if not args.app.is_dir() or args.output.exists():
|
||||
parser.error("Provide a built .app and an output ZIP path that does not already exist")
|
||||
if not re.fullmatch(r"[1-9]\d*[smh]", args.notary_timeout):
|
||||
parser.error("Use a positive notarization timeout, such as 60m")
|
||||
with signing_keychain(credentials) as (keychain, api_key, identity):
|
||||
sign(args.app.resolve(), identity, Path(__file__).with_name("direct.entitlements"), keychain=keychain)
|
||||
notarize(args.app.resolve(), args.output.resolve(), args.diagnostics.resolve(), credentials, api_key, args.notary_timeout)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except (RuntimeError, OSError):
|
||||
# RuntimeError messages are authored above and do not contain secret argv.
|
||||
error = sys.exc_info()[1]
|
||||
if isinstance(error, RuntimeError):
|
||||
sys.exit(f"macOS release failed: {error}")
|
||||
sys.exit("macOS release failed: file or network operation failed")
|
||||
except subprocess.CalledProcessError:
|
||||
sys.exit("macOS release failed: code signing or bundle audit failed")
|
||||
@@ -0,0 +1,49 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Run the relocated bundle with temporary settings and no IRC auto-connect."""
|
||||
from __future__ import annotations
|
||||
import argparse
|
||||
from pathlib import Path
|
||||
import shutil
|
||||
import subprocess
|
||||
import tempfile
|
||||
|
||||
|
||||
def main() -> None:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("app", type=Path)
|
||||
args = parser.parse_args()
|
||||
with tempfile.TemporaryDirectory(prefix="zoitechat-macos-smoke-") as directory:
|
||||
# Include spaces to exercise dyld and GTK module-cache path handling.
|
||||
app = Path(directory) / "Relocated App" / "ZoiteChat.app"
|
||||
shutil.copytree(args.app.resolve(), app)
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
subprocess.run(["codesign", "--verify", "--deep", "--strict", str(app)], check=True)
|
||||
subprocess.run([str(binary), "--version"], check=True, timeout=30)
|
||||
config = Path(directory) / "test-config"
|
||||
with (Path(directory) / "startup.log").open("w+") as log:
|
||||
process = subprocess.Popen([str(binary), "--no-auto", "--cfgdir", str(config)], stdout=log, stderr=log)
|
||||
try:
|
||||
process.wait(timeout=10)
|
||||
except subprocess.TimeoutExpired:
|
||||
# Stop the isolated process after checking for early startup failure.
|
||||
process.terminate()
|
||||
try:
|
||||
process.wait(timeout=10)
|
||||
except subprocess.TimeoutExpired:
|
||||
process.kill()
|
||||
process.wait()
|
||||
raise RuntimeError("GUI startup process did not terminate")
|
||||
else:
|
||||
log.seek(0)
|
||||
raise RuntimeError(f"GUI exited before smoke interval (code {process.returncode}):\n{log.read()}")
|
||||
log.seek(0)
|
||||
messages = log.read()
|
||||
print(messages)
|
||||
for failure in ("Library not loaded:", "Symbol not found:", "cannot open display", "Cannot load bundled HTTPS trust database", "Bundled emoji font is missing", "Cannot relocate", "Error loading plugin:"):
|
||||
if failure.lower() in messages.lower():
|
||||
raise RuntimeError(f"Startup failure found: {failure}")
|
||||
print("Relocated bundle stayed running for 10 seconds; manual interaction testing is still required.")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,10 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0"><dict>
|
||||
<key>com.apple.security.app-sandbox</key><true/>
|
||||
<key>com.apple.security.network.client</key><true/>
|
||||
<!-- DCC listening sockets and the optional ident service. -->
|
||||
<key>com.apple.security.network.server</key><true/>
|
||||
<key>com.apple.security.files.user-selected.read-write</key><true/>
|
||||
<key>com.apple.security.files.downloads.read-write</key><true/>
|
||||
</dict></plist>
|
||||
@@ -0,0 +1,125 @@
|
||||
"""Dependency parsing, relocation guards and release audit tests without a Mac SDK."""
|
||||
from pathlib import Path
|
||||
import shutil
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
|
||||
import bundle
|
||||
|
||||
|
||||
class BundleTests(unittest.TestCase):
|
||||
@unittest.skipUnless(sys.platform == "darwin", "requires Apple's Mach-O tools")
|
||||
def test_signed_binary_relocation_and_resigning(self):
|
||||
with tempfile.TemporaryDirectory(prefix="zoitechat relocation ") as temporary:
|
||||
directory = Path(temporary)
|
||||
library_source = directory / "answer.c"
|
||||
library_source.write_text("int answer(void) { return 42; }\n")
|
||||
library = directory / "libanswer.dylib"
|
||||
main_source = directory / "main.c"
|
||||
main_source.write_text(
|
||||
"#include <stdio.h>\n"
|
||||
"extern int answer(void);\n"
|
||||
"int main(void) { printf(\"%d\\n\", answer()); return 0; }\n"
|
||||
)
|
||||
executable = directory / "original"
|
||||
bundle.run("xcrun", "clang", "-dynamiclib", "-Wl,-headerpad_max_install_names",
|
||||
"-Wl,-install_name," + str(library), library_source, "-o", library)
|
||||
bundle.run("xcrun", "clang", "-Wl,-headerpad_max_install_names",
|
||||
"-Wl,-rpath," + str(directory), main_source, library, "-o", executable)
|
||||
for binary in (library, executable):
|
||||
bundle.run("codesign", "--force", "--sign", "-", binary)
|
||||
app = directory / "Test.app"
|
||||
target = app / "Contents/MacOS/zoitechat"
|
||||
target.parent.mkdir(parents=True)
|
||||
shutil.copy2(executable, target)
|
||||
relocator = bundle.Relocator(app, executable)
|
||||
relocator.relocate(executable, target)
|
||||
# Remove the original dependency so execution proves relocation.
|
||||
library.unlink()
|
||||
for binary in (app / "Contents/Frameworks/libanswer.dylib", target):
|
||||
bundle.run("codesign", "--force", "--sign", "-", binary)
|
||||
bundle.run("codesign", "--verify", "--strict", binary)
|
||||
self.assertEqual(bundle.run(target), "42")
|
||||
self.assertEqual(len(bundle.audit(app)["mach_o"]), 2)
|
||||
|
||||
def test_otool_preserves_paths_with_spaces(self):
|
||||
output = "app:\n\t/opt/Build Dependencies/lib/liba.dylib (compatibility version 1.0.0, current version 1.0.0)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1.0.0)"
|
||||
with patch.object(bundle, "run", return_value=output):
|
||||
self.assertEqual(bundle.dependencies(Path("app")), ["/opt/Build Dependencies/lib/liba.dylib", "/usr/lib/libSystem.B.dylib"])
|
||||
|
||||
def test_lc_rpaths_preserve_spaces(self):
|
||||
with patch.object(bundle, "run", return_value="cmd LC_RPATH\n cmdsize 48\n path @loader_path/../Build Dependencies (offset 12)\n"):
|
||||
self.assertEqual(bundle.rpaths(Path("app")), ["@loader_path/../Build Dependencies"])
|
||||
|
||||
def test_inherited_rpath_resolution(self):
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
directory = Path(temporary)
|
||||
library = directory / "with spaces/libtest.dylib"
|
||||
library.parent.mkdir()
|
||||
library.write_bytes(b"library")
|
||||
self.assertEqual(bundle.resolve_dependency("@rpath/libtest.dylib", directory / "libparent.dylib", directory / "app", [library.parent]), library.resolve())
|
||||
|
||||
def test_unresolved_rpath_fails(self):
|
||||
with self.assertRaisesRegex(RuntimeError, "Cannot resolve"):
|
||||
bundle.resolve_dependency("@rpath/missing.dylib", Path("/tmp/parent"), Path("/tmp/app"), [])
|
||||
|
||||
def test_conflicting_basename_fails(self):
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
directory = Path(temporary)
|
||||
sources = [directory / name / "libtest.dylib" for name in ("one", "two")]
|
||||
for source in sources:
|
||||
source.parent.mkdir()
|
||||
source.write_bytes(b"library")
|
||||
relocator = bundle.Relocator(directory / "App.app", directory / "executable")
|
||||
relocator.copy_dependency(sources[0])
|
||||
with self.assertRaisesRegex(RuntimeError, "Conflicting library basename"):
|
||||
relocator.copy_dependency(sources[1])
|
||||
|
||||
def test_audit_rejects_external_symlink(self):
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
app = Path(temporary) / "App.app"
|
||||
app.mkdir()
|
||||
(app / "outside").symlink_to("/usr/lib")
|
||||
with patch.object(bundle, "run", return_value="arm64"), self.assertRaisesRegex(RuntimeError, "External symlink"):
|
||||
bundle.audit(app)
|
||||
|
||||
def test_audit_raises_minimum_for_dependencies(self):
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
app = Path(temporary) / "App.app"
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
library = app / "Contents/Frameworks/libtest.dylib"
|
||||
for path in (binary, library):
|
||||
path.parent.mkdir(parents=True, exist_ok=True)
|
||||
path.write_bytes(bytes.fromhex("cffaedfe") + b"payload")
|
||||
def fake_run(*args):
|
||||
if args[0] == "lipo":
|
||||
return "arm64"
|
||||
if args[1] == "-D":
|
||||
return str(args[2]) + ("\n@rpath/libtest.dylib" if args[2] == library else "")
|
||||
if args[1] == "-L":
|
||||
name = "@loader_path/../Frameworks/libtest.dylib" if args[2] == binary else "@rpath/libtest.dylib"
|
||||
return f"{args[2]}:\n\t{name} (compatibility version 1.0.0, current version 1.0.0)"
|
||||
return "cmd LC_BUILD_VERSION\n cmdsize 32\n platform 1\n minos " + ("15.0.1" if args[2] == library else "11.0")
|
||||
with patch.object(bundle, "run", side_effect=fake_run):
|
||||
report = bundle.audit(app)
|
||||
self.assertEqual(report["minimum_macos"], "15.0.1")
|
||||
self.assertEqual(report["architectures"], ["arm64"])
|
||||
self.assertEqual(len(report["mach_o"]), 2)
|
||||
|
||||
def test_audit_rejects_wrong_architecture(self):
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
app = Path(temporary) / "App.app"
|
||||
binary = app / "Contents/MacOS/zoitechat"
|
||||
library = app / "Contents/Frameworks/libtest.dylib"
|
||||
for path in (binary, library):
|
||||
path.parent.mkdir(parents=True, exist_ok=True)
|
||||
path.write_bytes(bytes.fromhex("cffaedfe"))
|
||||
with patch.object(bundle, "run", side_effect=["arm64", "x86_64"]), self.assertRaisesRegex(RuntimeError, "Architecture mismatch"):
|
||||
bundle.audit(app)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -0,0 +1,153 @@
|
||||
"""Release failure gates, private-key handling and notarization result checks."""
|
||||
from contextlib import redirect_stdout
|
||||
import base64
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
|
||||
import release
|
||||
|
||||
FINGERPRINT = "A" * 40
|
||||
IDENTITY = "Developer ID Application: Test Only (NOTAREALID)"
|
||||
SUBMISSION = "a8c9438a-b972-455e-aedc-278070349394"
|
||||
ENVIRONMENT = {
|
||||
"MACOS_CERTIFICATE_P12_BASE64": base64.b64encode(b"not-a-real-certificate").decode(),
|
||||
"MACOS_CERTIFICATE_PASSWORD": "unit-test-password",
|
||||
"MACOS_SIGNING_IDENTITY": IDENTITY,
|
||||
"APPLE_API_KEY_P8": "-----BEGIN PRIVATE KEY-----\nunit-test-only\n-----END PRIVATE KEY-----",
|
||||
"APPLE_API_KEY_ID": "TESTKEY123",
|
||||
"APPLE_API_ISSUER_ID": SUBMISSION,
|
||||
}
|
||||
|
||||
|
||||
class ReleaseTests(unittest.TestCase):
|
||||
def credentials(self):
|
||||
with patch.dict(os.environ, ENVIRONMENT, clear=True):
|
||||
return release.Credentials.from_environment()
|
||||
|
||||
def test_config_reports_names_and_never_values(self):
|
||||
with patch.dict(os.environ, {}, clear=True), self.assertRaisesRegex(RuntimeError, "MACOS_CERTIFICATE_P12_BASE64"):
|
||||
release.Credentials.from_environment()
|
||||
|
||||
def test_config_accepts_multiline_certificate_base64(self):
|
||||
env = ENVIRONMENT.copy()
|
||||
text = env["MACOS_CERTIFICATE_P12_BASE64"]
|
||||
env["MACOS_CERTIFICATE_P12_BASE64"] = text[:10] + "\n" + text[10:]
|
||||
with patch.dict(os.environ, env, clear=True):
|
||||
self.assertEqual(release.Credentials.from_environment().certificate, b"not-a-real-certificate")
|
||||
|
||||
def test_config_rejects_development_certificate(self):
|
||||
env = {**ENVIRONMENT, "MACOS_SIGNING_IDENTITY": "Apple Development: Test"}
|
||||
with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "Developer ID Application"):
|
||||
release.Credentials.from_environment()
|
||||
|
||||
def test_config_rejects_base64_instead_of_plain_p8(self):
|
||||
env = {**ENVIRONMENT, "APPLE_API_KEY_P8": "not-the-pem-contents"}
|
||||
with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "complete, plain-text"):
|
||||
release.Credentials.from_environment()
|
||||
|
||||
def test_execute_does_not_expose_secret_argv_or_stderr(self):
|
||||
result = subprocess.CompletedProcess([], 1, stdout="", stderr="secret-password")
|
||||
with patch.object(release.subprocess, "run", return_value=result):
|
||||
with self.assertRaises(RuntimeError) as error:
|
||||
release.execute(["security", "import", "-P", "secret-password"], "Import certificate")
|
||||
self.assertNotIn("secret-password", str(error.exception))
|
||||
|
||||
def test_matching_identity_requires_developer_id_and_private_key(self):
|
||||
output = f' 1) {FINGERPRINT} "{IDENTITY}"\n'
|
||||
self.assertEqual(release.resolve_identity(output, IDENTITY), FINGERPRINT)
|
||||
with self.assertRaisesRegex(RuntimeError, "no valid Developer ID"):
|
||||
release.resolve_identity("0 valid identities found", IDENTITY)
|
||||
|
||||
def test_private_files_have_restricted_permissions(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
path = Path(directory) / "private.p8"
|
||||
release.write_private(path, b"test-only")
|
||||
self.assertEqual(path.stat().st_mode & 0o777, 0o600)
|
||||
|
||||
def test_keychain_and_private_files_are_cleaned_up_after_signing_failure(self):
|
||||
calls = []
|
||||
def fake_execute(args, operation, **kwargs):
|
||||
calls.append([str(value) for value in args])
|
||||
output = ''
|
||||
if args[:3] == ["security", "list-keychains", "-d"] and len(args) == 4:
|
||||
output = '"/tmp/original.keychain-db"\n'
|
||||
if args[:2] == ["security", "create-keychain"]:
|
||||
Path(args[-1]).touch()
|
||||
if args[:2] == ["security", "find-identity"]:
|
||||
output = f' 1) {FINGERPRINT} "{IDENTITY}"\n'
|
||||
return subprocess.CompletedProcess(args, 0, output, "")
|
||||
temporary_path = None
|
||||
with patch.object(release, "execute", side_effect=fake_execute), patch.object(release.urllib.request, "urlopen", side_effect=lambda *args, **kwargs: io.BytesIO(b"public-test-ca")):
|
||||
with self.assertRaisesRegex(RuntimeError, "test signing failed"):
|
||||
with release.signing_keychain(self.credentials()) as (keychain, api_key, identity):
|
||||
temporary_path = keychain.parent
|
||||
self.assertEqual(identity, FINGERPRINT)
|
||||
self.assertTrue(api_key.is_file())
|
||||
raise RuntimeError("test signing failed")
|
||||
self.assertFalse(temporary_path.exists())
|
||||
self.assertIn(["security", "list-keychains", "-d", "user", "-s", "/tmp/original.keychain-db"], calls)
|
||||
self.assertTrue(any(call[:2] == ["security", "delete-keychain"] for call in calls))
|
||||
|
||||
def run_notary(self, status, returncode=0):
|
||||
calls = []
|
||||
temporary = tempfile.TemporaryDirectory()
|
||||
self.addCleanup(temporary.cleanup)
|
||||
directory = Path(temporary.name)
|
||||
app = directory / "ZoiteChat.app"
|
||||
app.mkdir()
|
||||
output = directory / "release.zip"
|
||||
diagnostics = directory / "diagnostics"
|
||||
def fake_execute(args, operation, **kwargs):
|
||||
calls.append([str(value) for value in args])
|
||||
text = ""
|
||||
code = 0
|
||||
if args[:3] == ["xcrun", "notarytool", "submit"]:
|
||||
text = json.dumps({"id": SUBMISSION})
|
||||
elif args[:3] == ["xcrun", "notarytool", "wait"]:
|
||||
text = json.dumps({"id": SUBMISSION, "status": status})
|
||||
code = returncode
|
||||
elif args[:3] == ["xcrun", "notarytool", "log"]:
|
||||
Path(args[-1]).write_text('{"issues": []}')
|
||||
elif args[0] == "ditto":
|
||||
Path(args[-1]).write_bytes(b"test-zip")
|
||||
return subprocess.CompletedProcess(args, code, text, "")
|
||||
with patch.object(release, "execute", side_effect=fake_execute), redirect_stdout(io.StringIO()):
|
||||
if status == "Accepted" and not returncode:
|
||||
release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
|
||||
else:
|
||||
with self.assertRaisesRegex(RuntimeError, "not accepted"):
|
||||
release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
|
||||
return calls, output, diagnostics
|
||||
|
||||
def test_accepted_notarization_staples_and_checks_before_final_zip(self):
|
||||
calls, output, diagnostics = self.run_notary("Accepted")
|
||||
self.assertTrue(output.is_file())
|
||||
staple = next(i for i, call in enumerate(calls) if call[:3] == ["xcrun", "stapler", "staple"])
|
||||
assess = next(i for i, call in enumerate(calls) if call[0] == "spctl")
|
||||
final_zip = max(i for i, call in enumerate(calls) if call[0] == "ditto")
|
||||
self.assertLess(staple, assess)
|
||||
self.assertLess(assess, final_zip)
|
||||
self.assertEqual(json.loads((diagnostics / "status.json").read_text())["status"], "Accepted")
|
||||
|
||||
def test_rejected_notarization_never_staples_or_publishes(self):
|
||||
calls, output, diagnostics = self.run_notary("Invalid")
|
||||
self.assertFalse(output.exists())
|
||||
self.assertTrue((diagnostics / "notary-log.json").is_file())
|
||||
self.assertFalse(any(call[:2] == ["xcrun", "stapler"] for call in calls))
|
||||
|
||||
def test_timeout_retains_submission_id_and_never_publishes(self):
|
||||
calls, output, diagnostics = self.run_notary("In Progress", 1)
|
||||
self.assertFalse(output.exists())
|
||||
self.assertEqual(json.loads((diagnostics / "submission.json").read_text())["id"], SUBMISSION)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -0,0 +1,127 @@
|
||||
/* Relocate resources before GTK, Fontconfig, GIO or OpenSSL initialize.
|
||||
* GPL-2.0-or-later; see COPYING. */
|
||||
#include "config.h"
|
||||
#include "macos.h"
|
||||
#include <gio/gio.h>
|
||||
#include <mach-o/dyld.h>
|
||||
#include <stdint.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
static char *locale_dir;
|
||||
|
||||
static void
|
||||
set_path (const char *variable, const char *base, const char *relative)
|
||||
{
|
||||
char *path = g_build_filename (base, relative, NULL);
|
||||
g_setenv (variable, path, TRUE);
|
||||
g_free (path);
|
||||
}
|
||||
|
||||
static void
|
||||
relocate_cache (const char *resources, const char *name, const char *variable)
|
||||
{
|
||||
char *input = g_build_filename (resources, name, NULL);
|
||||
char *contents = NULL;
|
||||
GError *error = NULL;
|
||||
|
||||
if (g_file_get_contents (input, &contents, NULL, &error))
|
||||
{
|
||||
/* GTK cache files require absolute module paths. Write only data to
|
||||
* the user cache, never into the signed/read-only application bundle. */
|
||||
char **parts = g_strsplit (contents, "@ZOITECHAT_RESOURCES@", -1);
|
||||
char *escaped = g_strescape (resources, NULL);
|
||||
char *relocated = g_strjoinv (escaped, parts);
|
||||
g_free (escaped);
|
||||
char *digest = g_compute_checksum_for_string (G_CHECKSUM_SHA256, relocated, -1);
|
||||
char *directory = g_build_filename (g_get_user_cache_dir (), "zoitechat", "modules", digest, NULL);
|
||||
char *output = g_build_filename (directory, name, NULL);
|
||||
if (g_mkdir_with_parents (directory, 0700) == 0 &&
|
||||
g_file_set_contents (output, relocated, -1, &error))
|
||||
g_setenv (variable, output, TRUE);
|
||||
else
|
||||
g_warning ("Cannot relocate %s: %s", name, error ? error->message : "cannot create cache directory");
|
||||
g_free (output);
|
||||
g_free (directory);
|
||||
g_free (digest);
|
||||
g_free (relocated);
|
||||
g_strfreev (parts);
|
||||
}
|
||||
else
|
||||
g_warning ("Cannot read %s: %s", input, error->message);
|
||||
g_clear_error (&error);
|
||||
g_free (contents);
|
||||
g_free (input);
|
||||
}
|
||||
|
||||
void
|
||||
zoitechat_macos_init (void)
|
||||
{
|
||||
uint32_t size = 0;
|
||||
char *raw, *executable, *macos, *contents, *resources, *marker;
|
||||
char *ca;
|
||||
GTlsDatabase *database;
|
||||
GError *error = NULL;
|
||||
|
||||
_NSGetExecutablePath (NULL, &size);
|
||||
raw = g_malloc (size);
|
||||
if (_NSGetExecutablePath (raw, &size) != 0)
|
||||
{
|
||||
g_free (raw);
|
||||
return;
|
||||
}
|
||||
executable = realpath (raw, NULL);
|
||||
g_free (raw);
|
||||
if (!executable)
|
||||
return;
|
||||
macos = g_path_get_dirname (executable);
|
||||
free (executable);
|
||||
contents = g_path_get_dirname (macos);
|
||||
resources = g_build_filename (contents, "Resources", NULL);
|
||||
marker = g_build_filename (resources, "zoitechat-bundle", NULL);
|
||||
g_free (macos);
|
||||
g_free (contents);
|
||||
if (!g_file_test (marker, G_FILE_TEST_IS_REGULAR))
|
||||
{
|
||||
g_free (marker);
|
||||
g_free (resources);
|
||||
return; /* Ordinary Meson installs and build-tree runs retain their paths. */
|
||||
}
|
||||
g_free (marker);
|
||||
g_setenv ("GDK_BACKEND", "quartz", TRUE);
|
||||
set_path ("ZOITECHAT_MACOS_SHARE", resources, "share");
|
||||
set_path ("XDG_DATA_DIRS", resources, "share");
|
||||
set_path ("GSETTINGS_SCHEMA_DIR", resources, "share/glib-2.0/schemas");
|
||||
set_path ("FONTCONFIG_FILE", resources, "fonts.conf");
|
||||
set_path ("GIO_EXTRA_MODULES", resources, "lib/gio/modules");
|
||||
set_path ("GIO_MODULE_DIR", resources, "lib/gio/modules");
|
||||
set_path ("ZOITECHAT_LIBDIR", resources, "lib/zoitechat/plugins");
|
||||
set_path ("ZOITECHAT_EMOJI_FONT", resources, "share/fonts/zoitechat/NotoColorEmoji.ttf");
|
||||
set_path ("ZOITECHAT_ENCHANT_LIBRARY", resources, "lib/libenchant-2.dylib");
|
||||
g_setenv ("ZOITECHAT_ENCHANT_PREFIX", resources, TRUE);
|
||||
set_path ("SSL_CERT_FILE", resources, "certs/ca-bundle.crt");
|
||||
set_path ("OPENSSL_MODULES", resources, "lib/ossl-modules");
|
||||
locale_dir = g_build_filename (resources, "share/locale", NULL);
|
||||
relocate_cache (resources, "pixbuf-loaders.cache", "GDK_PIXBUF_MODULE_FILE");
|
||||
relocate_cache (resources, "gtk-immodules.cache", "GTK_IM_MODULE_FILE");
|
||||
|
||||
/* HTTPS previews use GIO; IRC uses OpenSSL. Give both the same CA set. */
|
||||
ca = g_build_filename (resources, "certs/ca-bundle.crt", NULL);
|
||||
database = g_tls_file_database_new (ca, &error);
|
||||
if (database)
|
||||
{
|
||||
g_tls_backend_set_default_database (g_tls_backend_get_default (), database);
|
||||
g_object_unref (database);
|
||||
}
|
||||
else
|
||||
g_warning ("Cannot load bundled HTTPS trust database: %s", error->message);
|
||||
g_clear_error (&error);
|
||||
g_free (ca);
|
||||
g_free (resources);
|
||||
}
|
||||
|
||||
const char *
|
||||
zoitechat_macos_locale_dir (void)
|
||||
{
|
||||
return locale_dir ? locale_dir : LOCALEDIR;
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
/* macOS bundle runtime; GPL-2.0-or-later, see COPYING. */
|
||||
#ifndef ZOITECHAT_MACOS_H
|
||||
#define ZOITECHAT_MACOS_H
|
||||
void zoitechat_macos_init (void);
|
||||
const char *zoitechat_macos_locale_dir (void);
|
||||
#endif
|
||||
+13
-2
@@ -29,6 +29,10 @@ common_sources = [
|
||||
'util.c'
|
||||
]
|
||||
|
||||
if host_machine.system() == 'darwin'
|
||||
common_sources += 'macos.c'
|
||||
endif
|
||||
|
||||
secretstore_sources = files('secretstore.c')
|
||||
|
||||
common_sysinfo_deps = []
|
||||
@@ -155,12 +159,19 @@ zoitechat_common = static_library('zoitechatcommon',
|
||||
pic: true
|
||||
)
|
||||
|
||||
# zoitechat.h exposes OpenSSL types whenever TLS is enabled. Propagate its
|
||||
# header requirements even to standalone consumers that do not call OpenSSL.
|
||||
zoitechat_common_header_deps = [libgio_dep]
|
||||
if libssl_dep.found()
|
||||
zoitechat_common_header_deps += libssl_dep.partial_dependency(compile_args: true, includes: true)
|
||||
endif
|
||||
|
||||
zoitechat_common_dep = declare_dependency(
|
||||
sources: [textevents, public_suffix_data] + marshal,
|
||||
link_with: zoitechat_common,
|
||||
include_directories: common_includes,
|
||||
compile_args: common_cflags,
|
||||
dependencies: libgio_dep,
|
||||
dependencies: zoitechat_common_header_deps,
|
||||
)
|
||||
|
||||
zoitechat_plugin_dep = declare_dependency(
|
||||
@@ -176,7 +187,7 @@ gtk3_theme_service_tests = executable('gtk3_theme_service_tests',
|
||||
'gtk3-theme-service.c',
|
||||
],
|
||||
include_directories: [config_h_include, include_directories('.')],
|
||||
dependencies: [libgio_dep] + (libarchive_dep.found() ? [libarchive_dep] : []),
|
||||
dependencies: zoitechat_common_header_deps + (libarchive_dep.found() ? [libarchive_dep] : []),
|
||||
)
|
||||
|
||||
test('GTK3 Theme Service Tests', gtk3_theme_service_tests,
|
||||
|
||||
@@ -54,6 +54,9 @@
|
||||
#include "text.h"
|
||||
#include "url.h"
|
||||
#include "zoitechatc.h"
|
||||
#ifdef __APPLE__
|
||||
#include "macos.h"
|
||||
#endif
|
||||
|
||||
#if ! GLIB_CHECK_VERSION (2, 36, 0)
|
||||
#include <glib-object.h> /* for g_type_init() */
|
||||
@@ -1172,6 +1175,10 @@ main (int argc, char *argv[])
|
||||
int i;
|
||||
int ret;
|
||||
|
||||
#ifdef __APPLE__
|
||||
zoitechat_macos_init ();
|
||||
#endif
|
||||
|
||||
#ifdef WIN32
|
||||
HRESULT coinit_result;
|
||||
#endif
|
||||
|
||||
+19
-1
@@ -21,6 +21,9 @@
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "fe-gtk.h"
|
||||
#ifdef __APPLE__
|
||||
#include "../common/macos.h"
|
||||
#endif
|
||||
|
||||
#ifdef GDK_WINDOWING_WIN32
|
||||
#include <gdk/gdkwin32.h>
|
||||
@@ -372,7 +375,13 @@ fe_args (int argc, char *argv[])
|
||||
g_free (locale_path);
|
||||
g_free (base_path);
|
||||
#else
|
||||
bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
|
||||
bindtextdomain (GETTEXT_PACKAGE,
|
||||
#ifdef __APPLE__
|
||||
zoitechat_macos_locale_dir ()
|
||||
#else
|
||||
LOCALEDIR
|
||||
#endif
|
||||
);
|
||||
#endif
|
||||
bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
|
||||
textdomain (GETTEXT_PACKAGE);
|
||||
@@ -493,6 +502,15 @@ fe_args (int argc, char *argv[])
|
||||
#endif
|
||||
gtk_init (&argc, &argv);
|
||||
|
||||
#ifdef __APPLE__
|
||||
if (g_getenv ("ZOITECHAT_MACOS_SHARE"))
|
||||
{
|
||||
char *icons = g_build_filename (g_getenv ("ZOITECHAT_MACOS_SHARE"), "icons", NULL);
|
||||
gtk_icon_theme_prepend_search_path (gtk_icon_theme_get_default (), icons);
|
||||
g_free (icons);
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef WIN32
|
||||
win32_configure_icon_theme ();
|
||||
#endif
|
||||
|
||||
@@ -53,6 +53,15 @@ zoitechat_gtk_deps = [
|
||||
|
||||
gtk_dep = dependency('gtk+-3.0', version: '>= 3.22')
|
||||
|
||||
# Standalone GTK tests also include the common application's headers.
|
||||
gtk_dep = declare_dependency(dependencies: [gtk_dep] + zoitechat_common_header_deps)
|
||||
|
||||
# fe-gtk.h exposes GtkosxApplication to every GTK consumer when enabled.
|
||||
# Theme libraries and standalone UI tests need the same headers as the app.
|
||||
if host_machine.system() == 'darwin' and gtk_mac_dep.found()
|
||||
gtk_dep = declare_dependency(dependencies: [gtk_dep, gtk_mac_dep])
|
||||
endif
|
||||
|
||||
zoitechat_theme_deps = [gtk_dep, zoitechat_common_dep]
|
||||
|
||||
if host_machine.system() != 'windows'
|
||||
@@ -91,12 +100,18 @@ if host_machine.system() != 'windows'
|
||||
endif
|
||||
|
||||
zoitechat_gtk_ldflags = []
|
||||
zoitechat_gtk_objcflags = []
|
||||
|
||||
if host_machine.system() == 'windows'
|
||||
zoitechat_gtk_sources += 'notifications/notification-windows.c'
|
||||
zoitechat_gtk_deps += cc.find_library('dwmapi', required: true)
|
||||
zoitechat_theme_deps += cc.find_library('dwmapi', required: true)
|
||||
|
||||
elif host_machine.system() == 'darwin'
|
||||
add_languages('objc', required: true)
|
||||
zoitechat_gtk_sources += 'notifications/notification-osx.m'
|
||||
zoitechat_gtk_deps += dependency('appleframeworks', modules: ['Cocoa', 'UserNotifications'])
|
||||
zoitechat_gtk_objcflags += '-fobjc-arc'
|
||||
else
|
||||
zoitechat_gtk_sources += 'notifications/notification-freedesktop.c'
|
||||
endif
|
||||
@@ -137,6 +152,7 @@ executable('zoitechat',
|
||||
dependencies: zoitechat_gtk_deps,
|
||||
link_with: zoitechat_theme_lib,
|
||||
c_args: zoitechat_gtk_cflags,
|
||||
objc_args: zoitechat_gtk_objcflags,
|
||||
link_args: zoitechat_gtk_ldflags,
|
||||
pie: true,
|
||||
install: true,
|
||||
|
||||
@@ -1,54 +1,67 @@
|
||||
/* ZoiteChat
|
||||
* Copyright (C) 2015 Patrick Griffis.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
*/
|
||||
|
||||
/* Native macOS notifications; GPL-2.0-or-later, see COPYING. */
|
||||
#import <Cocoa/Cocoa.h>
|
||||
#include <gtkosxapplication.h>
|
||||
#import <UserNotifications/UserNotifications.h>
|
||||
|
||||
void
|
||||
notification_backend_show (const char *title, const char *text)
|
||||
@interface ZoiteChatNotificationDelegate : NSObject <UNUserNotificationCenterDelegate>
|
||||
@end
|
||||
@implementation ZoiteChatNotificationDelegate
|
||||
- (void)userNotificationCenter:(UNUserNotificationCenter *)center
|
||||
willPresentNotification:(UNNotification *)notification
|
||||
withCompletionHandler:(void (^)(UNNotificationPresentationOptions))completionHandler
|
||||
{
|
||||
NSString *str_title = [[NSString alloc] initWithUTF8String:title];
|
||||
NSString *str_text = [[NSString alloc] initWithUTF8String:text];
|
||||
completionHandler(UNNotificationPresentationOptionBanner | UNNotificationPresentationOptionSound);
|
||||
}
|
||||
@end
|
||||
|
||||
NSUserNotification *userNotification = [NSUserNotification new];
|
||||
userNotification.title = str_title;
|
||||
userNotification.informativeText = str_text;
|
||||
static ZoiteChatNotificationDelegate *notification_delegate;
|
||||
|
||||
NSUserNotificationCenter *center = [NSUserNotificationCenter defaultUserNotificationCenter];
|
||||
[center scheduleNotification:userNotification];
|
||||
|
||||
[str_title release];
|
||||
[str_text release];
|
||||
int
|
||||
notification_backend_supported (void)
|
||||
{
|
||||
return [[NSBundle mainBundle] bundleIdentifier] != nil;
|
||||
}
|
||||
|
||||
int
|
||||
notification_backend_init (const char **error)
|
||||
{
|
||||
return 1;
|
||||
if (!notification_backend_supported ())
|
||||
{
|
||||
*error = "macOS notifications require an application bundle";
|
||||
return 0;
|
||||
}
|
||||
notification_delegate = [ZoiteChatNotificationDelegate new];
|
||||
[UNUserNotificationCenter currentNotificationCenter].delegate = notification_delegate;
|
||||
return 1;
|
||||
}
|
||||
|
||||
void
|
||||
notification_backend_show (const char *title, const char *text)
|
||||
{
|
||||
UNMutableNotificationContent *content = [UNMutableNotificationContent new];
|
||||
content.title = [NSString stringWithUTF8String:title] ?: @"ZoiteChat";
|
||||
content.body = [NSString stringWithUTF8String:text] ?: @"";
|
||||
UNUserNotificationCenter *center = [UNUserNotificationCenter currentNotificationCenter];
|
||||
/* Ask only when the user first needs a notification, without blocking GTK. */
|
||||
[center requestAuthorizationWithOptions:UNAuthorizationOptionAlert | UNAuthorizationOptionSound
|
||||
completionHandler:^(BOOL granted, NSError *error) {
|
||||
if (granted)
|
||||
{
|
||||
UNNotificationRequest *request = [UNNotificationRequest
|
||||
requestWithIdentifier:[[NSUUID UUID] UUIDString] content:content trigger:nil];
|
||||
[center addNotificationRequest:request withCompletionHandler:^(NSError *deliveryError) {
|
||||
if (deliveryError)
|
||||
NSLog(@"ZoiteChat notification failed: %@", deliveryError);
|
||||
}];
|
||||
}
|
||||
else if (error)
|
||||
NSLog(@"ZoiteChat notification authorization failed: %@", error);
|
||||
}];
|
||||
}
|
||||
|
||||
void
|
||||
notification_backend_deinit (void)
|
||||
{
|
||||
}
|
||||
|
||||
int
|
||||
notification_backend_supported (void)
|
||||
{
|
||||
return gtkosx_application_get_bundle_id () != NULL;
|
||||
if (notification_delegate)
|
||||
[UNUserNotificationCenter currentNotificationCenter].delegate = nil;
|
||||
notification_delegate = nil;
|
||||
}
|
||||
|
||||
@@ -215,7 +215,22 @@ initialize_enchant (void)
|
||||
#endif
|
||||
};
|
||||
|
||||
for (i = 0; i < G_N_ELEMENTS(libnames); ++i)
|
||||
#ifdef __APPLE__
|
||||
const char *bundled_enchant = g_getenv ("ZOITECHAT_ENCHANT_LIBRARY");
|
||||
if (bundled_enchant && *bundled_enchant)
|
||||
{
|
||||
enchant = g_module_open (bundled_enchant, 0);
|
||||
if (enchant)
|
||||
{
|
||||
void (*set_prefix) (const char *) = NULL;
|
||||
const char *prefix = g_getenv ("ZOITECHAT_ENCHANT_PREFIX");
|
||||
if (prefix && g_module_symbol (enchant, "enchant_set_prefix_dir", (gpointer *) &set_prefix))
|
||||
set_prefix (prefix);
|
||||
have_enchant = TRUE;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
for (i = 0; !have_enchant && i < G_N_ELEMENTS(libnames); ++i)
|
||||
{
|
||||
enchant = g_module_open(libnames[i], 0);
|
||||
if (enchant)
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
#include "../../fe-gtk.h"
|
||||
|
||||
#include "../theme-application.h"
|
||||
#include "../theme-css.h"
|
||||
#include "../theme-policy.h"
|
||||
#include "../../maingui.h"
|
||||
#include "../../../common/zoitechat.h"
|
||||
@@ -45,6 +46,13 @@ fe_message (char *msg, int flags)
|
||||
message_calls++;
|
||||
}
|
||||
|
||||
/* This test isolates input styling from the application's toplevel CSS. */
|
||||
char *
|
||||
theme_css_build_toplevel_classes (void)
|
||||
{
|
||||
return g_strdup ("");
|
||||
}
|
||||
|
||||
void
|
||||
theme_css_reload_input_style (gboolean enabled, const PangoFontDescription *font_desc)
|
||||
{
|
||||
|
||||
+10
-1
@@ -43,6 +43,9 @@
|
||||
#include "../common/util.h"
|
||||
#include "../common/fe.h"
|
||||
#include "fe-text.h"
|
||||
#ifdef __APPLE__
|
||||
#include "../common/macos.h"
|
||||
#endif
|
||||
|
||||
|
||||
static int done = FALSE;
|
||||
@@ -513,7 +516,13 @@ fe_args (int argc, char *argv[])
|
||||
g_free (locale_path);
|
||||
g_free (base_path);
|
||||
#else
|
||||
bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
|
||||
bindtextdomain (GETTEXT_PACKAGE,
|
||||
#ifdef __APPLE__
|
||||
zoitechat_macos_locale_dir ()
|
||||
#else
|
||||
LOCALEDIR
|
||||
#endif
|
||||
);
|
||||
#endif
|
||||
bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
|
||||
textdomain (GETTEXT_PACKAGE);
|
||||
|
||||
Reference in New Issue
Block a user