rebuild macos build

Fix clang -Wstrict-prototypes warnings

.github/workflows/macos-build.yml

@@ -0,0 +1,154 @@
+name: macOS build
+
+on:
+  workflow_dispatch:
+    inputs:
+      sign_and_notarize:
+        description: 'Sign with Developer ID and notarize using release credentials'
+        type: boolean
+        default: false
+  push:
+    branches: [master]
+    tags: ['v*']
+    paths:
+      - 'src/**'
+      - 'plugins/**'
+      - 'data/**'
+      - 'tools/**'
+      - 'po/**'
+      - 'meson*'
+      - 'VERSION'
+      - 'packaging/macos/**'
+      - '.github/workflows/macos-build.yml'
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'plugins/**'
+      - 'data/**'
+      - 'tools/**'
+      - 'po/**'
+      - 'meson*'
+      - 'VERSION'
+      - 'packaging/macos/**'
+      - '.github/workflows/macos-build.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' && !inputs.sign_and_notarize)
+    name: Native ${{ matrix.arch }} bundle
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    env:
+      HOMEBREW_NO_AUTO_UPDATE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Install native dependencies
+        run: brew bundle --file packaging/macos/Brewfile
+      - name: Test packaging logic
+        run: python3 -m unittest discover -s packaging/macos/tests -v
+      - name: Build and test application
+        run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
+      - name: Verify relocated startup
+        run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
+      - name: Create artifact preserving the application signature
+        run: ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-${{ matrix.arch }}.zip
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}
+          path: dist/ZoiteChat-${{ matrix.arch }}.zip
+          if-no-files-found: error
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-logs
+          path: build-macos/meson-logs/
+          if-no-files-found: ignore
+
+  release:
+    name: Signed and notarized ${{ matrix.arch }} release
+    if: >-
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
+      (github.event_name == 'workflow_dispatch' && inputs.sign_and_notarize && github.ref == 'refs/heads/master')
+    environment: macos-release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    env:
+      HOMEBREW_NO_AUTO_UPDATE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Validate release settings before building
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: python3 packaging/macos/release.py --check-config
+      - name: Install native dependencies
+        run: brew bundle --file packaging/macos/Brewfile
+      - name: Test packaging and release logic
+        run: python3 -m unittest discover -s packaging/macos/tests -v
+      - name: Build and test application
+        run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
+      - name: Verify relocated startup
+        run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
+      - name: Sign, notarize, staple and verify release
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: >-
+          python3 packaging/macos/release.py
+          --app dist/ZoiteChat.app
+          --output dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
+          --diagnostics dist/notarization
+          --notary-timeout 60m
+      - name: Upload signed and notarized application
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-signed-notarized
+          path: dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
+          if-no-files-found: error
+      - name: Upload notarization diagnostics
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-notarization-log
+          path: dist/notarization/*.json
+          if-no-files-found: ignore
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-release-build-logs
+          path: build-macos/meson-logs/
+          if-no-files-found: ignore

.gitignore

@@ -27,3 +27,9 @@ osx/.ZoiteChat.app
 *.dmg
 *.VC.db
 *.VC.opendb
+
+# Native macOS packaging output
+/build-macos*/
+/dist/
+/packaging/macos/__pycache__/
+/packaging/macos/tests/__pycache__/

docs/README.md

@@ -33,10 +33,53 @@ Example:
         that is not visually indented
 ```
 
-## Read the Docs theme skin
+## HTML theme
 
-The HTML output keeps the existing `basicstrap` Sphinx theme, then applies the
+The `zoitechat` theme inherits Sphinx's built-in `basic` theme. It uses the
-ZoiteChat main-site skin from `_static/css/zoitechat-docs.css`.
+same compact layout, blue navigation, and system fonts as zoitechat.org.
+Appearance starts in System mode on each page. Light and Dark are available
+for the current page; no cookies or browser storage are used.
 
-Brand navigation links are set in `conf.py` through `html_context`, and the
+The theme's templates are in `_theme/zoitechat/`. Its readable CSS and
-header logo uses `_static/zoitechat-logo.svg`.
+JavaScript are in `_static/css/zoitechat-docs.css` and
+`_static/js/zoitechat-docs.js`. No minification, JavaScript package manager,
+external fonts, or CDN assets are required.
+
+Navigation URLs, including `zoite_atlas_url`, are configured through
+`html_context` in `conf.py`. The logo
+is `_static/zoitechat-logo.svg`. Standard Sphinx search, indexes, source
+links, anchors, translations, and previous/next links remain available.
+The HTML output also works as locally installed documentation; project-site
+links only access the network when clicked.
+
+Build from the repository root:
+
+```sh
+sphinx-build -b html docs docs/_build/html
+```
+
+Use a clean output directory when switching themes, so stale Basicstrap
+assets from an earlier build are not included in a package.
+
+## Debian packaging
+
+The active theme does not use the bundled Basicstrap, Bootstrap, jQuery,
+jQuery Cookie, Font Awesome, or icon fonts. Its font stack includes DejaVu
+Sans and DejaVu Sans Mono; no font files are bundled by the theme.
+
+Packagers may exclude `docs/_theme/basicstrap/` from the source package.
+The default theme continues to build without that directory. No pre-minified
+third-party assets need to be added or rebuilt for this theme.
+
+Build with the distribution's `python3-sphinx`. After installing the HTML
+into the package staging directory, use `dh_sphinxdoc` (or `dh --with
+sphinxdoc`) to replace Sphinx's standard JavaScript files with system
+symlinks. Include `${sphinxdoc:Depends}` in the package dependencies and
+`${sphinxdoc:Built-Using}` where required for generated assets. The custom
+`zoitechat-docs.js` remains a small, readable project source file.
+
+A built-in theme is still selectable with `-D html_theme=classic` if a
+packager needs a different layout. The old RST content has existing build
+diagnostics; changing the theme does not suppress or alter them.
+
+Shared website chrome is in `_static/css/zoitechat-site.css`, copied from the main site. Keep that readable stylesheet in sync when changing the shared header, navigation, typography, or colours.

docs/_static/css/zoitechat-site.css

@@ -0,0 +1,526 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/* Shared chrome copied from ZoiteChat/site assets/css/site.css (1df996a). */
+:root {
+    color-scheme: light;
+    --bg: #fff;
+    --surface: #fff;
+    --chrome: #f1f2f3;
+    --chrome2: #e3e5e7;
+    --text: #25282c;
+    --muted: #58616b;
+    --line: #bdc3c9;
+    --soft-line: #dce0e4;
+    --blue: #215a9e;
+    --link: #174f92;
+    --selection: #e6effa;
+    --success: #236741;
+    --code: #f2f4f6;
+    --shadow: none;
+    --mono: Consolas,"Liberation Mono",monospace;
+}
+
+html[data-theme=dark] {
+    color-scheme: dark;
+    --bg: #111416;
+    --surface: #191c1f;
+    --chrome: #25292d;
+    --chrome2: #30353a;
+    --text: #eef0f2;
+    --muted: #b2bbc4;
+    --line: #50575e;
+    --soft-line: #353c43;
+    --blue: #2865a8;
+    --link: #8dc0ff;
+    --selection: #233951;
+    --success: #92d5ab;
+    --code: #111518;
+    --shadow: none;
+}
+
+* {
+    box-sizing: border-box;
+}
+
+body {
+    margin: 0;
+    background: var(--bg);
+    color: var(--text);
+    font: 15px/1.6 system-ui,-apple-system,"Segoe UI",sans-serif;
+}
+
+a {
+    color: var(--link);
+    text-underline-offset: 3px;
+}
+
+a:hover {
+    text-decoration: underline;
+}
+
+button, input, select {
+    font: inherit;
+}
+
+button, summary {
+    cursor: pointer;
+}
+
+img {
+    display: block;
+    max-width: 100%;
+    height: auto;
+}
+
+button, a, input, select, summary {
+    touch-action: manipulation;
+}
+
+:focus-visible {
+    outline: 3px solid var(--link);
+    outline-offset: 3px;
+}
+
+[hidden] {
+    display: none!important;
+}
+
+.sr-only {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip-path: inset(50%);
+    white-space: nowrap;
+    border: 0;
+}
+
+.skip-link {
+    position: absolute;
+    left: 12px;
+    top: -100px;
+    z-index: 10;
+    padding: 10px;
+    background: var(--surface);
+}
+
+.skip-link:focus {
+    top: 12px;
+}
+
+.topbar {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 20px;
+    padding: 0 0 16px;
+    background: var(--surface);
+    border-bottom: 1px solid var(--line);
+    border: 0;
+}
+
+.brand {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    color: var(--text);
+    text-decoration: none;
+}
+
+.brand img {
+    width: 38px;
+    height: 42px;
+}
+
+.brand strong {
+    font-size: 28px;
+    letter-spacing: -.8px;
+    font-weight: 650;
+}
+
+.brand small {
+    display: block;
+    font-size: 12px;
+    color: var(--muted);
+    line-height: 1.2;
+}
+
+.appearance {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    font-size: 11px;
+    color: var(--muted);
+}
+
+select {
+    border: 1px solid var(--line);
+    border-radius: 3px;
+    padding: 5px 8px;
+    background: var(--surface);
+    color: var(--text);
+}
+
+.navigation {
+    display: flex;
+    align-items: center;
+    justify-content: flex-start;
+    gap: 12px;
+    background: var(--chrome);
+    border-bottom: 1px solid var(--line);
+    padding: 0;
+    border: 1px solid var(--line);
+    border-radius: 0;
+}
+
+.nav-links {
+    display: flex;
+    align-items: stretch;
+    flex-wrap: wrap;
+    gap: 0;
+}
+
+.nav-links>a, .nav-menu summary {
+    display: flex;
+    align-items: center;
+    min-height: 36px;
+    padding: 6px 15px;
+    color: var(--text);
+    font-size: 13px;
+    text-decoration: none;
+    border-bottom: 0;
+}
+
+.nav-links>a[aria-current=page] {
+    color: #fff;
+    border-bottom-color: var(--blue);
+    font-weight: 500;
+    background: var(--blue);
+}
+
+.nav-links>a:hover, .nav-menu summary:hover {
+    background: var(--selection);
+}
+
+.nav-menu {
+    position: relative;
+}
+
+.nav-menu summary {
+    list-style: none;
+}
+
+.nav-menu summary::after {
+    content: "⌄";
+    margin-left: 9px;
+}
+
+.nav-menu summary::-webkit-details-marker {
+    display: none;
+}
+
+.nav-menu-panel {
+    position: absolute;
+    right: 0;
+    top: 100%;
+    z-index: 5;
+    min-width: 280px;
+    background: var(--surface);
+    border: 1px solid var(--line);
+    box-shadow: var(--shadow);
+    padding: 5px;
+}
+
+.nav-menu-panel a {
+    display: block;
+    padding: 10px 12px;
+    text-decoration: none;
+}
+
+.nav-menu-panel a:hover {
+    background: var(--selection);
+}
+
+.nav-menu-panel span {
+    display: block;
+    font-size: 12px;
+    color: var(--muted);
+}
+
+.site-main {
+    min-height: 0;
+}
+
+h1, h2, h3, p {
+    margin-top: 0;
+}
+
+h1 {
+    font-size: clamp(30px,3.9vw,46px);
+    line-height: 1.16;
+    letter-spacing: -1.5px;
+    font-weight: 650;
+    margin-bottom: 20px;
+}
+
+h2 {
+    font-size: 20px;
+    line-height: 1.3;
+    letter-spacing: 0;
+    margin-bottom: 12px;
+}
+
+h3 {
+    font-size: 16px;
+    line-height: 1.4;
+}
+
+p {
+    color: var(--text);
+    font-size: 14px;
+    line-height: 1.7;
+    margin-bottom: 15px;
+}
+
+.site-footer {
+    padding: 17px 0;
+    background: var(--surface);
+    border-top: 1px solid var(--line);
+}
+
+.footer-grid {
+    display: flex;
+    align-items: start;
+    justify-content: space-between;
+    gap: 20px;
+}
+
+.footer-copy {
+    font-size: 11px;
+    max-width: 62ch;
+    margin: 0;
+    color: var(--muted);
+}
+
+.footer-links {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 5px 14px;
+    max-width: 400px;
+    font-size: 11px;
+}
+
+@media (max-width:1000px) {
+.navigation {
+        padding: 0 15px;
+    }
+
+.nav-links>a, .nav-menu summary {
+        padding: 8px 10px;
+    }
+}
+
+@media (max-width:650px) {
+.topbar {
+        padding: 13px 16px;
+        gap: 8px;
+    }
+
+.brand strong {
+        font-size: 20px;
+    }
+
+.brand small {
+        font-size: 10px;
+    }
+
+.brand img {
+        width: 28px;
+        height: 31px;
+    }
+
+.appearance {
+        gap: 5px;
+    }
+
+.appearance>span {
+        display: none;
+    }
+
+.appearance select {
+        font-size: 12px;
+        max-width: 98px;
+    }
+
+.navigation {
+        padding: 0 6px;
+    }
+
+.nav-links {
+        gap: 0;
+    }
+
+.nav-links>a, .nav-menu summary {
+        min-height: 44px;
+        padding: 8px;
+        font-size: 12px;
+    }
+
+h1 {
+        font-size: 34px;
+        letter-spacing: -1px;
+    }
+
+.footer-grid {
+        display: grid;
+        gap: 20px;
+    }
+
+.site-footer {
+        padding: 20px 17px;
+    }
+
+.nav-menu-panel {
+        position: fixed;
+        right: 10px;
+        left: 10px;
+        top: auto;
+        min-width: 0;
+    }
+}
+
+@media (prefers-reduced-motion:reduce) {
+* {
+        scroll-behavior: auto!important;
+    }
+}
+
+.appearance select {
+    font-size: 12px;
+    padding: 3px 7px;
+}
+
+.nav-links>a:hover {
+    background: var(--selection);
+    color: var(--link);
+}
+
+h1 {
+    font-size: 28px;
+    font-weight: 600;
+    letter-spacing: -.5px;
+    line-height: 1.3;
+    margin: 0 0 16px;
+    max-width: none;
+}
+
+@media (max-width:1100px) {
+.navigation {
+        padding: 0;
+    }
+}
+
+@media (max-width:800px) {
+.nav-links>a, .nav-menu summary {
+        padding: 6px 10px;
+    }
+}
+
+@media (max-width:600px) {
+.topbar {
+        padding: 0 0 14px;
+    }
+
+.brand strong {
+        font-size: 25px;
+    }
+
+.brand img {
+        width: 32px;
+        height: 36px;
+    }
+
+.nav-links>a, .nav-menu summary {
+        padding: 7px 9px;
+        min-height: 38px;
+        font-size: 12px;
+    }
+
+.footer-grid {
+        display: block;
+    }
+
+.footer-links {
+        margin-top: 10px;
+        max-width: none;
+    }
+
+.site-footer {
+        padding: 14px 0;
+    }
+
+h1 {
+        font-size: 26px;
+    }
+}
+
+@media (prefers-color-scheme: dark) {
+:root:not([data-theme]) {
+        color-scheme: dark;
+        --bg: #111416;
+        --surface: #191c1f;
+        --chrome: #25292d;
+        --chrome2: #30353a;
+        --text: #eef0f2;
+        --muted: #b2bbc4;
+        --line: #50575e;
+        --soft-line: #353c43;
+        --blue: #2865a8;
+        --link: #8dc0ff;
+        --selection: #233951;
+        --success: #92d5ab;
+        --code: #111518;
+        --shadow: none;
+    }
+}
+
+.site-header, .site-main, .site-footer {
+    width: min(1040px, calc(100% - 48px));
+    margin-inline: auto;
+}
+
+.site-header {
+    margin-top: 32px;
+}
+
+.site-main {
+    padding-block: 28px 20px;
+}
+
+.site-header .topbar {
+    padding: 0 0 16px;
+}
+
+.site-header .navigation {
+    padding: 0;
+}
+
+@media (max-width: 600px) {
+.site-header, .site-main, .site-footer {
+        width: calc(100% - 30px);
+    }
+
+.site-header {
+        margin-top: 18px;
+    }
+
+.site-main {
+        padding-top: 23px;
+    }
+}
+
+/* Match the browser's heading defaults used by the main site. */
+h2, h3 { font-weight: bold; }
+h2 { margin-top: .83em; }
+h3 { margin-block: 1em; }

docs/_static/js/zoitechat-docs.js

@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+(() => {
+    'use strict';
+
+    const initialise = () => {
+        const picker = document.getElementById('theme-picker');
+        const preference = window.matchMedia('(prefers-color-scheme: dark)');
+
+        if (picker instanceof HTMLSelectElement) {
+            const applyTheme = () => {
+                const dark = picker.value === 'dark'
+                    || (picker.value === 'system' && preference.matches);
+                document.documentElement.dataset.theme = dark ? 'dark' : 'light';
+                document.querySelectorAll('meta[name="theme-color"]').forEach((meta) => {
+                    meta.setAttribute('content', dark ? '#111416' : '#ffffff');
+                });
+            };
+
+            // Follow the OS on every visit, including browser back/forward navigation.
+            const resetTheme = () => {
+                picker.value = 'system';
+                applyTheme();
+            };
+            picker.addEventListener('change', applyTheme);
+            preference.addEventListener('change', applyTheme);
+            window.addEventListener('pageshow', resetTheme);
+            resetTheme();
+        }
+
+        const navigation = document.getElementById('docs-navigation');
+        const compact = window.matchMedia('(max-width: 760px)');
+        if (navigation instanceof HTMLDetailsElement) {
+            const fitNavigation = () => { navigation.open = !compact.matches; };
+            compact.addEventListener('change', fitNavigation);
+            fitNavigation();
+        }
+    };
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', initialise, { once: true });
+    } else {
+        initialise();
+    }
+})();

docs/_theme/zoitechat/globaltoc.html

@@ -0,0 +1,5 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+<nav class="global-toc" aria-label="{{ _('Documentation contents') }}">
+    <h2>{{ _('Contents') }}</h2>
+    {{ toctree(maxdepth=2, collapse=true, includehidden=true, titles_only=true) }}
+</nav>

docs/_theme/zoitechat/layout.html

@@ -0,0 +1,108 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+{% extends "basic/layout.html" %}
+{% set docs_root = root_doc|default(master_doc) %}
+
+{% block extrahead %}
+    {{ super() }}
+    <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
+    <meta name="theme-color" content="#111416" media="(prefers-color-scheme: dark)">
+{% endblock %}
+
+{% block body_tag %}<body id="top">{% endblock %}
+
+{% block header %}
+    <a class="skip-link" href="#main-content">{{ _('Skip to content') }}</a>
+    <header class="site-header">
+        <div class="topbar">
+            <a class="brand" href="{{ pathto(docs_root)|e }}">
+                <img src="{{ logo_url|default(pathto('_static/zoitechat-logo.svg', 1), true)|e }}" alt="" width="38" height="42">
+                <strong>{{ project|e }}</strong>
+            </a>
+            <label class="appearance" for="theme-picker">
+                <span>{{ _('Appearance') }}</span>
+                <select id="theme-picker" aria-label="{{ _('Documentation appearance') }}">
+                    <option value="system" selected>{{ _('System') }}</option>
+                    <option value="light">{{ _('Light') }}</option>
+                    <option value="dark">{{ _('Dark') }}</option>
+                </select>
+            </label>
+        </div>
+        <div class="navigation">
+            <nav class="nav-links" aria-label="{{ _('Primary') }}">
+                <a href="{{ zoite_site_url|e }}">{{ _('Home') }}</a>
+                <a href="{{ zoite_download_url|e }}">{{ _('Downloads') }}</a>
+                <a href="{{ zoite_addons_url|e }}">{{ _('Addons') }}</a>
+                <a href="{{ zoite_announcements_url|e }}">{{ _('Announcements') }}</a>
+                <a href="{{ pathto(docs_root)|e }}" aria-current="page">{{ _('Documentation') }}</a>
+                <a href="{{ zoite_atlas_url|e }}">{{ _('Atlas') }}</a>
+                <a href="{{ zoite_github_url|e }}" target="_blank" rel="noopener">{{ _('GitHub') }}</a>
+                <details class="nav-menu">
+                    <summary>{{ _('IRC support') }}</summary>
+                    <div class="nav-menu-panel" aria-label="{{ _('IRC support channels') }}">
+                        <a href="{{ zoite_irc_url|e }}" target="_blank" rel="noopener"><strong>{{ _('Zoite IRC') }}</strong><span>{{ _('Official support') }} · #zoitechat</span></a>
+                        <a href="{{ libera_irc_url|e }}" target="_blank" rel="noopener"><strong>{{ _('Libera.Chat') }}</strong><span>{{ _('Secondary support') }} · #zoitechat</span></a>
+                    </div>
+                </details>
+            </nav>
+        </div>
+    </header>
+{% endblock %}
+
+{% block relbar1 %}{% endblock %}
+{% block relbar2 %}{% endblock %}
+
+{% block content %}
+    <div class="docs-layout{% if not render_sidebar %} no-sidebar{% endif %}">
+        {% if render_sidebar %}
+            <aside class="docs-sidebar" aria-label="{{ _('Documentation navigation') }}">
+                <details class="docs-navigation" id="docs-navigation" open>
+                    <summary>{{ _('Documentation') }}</summary>
+                    <div class="sidebar-content">
+                        {% for sidebartemplate in sidebars %}
+                            {% include sidebartemplate %}
+                        {% endfor %}
+                    </div>
+                </details>
+            </aside>
+        {% endif %}
+        <main class="docs-content" id="main-content" tabindex="-1">
+            <div class="docs-location">
+                <nav aria-label="{{ _('Breadcrumbs') }}">
+                    <a href="{{ pathto(docs_root)|e }}">{{ _('Documentation') }}</a>
+                    {% for parent in parents %}
+                        <span aria-hidden="true">/</span> <a href="{{ parent.link|e }}">{{ parent.title }}</a>
+                    {% endfor %}
+                    {% if pagename != docs_root %}<span aria-hidden="true">/</span> <span>{{ title|striptags|e }}</span>{% endif %}
+                </nav>
+                <span class="docs-version">{{ release|e }}</span>
+            </div>
+
+            {% block body %}{% endblock %}
+            {% if prev or next %}
+                <nav class="page-relations" aria-label="{{ _('Related pages') }}">
+                    <div>
+                        {% if prev %}<small>{{ _('Previous') }}</small><a href="{{ prev.link|e }}" rel="prev">{{ prev.title }}</a>{% endif %}
+                    </div>
+                    <div>
+                        {% if next %}<small>{{ _('Next') }}</small><a href="{{ next.link|e }}" rel="next">{{ next.title }}</a>{% endif %}
+                    </div>
+                </nav>
+            {% endif %}
+        </main>
+    </div>
+{% endblock %}
+
+{% block footer %}
+    <footer class="site-footer">
+        <div class="footer-grid">
+            <p class="footer-copy">{{ project|e }} {{ _('documentation') }} · {{ release|e }}</p>
+            <nav class="footer-links" aria-label="{{ _('Footer navigation') }}">
+                <a href="{{ pathto(docs_root)|e }}">{{ _('Contents') }}</a>
+                <a href="{{ zoite_atlas_url|e }}">{{ _('Atlas') }}</a>
+                {% if hasdoc('search') %}<a href="{{ pathto('search')|e }}">{{ _('Search') }}</a>{% endif %}
+                {% if hasdoc('genindex') %}<a href="{{ pathto('genindex')|e }}">{{ _('Index') }}</a>{% endif %}
+                <a href="#top">{{ _('Back to top') }}</a>
+            </nav>
+        </div>
+    </footer>
+{% endblock %}

docs/_theme/zoitechat/localtoc.html

@@ -0,0 +1,7 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+{% if display_toc %}
+    <nav class="local-toc" aria-label="{{ _('On this page') }}">
+        <h2>{{ _('On this page') }}</h2>
+        {{ toc }}
+    </nav>
+{% endif %}

docs/_theme/zoitechat/searchbox.html

@@ -0,0 +1,10 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+{% if pagename != "search" %}
+    <form class="docs-search" action="{{ pathto('search')|e }}" method="get" role="search">
+        <label for="docs-search-input">{{ _('Search documentation') }}</label>
+        <div class="search-inputs">
+            <input id="docs-search-input" type="search" name="q" placeholder="{{ _('Search documentation') }}" autocomplete="off" spellcheck="false">
+            <button type="submit">{{ _('Search') }}</button>
+        </div>
+    </form>
+{% endif %}

docs/_theme/zoitechat/theme.conf

@@ -0,0 +1,7 @@
+[theme]
+inherit = basic
+stylesheet = basic.css
+pygments_style = sphinx
+sidebars = searchbox.html, globaltoc.html, localtoc.html, sourcelink.html
+
+[options]

docs/conf.py

@@ -99,7 +99,7 @@ trim_footnote_reference_space = True
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
-html_theme = 'basicstrap'
+html_theme = 'zoitechat'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
@@ -127,13 +127,16 @@ html_context = {
     'zoite_site_url': 'https://zoitechat.org/',
     'zoite_download_url': 'https://zoitechat.org/download.php',
     'zoite_addons_url': 'https://zoitechat.org/addons.php',
+    'zoite_announcements_url': 'https://zoitechat.org/announcements.php',
+    'zoite_github_url': 'https://github.com/ZoiteChat/zoitechat',
+    'zoite_atlas_url': 'https://atlas.zoitechat.org/',
     'zoite_irc_url': 'https://zoite.net/webchat/?join=%23zoitechat',
     'libera_irc_url': 'https://web.libera.chat/#zoitechat',
 }
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
-html_logo = 'zoitechat-logo.svg'
+html_logo = '_static/zoitechat-logo.svg'
 
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
@@ -145,8 +148,9 @@ html_favicon = '_static/favicon.ico'
 # so a file named "default.css" will overwrite the builtin "default.css".
 html_static_path = ['_static']
 
-# Main-site visual skin for Read the Docs/Sphinx HTML output.
+# Local, readable assets shared by hosted and offline HTML documentation.
-html_css_files = ['css/zoitechat-docs.css']
+html_css_files = ['css/zoitechat-docs.css', 'css/zoitechat-site.css']
+html_js_files = ['js/zoitechat-docs.js']
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.

meson.build

@@ -13,7 +13,9 @@ gnome = import('gnome')
 cc = meson.get_compiler('c')
 
 
-libgio_dep = dependency('gio-2.0', version: '>= 2.36.0')
+# The relocatable macOS runtime sets the GIO TLS database explicitly.
+libgio_dep = dependency('gio-2.0',
+  version: host_machine.system() == 'darwin' ? '>= 2.60.0' : '>= 2.36.0')
 libgmodule_dep = dependency('gmodule-2.0')
 
 libcanberra_dep = dependency('libcanberra', version: '>= 0.22',
@@ -29,7 +31,13 @@ else
                           required: get_option('tls'))
 endif
 
+gtk_mac_dep = disabler()
+if host_machine.system() == 'darwin' and get_option('gtk-frontend')
+  gtk_mac_dep = dependency('gtk-mac-integration-gtk3', required: get_option('mac-integration'))
+endif
+
 config_h = configuration_data()
+config_h.set('HAVE_GTK_MAC', host_machine.system() == 'darwin' and gtk_mac_dep.found())
 config_h.set_quoted('PACKAGE_VERSION', meson.project_version())
 config_h.set_quoted('PACKAGE_NAME', meson.project_name())
 config_h.set_quoted('GETTEXT_PACKAGE', 'zoitechat')
@@ -99,6 +107,12 @@ global_cflags = [
   '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_36',
   '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_36',
 ]
+if host_machine.system() == 'darwin'
+  global_cflags = [
+    '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_60',
+    '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_60',
+  ]
+endif
 test_cflags = [
   '-funsigned-char',
   '-Wno-conversion',
@@ -159,6 +173,10 @@ foreach ldflag : test_ldflags
     global_ldflags += ldflag
   endif
 endforeach
+if host_machine.system() == 'darwin'
+  # Leave room for install_name_tool to rewrite packaged dependencies.
+  global_ldflags += '-Wl,-headerpad_max_install_names'
+endif
 add_project_link_arguments(global_ldflags, language: 'c')
 
 subdir('src')

meson_options.txt

@@ -23,6 +23,10 @@ option('appindicator', type: 'feature', value: 'auto',
   description: 'Use Ayatana/AppIndicator-based tray backend for GTK frontend (non-Windows only)'
 )
 
+# macOS only; ignored by other platforms.
+option('mac-integration', type: 'feature', value: 'auto',
+  description: 'Native macOS menu bar, Dock and application lifecycle')
+
 # Install options
 option('dbus-service-use-appid', type: 'boolean', value: false,
   description: 'Rename dbus service to match app-id, required for Flatpak'

packaging/macos/Brewfile

@@ -0,0 +1,15 @@
+brew "meson"
+brew "ninja"
+brew "pkgconf"
+brew "python"
+brew "gettext"
+brew "gtk+3"
+brew "gtk-mac-integration"
+brew "libarchive"
+brew "openssl@3"
+brew "lua"
+brew "librsvg"
+brew "glib-networking"
+brew "adwaita-icon-theme"
+brew "enchant"
+brew "ca-certificates"

packaging/macos/README.md

@@ -0,0 +1,335 @@
+# Native macOS build and distribution
+
+This builds GTK3 with the native Quartz backend, macOS menus/Dock integration,
+UserNotifications, translations, bundled emoji, TLS, image loaders and supported
+native plugins. It creates a self-contained `ZoiteChat.app`; end users do not
+need Homebrew, XQuartz or Python. No system-wide ZoiteChat installation occurs.
+
+The source changes are conditional on Darwin. Windows and Linux retain their
+existing notification backends and feature defaults. This adds a separate
+macOS workflow; it does not replace existing workflows.
+
+## 1. Install build prerequisites
+
+Use a Mac with a currently supported macOS release and native Homebrew. On Apple
+Silicon, use ARM Homebrew (`/opt/homebrew`), not Intel Homebrew under Rosetta.
+Intel builds use Intel Homebrew (`/usr/local`). Install Xcode command-line tools
+and Homebrew from https://brew.sh if absent. Full current Xcode is recommended
+for distribution and needed to meet the current App Store submission SDK rules.
+
+```sh
+xcode-select --install
+# Run once if the command-line tools are not installed; let installation finish.
+
+cd /path/to/zoitechat
+brew bundle --file packaging/macos/Brewfile
+python3 packaging/macos/build.py
+open dist/ZoiteChat.app
+```
+
+The build compiles the app, runs its Meson tests, stages an installation within
+`build-macos/macos-stage`, bundles and rewrites every non-system Mach-O dependency,
+creates the icon and plist, audits the result, and signs it ad hoc for local use.
+It refuses to overwrite an existing output app. For another build, choose a new
+output path, or explicitly delete your old generated app before rebuilding:
+
+```sh
+python3 packaging/macos/build.py --output dist/ZoiteChat-test2.app --build-number 2
+```
+
+The same build directory can be reconfigured. Use a different build directory
+for another architecture or the experimental store variant. Do not change
+architectures within one Meson build directory.
+
+Homebrew packages change over time; this is a repeatable procedure, not a
+bit-for-bit reproducible dependency lock. The bundle records dependency versions
+in `Contents/Resources/homebrew-dependencies.json`. Retain that record and the
+release's source commit. For a reproducible release, archive the exact dependency
+sources and build them in a controlled prefix, or maintain pinned Homebrew formulae.
+
+## 2. Verify portability and behavior
+
+```sh
+python3 -m unittest discover -s packaging/macos/tests -v
+python3 packaging/macos/bundle.py audit dist/ZoiteChat.app
+python3 packaging/macos/smoke.py dist/ZoiteChat.app
+```
+
+The smoke check copies the app to a path containing spaces, verifies its signature,
+runs `--version`, and keeps an isolated GUI process alive for ten seconds without
+connecting to IRC. It tests startup, not interaction or long-running stability.
+
+The audit verifies the entire dependency closure, including GTK image/input
+modules, GIO TLS, Enchant providers, OpenSSL providers and ZoiteChat plugins. It
+fails on missing libraries, external symlinks/search paths, architecture mismatches
+or unresolved load commands. The minimum macOS version in the plist is derived
+from **all** bundled binaries, including Homebrew libraries. Lowering that plist
+value does not make newer dependency bottles run on an older Mac.
+
+Before releasing, test on a second Mac without Homebrew installed:
+
+- Launch from Finder and from a relocated/read-only location; verify Dock and
+  menu bar, preferences persistence, dark/light themes and normal shutdown.
+- Connect with verified TLS, exercise SASL authentication and reconnect.
+- Send Unicode/emoji, render SVG/PNG/JPEG icons/images, and test HTTPS image previews.
+- Verify clipboard shortcuts, input methods, notifications/permission denial,
+  detach/reattach tabs, focus changes, unread highlights and notification clicks.
+- Send/receive/resume DCC, write downloads and logs, import/export themes/settings.
+- Test FiSH, Lua and DCC checksum plugins in the direct build.
+- Exercise accessibility with VoiceOver and keyboard-only navigation.
+
+Direct builds include Lua, FiSH and checksum, and retain the plugin loader.
+Python/Perl are explicitly not bundled: reliable redistribution requires packaging
+and auditing their interpreter runtimes, standard libraries and extensions.
+Linux `/proc`/PCI sysinfo is not built on macOS. These are macOS build choices;
+other platforms' plugin defaults are unchanged. macOS uses the existing password
+storage fallback; this patch does not add a Keychain backend. Audit credentials
+storage before adopting a stronger macOS security claim.
+
+Desktop URL registration (`irc://` in Finder/browser) is not advertised by the
+plist; command-line IRC URLs continue to work. A native open-URL event handler
+and single-instance forwarding need separate integration before registering those
+schemes. AppIndicator and Linux D-Bus scripting/single-instance support are not
+used on macOS.
+
+## 3. Sign and notarize for direct downloads
+
+Local ad-hoc builds are for testing; they are not notarized releases. For public
+release, enroll in Apple's Developer Program, install your **Developer ID
+Application** certificate with its private key, then sign using that identity.
+Use your actual certificate identity in place of the example:
+
+```sh
+python3 packaging/macos/bundle.py sign dist/ZoiteChat.app \
+  --identity 'Developer ID Application: YOUR NAME (TEAMID)' \
+  --entitlements packaging/macos/direct.entitlements
+
+# Store credentials once in your login Keychain; enter your own values interactively.
+xcrun notarytool store-credentials ZoiteChat-notary
+
+ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-notarization.zip
+xcrun notarytool submit dist/ZoiteChat-notarization.zip \
+  --keychain-profile ZoiteChat-notary --wait
+
+# Only after notarization has succeeded:
+xcrun stapler staple dist/ZoiteChat.app
+xcrun stapler validate dist/ZoiteChat.app
+spctl --assess --type execute --verbose=2 dist/ZoiteChat.app
+
+ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-macos.zip
+```
+
+Signing runs inside-out, verifies the final bundle and enables hardened runtime.
+It does not use `codesign --deep` to sign. `--deep` is used only for verification.
+The direct entitlement allows users' independently signed native plugins; it
+relaxes library validation, not the entire hardened runtime. No JIT or executable
+memory entitlements are added. Do not change bundle contents after signing; signing
+again is required after any code/resource edit. Stapling is Apple's supported
+post-signing operation.
+
+Publish exact corresponding source for ZoiteChat and satisfy the applicable
+licenses of each bundled dependency. Notices and dependency metadata are included,
+but those alone do not satisfy every source-distribution obligation. Review the
+notarization log if rejected; the script does not silently bypass Gatekeeper.
+
+### Automate signing and notarization with GitHub Actions
+
+The workflow now has a separate signed/notarized release job for both
+architectures. It uses Developer ID distribution for direct downloads, not Mac
+App Store signing. You can manage it from Windows/Linux; GitHub's macOS runners
+perform all signing, notarization and stapling.
+
+Prepare these repository Actions secrets under **Settings → Secrets and
+variables → Actions**, or store them as environment secrets in **macos-release**.
+The certificate setting names are unchanged from the original instructions.
+The three `APPLE_API_*` settings are new notarization credentials:
+
+| Name | Type | Value |
+| --- | --- | --- |
+| `MACOS_CERTIFICATE_P12_BASE64` | Secret | Base64-encoded Developer ID Application `.p12`, including its private key |
+| `MACOS_CERTIFICATE_PASSWORD` | Secret | Password used to export that `.p12` |
+| `MACOS_SIGNING_IDENTITY` | Variable, or Secret | Exact `Developer ID Application: YOUR NAME (TEAMID)` identity; the matching certificate's SHA-1 fingerprint is also accepted |
+| `APPLE_API_KEY_P8` | Secret | Entire plain-text App Store Connect **Team API key** `.p8` file, including PEM header/footer and newlines |
+| `APPLE_API_KEY_ID` | Secret | That API key's Key ID |
+| `APPLE_API_ISSUER_ID` | Secret | The Team API key's Issuer ID UUID; this is **not** your Apple Team ID |
+
+Repository variables are under the **Variables** tab. If the identity is entered
+as both a variable and a secret, the variable takes precedence. No separate
+keychain password is needed; the job generates a temporary random password.
+The `.p8` is the notarization API key; it does not replace the signing `.p12`.
+No Apple ID password or app-specific password is used by this configuration.
+
+To obtain the API key, open **App Store Connect → Users and Access → Integrations
+→ App Store Connect API → Team Keys → Generate API Key**. Choose **Developer**
+access for notarization. If API access is not enabled, the Account Holder must
+request it first. Download the `.p8` and record the Key ID and Issuer ID. Use a
+**Team** key with this workflow: individual API keys use different authentication
+and are not supported by this issuer-based configuration. Apple allows the
+private key download only once, so retain your copy securely.
+
+For the certificate, export the Developer ID Application identity (certificate
+plus private key) from Keychain Access as a password-protected `.p12`.
+If you generated the CSR with OpenSSL on Linux/WSL, you can also create it there.
+Assuming Apple's downloaded DER certificate has been saved as
+`developerID_application.cer`, and you retained `zoitechat-signing.key`:
+
+```sh
+openssl x509 -inform DER -in developerID_application.cer \
+  -out zoitechat-signing.pem
+openssl pkcs12 -export -inkey zoitechat-signing.key \
+  -in zoitechat-signing.pem -out ZoiteChat-signing.p12
+
+# Enter the existing private-key password, then choose the .p12 export password.
+# Copy the resulting Base64 text into MACOS_CERTIFICATE_P12_BASE64:
+openssl base64 -A -in ZoiteChat-signing.p12 -out ZoiteChat-signing.p12.base64
+
+# Read the certificate's commonName to obtain MACOS_SIGNING_IDENTITY:
+openssl x509 -in zoitechat-signing.pem -noout -subject -nameopt multiline
+```
+
+Upload only the public CSR to Apple. Put the `.p12` Base64, export password and
+API credentials in GitHub settings, never in the repository or build artifacts.
+
+Once these patches are committed to `master` and the settings are ready:
+
+1. Open **Actions → macOS build → Run workflow**.
+2. Select **master** and enable **Sign with Developer ID and notarize using
+   release credentials**.
+3. Run the workflow. It creates separate Apple Silicon and Intel release jobs.
+4. After success, download `ZoiteChat-macos-arm64-signed-notarized` or
+   `ZoiteChat-macos-x86_64-signed-notarized`. The ZIP inside contains the signed,
+   stapled app. Actions artifacts wrap it in their own download archive.
+
+A push of a `v*` tag also triggers the signed release jobs automatically, so wait
+until credentials are configured before pushing a release tag. Normal branch
+pushes, pull requests and manual runs with the checkbox off continue to build
+ad-hoc test artifacts without any signing secrets. Manual credentialed releases
+are restricted to `master`; pull requests cannot invoke the release job.
+Missing/malformed release settings fail before the Homebrew/build steps rather
+than producing an unsigned artifact marked as a release.
+
+The release jobs use the GitHub environment **macos-release**. Repository secrets
+work with it; environment secrets can override them. Configure environment
+branch/tag restrictions or required reviewers if that fits your repository's
+release process. This workflow does not automatically create a GitHub Release,
+publish to zoitechat.org, or upload to App Store Connect; it produces downloadable
+signed/notarized artifacts for you to publish.
+
+The job imports the `.p12` into a temporary keychain, installs Apple's public
+Developer ID intermediate certificates, verifies a valid matching identity,
+and signs inside-out with hardened runtime and the direct plugin entitlement.
+It uses the existing bundle audit and then submits a ZIP with `notarytool`.
+After Apple reports **Accepted**, it staples the ticket to the `.app`, verifies
+stapling/signatures and Gatekeeper acceptance, and creates a **new** final ZIP.
+Private credential files and the temporary keychain are cleaned up on normal
+success/failure paths; hosted runner VMs are also discarded after the job.
+
+The default Apple wait limit is **60 minutes** within a **180-minute** release
+job. A rejected, failed or still-pending submission produces no final release
+ZIP. The `ZoiteChat-macos-<arch>-notarization-log` artifact retains the submission
+ID, status and Apple's available diagnostic log. First submissions can take
+longer; check the saved ID with `notarytool info` and your API credentials. An
+accepted submission still requires stapling and repackaging before publication;
+rerunning this workflow starts a new build and submission. To increase the wait
+limit, update `--notary-timeout` and allow adequate job timeout for build plus wait.
+
+Both architecture builds receive the same bundle build number for one workflow
+run. The API credentials are supplied only to the config-check/release steps,
+not to Homebrew, compiler tests, ordinary builds or pull-request jobs.
+
+## 4. Mac App Store: experimental groundwork, not submission-ready
+
+A working direct-download app is not sufficient for App Store submission. This
+repository inherits GPL-2.0-or-later code from XChat/HexChat and other contributors.
+App Store terms and GPL obligations require a licensing review; do not assume
+that signing, a custom EULA, or relicensing only your new changes resolves rights
+to inherited code. This patch changes no licenses or copyright permissions.
+
+An isolated sandbox-test build is provided:
+
+```sh
+python3 packaging/macos/build.py --store-experimental \
+  --build-dir build-macos-store --output dist/ZoiteChat-store-test.app \
+  --build-number 1
+
+# Local sandbox experimentation (not an uploadable distribution signature):
+python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
+  --identity - --entitlements packaging/macos/store-experimental.entitlements
+open dist/ZoiteChat-store-test.app
+```
+
+The separate store variant excludes loadable plugins and scripting runtimes.
+The template grants sandboxed client/server networking, user-selected files and
+Downloads. The direct version retains its plugin functionality. This is an
+explicit experimental variant, not a change to Windows/Linux or direct builds.
+
+Before a store package can be regarded as a release candidate:
+
+1. Resolve the inherited GPL/dependency-license distribution question and review
+   Apple's current SDK, content/chat moderation, privacy and accessibility rules.
+2. Register `org.Zoitechat` (or change the plist identifier consistently if already
+   owned by another developer), create App Store Connect metadata, and choose a
+   unique incrementing build number. Use a stable release, not a `-dev` snapshot.
+3. Test sandboxed settings/logs, notifications, SASL/TLS, HTTPS and DCC on a real
+   Mac. GTK dialogs are not assumed to grant Powerbox access. Add native
+   `NSOpenPanel`/`NSSavePanel` integration and security-scoped bookmarks for
+   persistent access to user-selected files. The entitlement template alone does
+   not solve persistent file access. `/EXEC`, custom external commands, user
+   plugin loading and arbitrary external paths cannot be promised under sandbox.
+4. Add required privacy manifest declarations based on an actual API audit of the
+   app and dependencies; do not submit an invented empty compliance declaration.
+5. Obtain matching App Store distribution application/installer certificates and
+   a matching provisioning profile. Generate team-specific signing entitlements
+   from the profile with Xcode; do not use Developer ID or the generic local-test
+   template as a store distribution identity/profile.
+6. Embed the matching profile as `Contents/embedded.provisionprofile` **before**
+   final signing. Sign embedded libraries with the distribution identity, then
+   the app with its profile-authorized entitlements (use `bundle.py sign` with
+   that identity and generated entitlement file). Package with Apple's
+   `productbuild`, validate and upload with Transporter/App Store Connect, then
+   test the App Store processed build via TestFlight before submission.
+
+Example **after those prerequisites are satisfied**:
+
+```sh
+# Use the actual prepared profile and team-specific entitlements:
+cp /path/to/ZoiteChat.provisionprofile \
+  dist/ZoiteChat-store-test.app/Contents/embedded.provisionprofile
+python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
+  --identity 'YOUR APP STORE APPLICATION CERTIFICATE IDENTITY' \
+  --entitlements /path/to/ZoiteChat-distribution.entitlements
+productbuild --component dist/ZoiteChat-store-test.app /Applications \
+  --sign 'YOUR APP STORE INSTALLER CERTIFICATE IDENTITY' dist/ZoiteChat-store.pkg
+```
+
+No App Store approval, sandbox compatibility or legal compatibility is asserted.
+For an initial macOS release, the signed/notarized direct build is the practical
+path while those issues are resolved.
+
+## 5. CI and architecture support
+
+`.github/workflows/macos-build.yml` adds independent Apple Silicon and Intel jobs.
+Ordinary jobs install prerequisites, run tests, create/audit/ad-hoc-sign the
+bundle, check relocated startup and upload test ZIPs. They need no Apple secrets.
+The separate release jobs add Developer ID signing, Apple notarization, stapling
+and final verification. Only their successful output is named signed/notarized.
+
+Homebrew may build unsupported Intel bottles from source; that can be slower.
+The workflow uses native runners and does not claim a universal application.
+Do not merge only the main executable with `lipo`: a universal release must merge
+and validate every bundled dylib, module and plugin plus matching resources.
+Signing must happen after that merge. Publish separate architecture downloads
+until a full universal dependency pipeline is available.
+
+## References
+
+- GTK on macOS: https://www.gtk.org/docs/installations/macos
+- GTK macOS backend: https://docs.gtk.org/gtk3/macos.html
+- Apple distribution signing: https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac
+- Apple packaging: https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution
+- GitHub certificate import: https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications
+- Apple notarization authentication: https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool
+- App Store Connect API keys: https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/
+- Apple review rules (especially 1.2 and 2.4.5): https://developer.apple.com/app-store/review/guidelines/
+- Apple sandbox file access: https://developer.apple.com/documentation/security/accessing-files-from-the-macos-app-sandbox
+- FSF discussion of GPL and App Store terms (historical, not a current legal determination): https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement

packaging/macos/build.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Compile, test, stage and package ZoiteChat on the host Mac."""
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import sys
+
+from bundle import ROOT, package, run
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--build-dir", type=Path, default=Path("build-macos"))
+    parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat.app"))
+    parser.add_argument("--build-number", default="1")
+    parser.add_argument("--store-experimental", action="store_true", help="Build a separate sandbox test variant without loadable plugins; not submission approval")
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("Build on macOS; cross-compiling from Linux is not supported")
+    if args.output.exists():
+        parser.error("Output already exists; use a new --output or explicitly remove the old app")
+    build = args.build_dir.resolve()
+    if build == ROOT or ROOT.is_relative_to(build):
+        parser.error("Build directory must not contain the source checkout")
+    run("xcrun", "--find", "clang")
+    env = os.environ.copy()
+    prefixes = [Path(run("brew", "--prefix", name)) for name in ("gettext", "openssl@3", "libarchive", "lua", "gtk+3", "gtk-mac-integration")]
+    brew = Path(run("brew", "--prefix"))
+    # Keg-only gettext, OpenSSL and libarchive are not necessarily in PATH/pkg-config.
+    env["PATH"] = os.pathsep.join([str(p / "bin") for p in prefixes] + [str(brew / "bin"), env.get("PATH", "")])
+    env["PKG_CONFIG_PATH"] = os.pathsep.join([str(p / "lib/pkgconfig") for p in prefixes] + [str(brew / "lib/pkgconfig"), str(brew / "share/pkgconfig"), env.get("PKG_CONFIG_PATH", "")])
+    # Native dependency bottles determine the true deployment target; the bundle
+    # auditor derives the final minimum rather than promising an arbitrary old OS.
+    env.setdefault("MACOSX_DEPLOYMENT_TARGET", "11.0")
+    backend = run("pkg-config", "--variable=targets", "gtk+-3.0", env=env).split()
+    if "quartz" not in backend:
+        parser.error(f"GTK must provide the native Quartz backend, got {backend}")
+    # Do not silently select an XQuartz GTK stack or mix Intel/ARM Homebrew prefixes.
+    machine = platform.machine()
+    if machine not in ("arm64", "x86_64"):
+        parser.error(f"Unsupported architecture: {machine}")
+    options = [
+        "--prefix=/", "--libdir=lib", "--buildtype=release", "-Dgtk-frontend=true",
+        "-Dtext-frontend=false", "-Dmac-integration=enabled", "-Ddbus=disabled",
+        "-Dlibcanberra=disabled", "-Dappindicator=disabled", "-Dinstall-appdata=false",
+        "-Dwith-sysinfo=false", "-Dwith-python=false", "-Dwith-perl=false",
+        "-Dwith-lua=lua", "-Dwith-fishlim=true", "-Dwith-checksum=true",
+        "-Dplugin=" + ("false" if args.store_experimental else "true"),
+    ]
+    if (build / "meson-private/coredata.dat").exists():
+        options.insert(0, "--reconfigure")
+    subprocess.run(["meson", "setup", str(build), str(ROOT), *options], env=env, check=True)
+    subprocess.run(["meson", "compile", "-C", str(build)], env=env, check=True)
+    subprocess.run(["meson", "test", "-C", str(build), "--print-errorlogs"], env=env, check=True)
+    stage = build / "macos-stage"
+    if stage.exists():
+        shutil.rmtree(stage)
+    subprocess.run(["meson", "install", "-C", str(build), "--destdir", str(stage)], env=env, check=True)
+    package(stage, args.output.resolve(), args.build_number)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
+        sys.exit(f"macOS build failed: {error}")

packaging/macos/bundle.py

@@ -0,0 +1,358 @@
+#!/usr/bin/env python3
+"""Build and audit a relocatable GTK3 application. No third-party Python packages."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import platform
+import plistlib
+import re
+import shutil
+import subprocess
+import sys
+
+ROOT = Path(__file__).resolve().parents[2]
+MACH_MAGIC = {bytes.fromhex(h) for h in ("feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca")}
+SYSTEM_ROOTS = ("/usr/lib/", "/System/Library/")
+
+
+def run(*args: str | Path, env: dict[str, str] | None = None) -> str:
+    return subprocess.check_output([str(arg) for arg in args], env=env, text=True).strip()
+
+
+def is_macho(path: Path) -> bool:
+    if not path.is_file() or path.is_symlink():
+        return False
+    with path.open("rb") as stream:
+        return stream.read(4) in MACH_MAGIC
+
+
+def dependencies(path: Path) -> list[str]:
+    # Paths may contain spaces; splitting on whitespace would corrupt them.
+    return re.findall(r"^\s+(.+?) \(compatibility version", run("otool", "-L", path), re.M)
+
+
+def rpaths(path: Path) -> list[str]:
+    return re.findall(r"cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset", run("otool", "-l", path))
+
+
+def dylib_id(path: Path) -> str | None:
+    lines = run("otool", "-D", path).splitlines()
+    return lines[1].strip() if len(lines) > 1 else None
+
+
+def system_library(name: str) -> bool:
+    return name.startswith(SYSTEM_ROOTS)
+
+
+def expand_path(name: str, loader: Path, executable: Path) -> Path:
+    return Path(name.replace("@loader_path", str(loader.parent)).replace("@executable_path", str(executable.parent)))
+
+
+def resolve_dependency(name: str, loader: Path, executable: Path, search: list[Path]) -> Path:
+    if name.startswith("@rpath/"):
+        suffix = name[len("@rpath/"):]
+        candidates = [directory / suffix for directory in search]
+    else:
+        candidates = [expand_path(name, loader, executable)]
+    for candidate in candidates:
+        if candidate.is_absolute() and candidate.is_file():
+            return candidate.resolve()
+    raise RuntimeError(f"Cannot resolve {name!r} from {loader}; searched {candidates}")
+
+
+class Relocator:
+    def __init__(self, app: Path, executable: Path):
+        self.app = app
+        self.executable = executable
+        self.frameworks = app / "Contents/Frameworks"
+        self.frameworks.mkdir(parents=True)
+        self.sources: dict[Path, Path] = {}
+        self.names: dict[str, Path] = {}
+        self.visited: set[Path] = set()
+
+    def copy_dependency(self, source: Path) -> Path:
+        source = source.resolve()
+        if ".framework/" in str(source):
+            raise RuntimeError(f"Third-party frameworks require separate packaging support: {source}")
+        if source in self.sources:
+            return self.sources[source]
+        existing = self.names.get(source.name)
+        if existing and existing != source:
+            raise RuntimeError(f"Conflicting library basename: {existing} and {source}")
+        target = self.frameworks / source.name
+        shutil.copy2(source, target)
+        target.chmod(target.stat().st_mode | 0o200)
+        self.sources[source] = target
+        self.names[source.name] = source
+        return target
+
+    def relocate(self, source: Path, target: Path, inherited: list[Path] | None = None) -> None:
+        source = source.resolve()
+        if target in self.visited:
+            return
+        self.visited.add(target)
+        local = [expand_path(name, source, self.executable) for name in rpaths(source)]
+        search = local + (inherited or [])
+        identity = dylib_id(source)
+        # Keep the existing signature allocation while editing: stripping it
+        # first can leave __LINKEDIT padding that install_name_tool rejects.
+        # The final inside-out codesign --force pass replaces stale signatures.
+        edits: list[str | Path] = []
+        for name in dependencies(source):
+            if name == identity or system_library(name):
+                continue
+            dependency = resolve_dependency(name, source, self.executable, search)
+            destination = self.copy_dependency(dependency)
+            relative = os.path.relpath(destination, target.parent)
+            edits += ["-change", name, "@loader_path/" + relative]
+            self.relocate(dependency, destination, search)
+        if identity:
+            edits += ["-id", "@rpath/" + target.name]
+        for name in sorted(set(rpaths(target))):
+            edits += ["-delete_rpath", name]
+        if edits:
+            run("install_name_tool", *edits, target)
+
+
+def copy_tree(source: Path, target: Path) -> None:
+    if source.is_dir():
+        # Dereference symlinks: never leave links into the builder's Cellar.
+        shutil.copytree(source, target, dirs_exist_ok=True, symlinks=False)
+
+
+def audit(app: Path) -> dict[str, object]:
+    binary = app / "Contents/MacOS/zoitechat"
+    architectures = set(run("lipo", "-archs", binary).split())
+    minimum = (11, 0, 0)
+    entries = []
+    for path in sorted(app.rglob("*")):
+        if path.is_symlink():
+            resolved = path.resolve()
+            if not resolved.is_relative_to(app.resolve()):
+                raise RuntimeError(f"External symlink: {path} -> {resolved}")
+        if not is_macho(path):
+            continue
+        if not architectures.issubset(set(run("lipo", "-archs", path).split())):
+            raise RuntimeError(f"Architecture mismatch: {path}")
+        identity = dylib_id(path)
+        for name in dependencies(path):
+            if name == identity or system_library(name):
+                continue
+            if not name.startswith("@loader_path/"):
+                raise RuntimeError(f"Non-relocatable dependency: {path}: {name}")
+            target = expand_path(name, path, binary).resolve()
+            if not target.is_relative_to(app.resolve()) or not target.is_file():
+                raise RuntimeError(f"Missing or external dependency: {path}: {name}")
+        if rpaths(path):
+            raise RuntimeError(f"Unexpected runtime search paths: {path}")
+        load_commands = run("otool", "-l", path)
+        versions = re.findall(r"\bminos (\d+(?:\.\d+){0,2})", load_commands)
+        versions += re.findall(r"cmd LC_VERSION_MIN_MACOSX\s+cmdsize \d+\s+version (\d+(?:\.\d+){0,2})", load_commands)
+        if not versions:
+            raise RuntimeError(f"Missing deployment version: {path}")
+        for version in versions:
+            parts = tuple(int(value) for value in version.split("."))
+            minimum = max(minimum, parts + (0,) * (3 - len(parts)))
+        entries.append({"path": str(path.relative_to(app))})
+    return {"architectures": sorted(architectures), "minimum_macos": ".".join(map(str, minimum if minimum[2] else minimum[:2])), "mach_o": entries}
+
+
+def package(stage: Path, app: Path, build_number: str) -> None:
+    if not re.fullmatch(r"[1-9]\d*(?:\.\d+){0,2}", build_number):
+        raise RuntimeError("Build number must be a positive Apple CFBundleVersion (for example 1 or 12.3)")
+    if app.exists():
+        raise RuntimeError(f"Output already exists; choose another --output or remove it explicitly: {app}")
+    app.mkdir(parents=True)
+    resources = app / "Contents/Resources"
+    resources.mkdir(parents=True)
+    binary = app / "Contents/MacOS/zoitechat"
+    binary.parent.mkdir()
+    shutil.copy2(stage / "bin/zoitechat", binary)
+    copy_tree(stage / "share", resources / "share")
+    copy_tree(stage / "lib/zoitechat/plugins", resources / "lib/zoitechat/plugins")
+    relocator = Relocator(app, stage / "bin/zoitechat")
+    seeds: list[tuple[Path, Path]] = [(stage / "bin/zoitechat", binary)]
+    for source in (stage / "lib/zoitechat/plugins").glob("*"):
+        if is_macho(source):
+            seeds.append((source, resources / "lib/zoitechat/plugins" / source.name))
+
+    prefixes = {formula: Path(run("brew", "--prefix", formula)) for formula in (
+        "gtk+3", "gdk-pixbuf", "glib", "glib-networking", "librsvg", "enchant", "adwaita-icon-theme", "hicolor-icon-theme", "gsettings-desktop-schemas", "ca-certificates", "openssl@3", "lua", "libarchive", "gtk-mac-integration")}
+    # Runtime-loaded code is not visible in the main executable's otool output.
+    module_groups = [
+        (prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
+        (prefixes["librsvg"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
+        (prefixes["gtk+3"] / "lib/gtk-3.0/3.0.0/immodules", "lib/gtk-3.0/3.0.0/immodules"),
+        (prefixes["glib-networking"] / "lib/gio/modules", "lib/gio/modules"),
+        (prefixes["enchant"] / "lib/enchant-2", "lib/enchant-2"),
+        (prefixes["openssl@3"] / "lib/ossl-modules", "lib/ossl-modules"),
+    ]
+    for source_dir, relative in module_groups:
+        target_dir = resources / relative
+        target_dir.mkdir(parents=True, exist_ok=True)
+        for source in sorted(source_dir.glob("*")):
+            if source.suffix not in (".so", ".dylib") or not source.is_file():
+                continue
+            target = target_dir / source.name
+            if target.exists() and target.read_bytes() != source.read_bytes():
+                raise RuntimeError(f"Conflicting module: {target}")
+            shutil.copy2(source.resolve(), target)
+            seeds.append((source.resolve(), target))
+    enchant = (prefixes["enchant"] / "lib/libenchant-2.dylib").resolve()
+    # Register Enchant at Resources/lib so its public prefix relocation API
+    # finds Resources/lib/enchant-2 and Resources/share/enchant.
+    enchant_alias = resources / "lib/libenchant-2.dylib"
+    shutil.copy2(enchant, enchant_alias)
+    relocator.sources[enchant] = enchant_alias
+    relocator.names[enchant.name] = enchant
+    seeds.append((enchant, enchant_alias))
+    for formula, prefix in prefixes.items():
+        for name in ("icons", "glib-2.0/schemas", "locale", "enchant", "hunspell"):
+            copy_tree(prefix / "share" / name, resources / "share" / name)
+    ca = prefixes["ca-certificates"] / "share/ca-certificates/cacert.pem"
+    if not ca.is_file():
+        raise RuntimeError(f"CA bundle not found: {ca}")
+    (resources / "certs").mkdir()
+    shutil.copy2(ca, resources / "certs/ca-bundle.crt")
+    schemas = resources / "share/glib-2.0/schemas"
+    run(prefixes["glib"] / "bin/glib-compile-schemas", schemas)
+    pixbuf_modules = sorted((resources / "lib/gdk-pixbuf-2.0/2.10.0/loaders").glob("*"))
+    if not any("svg" in path.name for path in pixbuf_modules):
+        raise RuntimeError("SVG loader missing: install librsvg")
+    if list((resources / "lib/zoitechat/plugins").glob("fishlim.*")) and not list((resources / "lib/ossl-modules").glob("legacy.*")):
+        raise RuntimeError("FiSH needs the OpenSSL legacy provider in the bundle")
+    if not list((resources / "lib/gio/modules").glob("*tls*")):
+        raise RuntimeError("GIO TLS backend missing: install glib-networking")
+    # Query original binaries before relocation, then rewrite only the cached paths.
+    pixbuf_query = prefixes["gdk-pixbuf"] / "bin/gdk-pixbuf-query-loaders"
+    if not pixbuf_query.exists():
+        pixbuf_query = prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
+    for tool, module_dir, cache in (
+        (pixbuf_query, "lib/gdk-pixbuf-2.0/2.10.0/loaders", "pixbuf-loaders.cache"),
+        (prefixes["gtk+3"] / "bin/gtk-query-immodules-3.0", "lib/gtk-3.0/3.0.0/immodules", "gtk-immodules.cache"),
+    ):
+        originals = [(source, target) for source, target in seeds if target.parent == resources / module_dir]
+        # Never call a query tool with zero arguments: it would scan global modules.
+        data = run(tool, *(source for source, _ in originals)) if originals else "# No external input-method modules\n"
+        for source, target in originals:
+            data = data.replace(str(source), "@ZOITECHAT_RESOURCES@/" + str(target.relative_to(resources)))
+        (resources / cache).write_text(data + "\n")
+    # The private font map loads the bundled Noto font; ordinary GTK fonts stay local.
+    (resources / "fonts.conf").write_text('''<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+<fontconfig>
+  <dir>/System/Library/Fonts</dir><dir>/Library/Fonts</dir><dir>~/Library/Fonts</dir>
+  <cachedir prefix="xdg">fontconfig</cachedir>
+  <alias><family>sans-serif</family><prefer><family>Helvetica</family></prefer></alias>
+  <alias><family>monospace</family><prefer><family>Menlo</family></prefer></alias>
+</fontconfig>
+''')
+    (resources / "zoitechat-bundle").write_text("1\n")
+    licenses = resources / "licenses"
+    licenses.mkdir()
+    shutil.copy2(ROOT / "COPYING", licenses / "ZoiteChat-COPYING")
+    # Preserve the notices shipped with every installed Homebrew dependency.
+    # brew deps traverses dependencies by default; --recursive is not an option.
+    wanted = set(prefixes)
+    for formula in prefixes:
+        wanted.update(run("brew", "deps", "--formula", formula).splitlines())
+    installed = [item for item in json.loads(run("brew", "info", "--json=v2", "--installed"))["formulae"]
+                 if item["name"] in wanted]
+    for formula in installed:
+        prefix = Path(run("brew", "--prefix", formula["name"]))
+        notices = [p for p in prefix.iterdir() if p.is_file() and re.match(r"(?i)(copying|license|copyright|notice)", p.name)]
+        if notices:
+            target = licenses / formula["name"].replace("/", "-")
+            target.mkdir(exist_ok=True)
+            for notice in notices:
+                shutil.copy2(notice, target / notice.name)
+    (resources / "homebrew-dependencies.json").write_text(json.dumps(installed, indent=2) + "\n")
+    for source, target in seeds:
+        relocator.relocate(source, target)
+    report = audit(app)
+    (resources / "bundle-audit.json").write_text(json.dumps(report, indent=2) + "\n")
+    # Use the actual highest deployment target of the executable and all dylibs.
+    # Setting an older plist version cannot make newer Homebrew bottles compatible.
+    version = (ROOT / "VERSION").read_text().strip()
+    release = re.match(r"\d+\.\d+\.\d+", version)
+    if not release:
+        raise RuntimeError(f"Unsupported release version: {version}")
+    plist = {
+        "CFBundleIdentifier": "org.Zoitechat", "CFBundleExecutable": "zoitechat",
+        "CFBundleName": "ZoiteChat", "CFBundleDisplayName": "ZoiteChat",
+        "CFBundlePackageType": "APPL", "CFBundleShortVersionString": release.group(),
+        "CFBundleVersion": build_number, "CFBundleIconFile": "ZoiteChat.icns",
+        "LSMinimumSystemVersion": report["minimum_macos"], "NSHighResolutionCapable": True,
+        "NSPrincipalClass": "NSApplication",
+        "LSApplicationCategoryType": "public.app-category.social-networking",
+        "DTSDKName": "macosx" + run("xcrun", "--sdk", "macosx", "--show-sdk-version"),
+        "DTSDKBuild": run("xcrun", "--sdk", "macosx", "--show-sdk-build-version"),
+    }
+    with (app / "Contents/Info.plist").open("wb") as stream:
+        plistlib.dump(plist, stream)
+    iconset = app.parent / (app.stem + ".iconset")
+    if iconset.exists():
+        raise RuntimeError(f"Icon staging directory already exists: {iconset}")
+    iconset.mkdir()
+    try:
+        # Rasterize the original vector at 1024px, then generate every icon size.
+        large = iconset / "source.png"
+        run(prefixes["librsvg"] / "bin/rsvg-convert", "-w", "1024", "-h", "1024", "-o", large, ROOT / "data/icons/zoitechat.svg")
+        for size in (16, 32, 128, 256, 512):
+            for scale in (1, 2):
+                name = f"icon_{size}x{size}" + ("@2x" if scale == 2 else "") + ".png"
+                run("sips", "-z", str(size * scale), str(size * scale), large, "--out", iconset / name)
+        large.unlink()
+        run("iconutil", "-c", "icns", iconset, "-o", resources / "ZoiteChat.icns")
+    finally:
+        shutil.rmtree(iconset)
+    # Local builds need an ad-hoc signature after install_name_tool changes.
+    sign(app, "-", None)
+    print(f"Created {app}: {', '.join(report['architectures'])}, macOS {report['minimum_macos']}+")
+
+
+def sign(app: Path, identity: str, entitlements: Path | None, *, keychain: Path | None = None) -> None:
+    audit(app)
+    binaries = [p for p in app.rglob("*") if is_macho(p) and p != app / "Contents/MacOS/zoitechat"]
+    options = [] if identity == "-" else ["--timestamp", "--options", "runtime"]
+    if keychain is not None:
+        options += ["--keychain", str(keychain)]
+    for binary in sorted(binaries, key=lambda p: len(p.parts), reverse=True):
+        run("codesign", "--force", "--sign", identity, *options, binary)
+    main_options = ["--entitlements", str(entitlements)] if entitlements else []
+    run("codesign", "--force", "--sign", identity, *options, *main_options, app)
+    run("codesign", "--verify", "--deep", "--strict", "--verbose=2", app)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="action", required=True)
+    create = sub.add_parser("create")
+    create.add_argument("--stage", type=Path, required=True)
+    create.add_argument("--app", type=Path, required=True)
+    create.add_argument("--build-number", default="1")
+    verify = sub.add_parser("audit")
+    verify.add_argument("app", type=Path)
+    signing = sub.add_parser("sign")
+    signing.add_argument("app", type=Path)
+    signing.add_argument("--identity", required=True)
+    signing.add_argument("--entitlements", type=Path)
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("This tool requires macOS and the Xcode command-line tools")
+    if args.action == "create":
+        package(args.stage.resolve(), args.app.resolve(), args.build_number)
+    elif args.action == "audit":
+        print(json.dumps(audit(args.app.resolve()), indent=2))
+    else:
+        sign(args.app.resolve(), args.identity, args.entitlements)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
+        sys.exit(f"macOS packaging failed: {error}")

packaging/macos/direct.entitlements

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <!-- User-installed native plugins need library validation disabled. -->
+  <key>com.apple.security.cs.disable-library-validation</key><true/>
+</dict></plist>

packaging/macos/release.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Developer ID sign, notarize and staple a built app using CI environment secrets."""
+from __future__ import annotations
+
+import argparse
+import base64
+import binascii
+from contextlib import contextmanager
+from dataclasses import dataclass
+import json
+import os
+from pathlib import Path
+import platform
+import re
+import secrets
+import shlex
+import subprocess
+import sys
+import tempfile
+import urllib.request
+import uuid
+
+from bundle import sign
+
+REQUIRED = (
+    "MACOS_CERTIFICATE_P12_BASE64", "MACOS_CERTIFICATE_PASSWORD",
+    "MACOS_SIGNING_IDENTITY", "APPLE_API_KEY_P8", "APPLE_API_KEY_ID", "APPLE_API_ISSUER_ID",
+)
+
+
+@dataclass(repr=False)
+class Credentials:
+    certificate: bytes
+    password: str
+    identity: str
+    api_key: str
+    key_id: str
+    issuer: str
+
+    @classmethod
+    def from_environment(cls) -> Credentials:
+        missing = [name for name in REQUIRED if not os.environ.get(name, "").strip()]
+        if missing:
+            raise RuntimeError("Missing release settings: " + ", ".join(missing))
+        try:
+            certificate = base64.b64decode("".join(os.environ[REQUIRED[0]].split()), validate=True)
+        except (binascii.Error, ValueError):
+            raise RuntimeError("MACOS_CERTIFICATE_P12_BASE64 must contain Base64-encoded .p12 bytes") from None
+        if not certificate:
+            raise RuntimeError("Signing certificate is empty")
+        identity = os.environ["MACOS_SIGNING_IDENTITY"].strip()
+        if not (identity.startswith("Developer ID Application:") or re.fullmatch(r"[a-fA-F0-9]{40}", identity)):
+            raise RuntimeError("MACOS_SIGNING_IDENTITY must identify a Developer ID Application certificate")
+        api_key = os.environ["APPLE_API_KEY_P8"].strip()
+        if not (api_key.startswith("-----BEGIN PRIVATE KEY-----") and api_key.endswith("-----END PRIVATE KEY-----")):
+            raise RuntimeError("APPLE_API_KEY_P8 must contain the complete, plain-text .p8 private key")
+        key_id = os.environ["APPLE_API_KEY_ID"].strip()
+        if not re.fullmatch(r"[A-Za-z0-9]{6,32}", key_id):
+            raise RuntimeError("APPLE_API_KEY_ID must be an App Store Connect key ID")
+        try:
+            issuer = str(uuid.UUID(os.environ["APPLE_API_ISSUER_ID"].strip()))
+        except ValueError:
+            raise RuntimeError("APPLE_API_ISSUER_ID must be the Team API key issuer UUID") from None
+        return cls(certificate, os.environ["MACOS_CERTIFICATE_PASSWORD"], identity, api_key, key_id, issuer)
+
+
+def execute(args: list[str | Path], operation: str, *, check: bool = True) -> subprocess.CompletedProcess[str]:
+    # Do not print argv or CalledProcessError: security commands contain passwords.
+    try:
+        result = subprocess.run([str(arg) for arg in args], capture_output=True, text=True, check=False)
+    except OSError:
+        raise RuntimeError(f"{operation}: could not start the required tool") from None
+    if check and result.returncode != 0:
+        raise RuntimeError(f"{operation} failed (exit {result.returncode})")
+    return result
+
+
+def write_private(path: Path, data: bytes) -> None:
+    with path.open("xb") as stream:
+        path.chmod(0o600)
+        stream.write(data)
+
+
+def resolve_identity(output: str, requested: str) -> str:
+    for fingerprint, name in re.findall(r'\b([A-Fa-f0-9]{40})\s+"([^"\n]+)"', output):
+        if name.startswith("Developer ID Application:") and (requested == name or requested.upper() == fingerprint.upper()):
+            return fingerprint
+    raise RuntimeError("Imported .p12 has no valid Developer ID Application identity matching MACOS_SIGNING_IDENTITY; check its private key, password, expiry and certificate chain")
+
+
+@contextmanager
+def signing_keychain(credentials: Credentials):
+    original = shlex.split(execute(["security", "list-keychains", "-d", "user"], "Read keychain search list").stdout)
+    with tempfile.TemporaryDirectory(prefix="zoitechat-signing-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
+        directory = Path(temporary)
+        keychain = directory / "signing.keychain-db"
+        keychain_password = secrets.token_urlsafe(32)
+        certificate = directory / "signing.p12"
+        api_key = directory / "notary.p8"
+        write_private(certificate, credentials.certificate)
+        write_private(api_key, (credentials.api_key + "\n").encode())
+        try:
+            execute(["security", "create-keychain", "-p", keychain_password, keychain], "Create signing keychain")
+            execute(["security", "set-keychain-settings", "-lut", "21600", keychain], "Configure signing keychain")
+            execute(["security", "unlock-keychain", "-p", keychain_password, keychain], "Unlock signing keychain")
+            # Include both public Developer ID intermediates so signing does not
+            # depend on the runner having cached the leaf certificate's issuer.
+            for name in ("DeveloperIDCA.cer", "DeveloperIDG2CA.cer"):
+                intermediate = directory / name
+                try:
+                    with urllib.request.urlopen("https://www.apple.com/certificateauthority/" + name, timeout=60) as response:
+                        write_private(intermediate, response.read())
+                except OSError:
+                    raise RuntimeError("Download of Apple's public Developer ID intermediate failed") from None
+                execute(["security", "import", intermediate, "-k", keychain], "Import Developer ID intermediate")
+            execute(["security", "import", certificate, "-P", credentials.password,
+                     "-k", keychain, "-T", "/usr/bin/codesign", "-T", "/usr/bin/security"], "Import signing .p12")
+            execute(["security", "set-key-partition-list", "-S", "apple-tool:,apple:",
+                     "-k", keychain_password, keychain], "Allow non-interactive code signing")
+            execute(["security", "list-keychains", "-d", "user", "-s", keychain, *original], "Add temporary signing keychain")
+            identities = execute(["security", "find-identity", "-v", "-p", "codesigning", keychain], "Find signing identity").stdout
+            yield keychain, api_key, resolve_identity(identities, credentials.identity)
+        finally:
+            # Hosted runners are discarded too, but clean up on every ordinary
+            # success/failure path and restore the original search list.
+            execute(["security", "list-keychains", "-d", "user", "-s", *original], "Restore keychain search list", check=False)
+            if keychain.exists():
+                result = execute(["security", "delete-keychain", keychain], "Delete signing keychain", check=False)
+                if result.returncode:
+                    print("Warning: keychain deletion failed; temporary files will still be removed.", file=sys.stderr)
+
+
+def decode_response(result: subprocess.CompletedProcess[str], operation: str) -> dict:
+    try:
+        response = json.loads(result.stdout)
+    except (json.JSONDecodeError, TypeError):
+        raise RuntimeError(f"{operation} did not return valid JSON (exit {result.returncode})") from None
+    if not isinstance(response, dict):
+        raise RuntimeError(f"{operation} returned an unexpected response")
+    return response
+
+
+def save_json(path: Path, response: dict) -> None:
+    path.write_text(json.dumps(response, indent=2) + "\n")
+
+
+def notarize(app: Path, output: Path, diagnostics: Path, credentials: Credentials, api_key: Path, timeout: str) -> None:
+    diagnostics.mkdir(parents=True, exist_ok=True)
+    authentication = ["--key", str(api_key), "--key-id", credentials.key_id, "--issuer", credentials.issuer]
+    with tempfile.TemporaryDirectory(prefix="zoitechat-notary-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
+        submission_zip = Path(temporary) / "ZoiteChat-submission.zip"
+        execute(["ditto", "-c", "-k", "--keepParent", app, submission_zip], "Package notarization submission")
+        result = execute(["xcrun", "notarytool", "submit", submission_zip, *authentication,
+                          "--output-format", "json"], "Submit notarization", check=False)
+        submission = decode_response(result, "Notarization submission")
+        save_json(diagnostics / "submission.json", submission)
+        if result.returncode or not submission.get("id"):
+            raise RuntimeError("Apple rejected the notarization submission; see submission.json")
+        try:
+            submission_id = str(uuid.UUID(submission["id"]))
+        except (ValueError, TypeError, AttributeError):
+            raise RuntimeError("Apple returned an invalid notarization submission ID") from None
+        print(f"Notarization submitted: {submission_id}", flush=True)
+        waited = execute(["xcrun", "notarytool", "wait", submission_id, *authentication,
+                          "--timeout", timeout, "--output-format", "json"], "Wait for notarization", check=False)
+        try:
+            status = decode_response(waited, "Notarization wait")
+        except RuntimeError:
+            status = {"id": submission_id, "status": "Unknown", "exit_code": waited.returncode}
+        save_json(diagnostics / "status.json", status)
+        # Apple can provide a diagnostic log after processing. Fetch it for both
+        # successful and rejected submissions; never include credential files.
+        execute(["xcrun", "notarytool", "log", submission_id, *authentication,
+                 diagnostics / "notary-log.json"], "Fetch notarization log", check=False)
+        if waited.returncode or status.get("status") != "Accepted":
+            raise RuntimeError("Notarization was not accepted or exceeded the wait limit; see the notarization diagnostic artifact. No release ZIP will be published")
+        execute(["xcrun", "stapler", "staple", app], "Staple notarization ticket")
+        execute(["xcrun", "stapler", "validate", app], "Validate notarization ticket")
+        execute(["codesign", "--verify", "--deep", "--strict", "--verbose=2", app], "Verify stapled app signature")
+        execute(["spctl", "--assess", "--type", "execute", "--verbose=2", app], "Assess Gatekeeper acceptance")
+        output.parent.mkdir(parents=True, exist_ok=True)
+        # Repack only after stapling. The submission ZIP is not the distributable ZIP.
+        execute(["ditto", "-c", "-k", "--keepParent", app, output], "Package notarized release")
+    print(f"Signed and notarized release: {output}", flush=True)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--check-config", action="store_true", help="Validate release settings without accessing Apple or a keychain")
+    parser.add_argument("--app", type=Path, default=Path("dist/ZoiteChat.app"))
+    parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat-signed-notarized.zip"))
+    parser.add_argument("--diagnostics", type=Path, default=Path("dist/notarization"))
+    parser.add_argument("--notary-timeout", default="60m")
+    args = parser.parse_args()
+    credentials = Credentials.from_environment()
+    if args.check_config:
+        print("Release signing and notarization settings are present and correctly formatted.")
+        return
+    if platform.system() != "Darwin":
+        parser.error("Signing/notarization requires the macOS runner and Xcode command-line tools")
+    if not args.app.is_dir() or args.output.exists():
+        parser.error("Provide a built .app and an output ZIP path that does not already exist")
+    if not re.fullmatch(r"[1-9]\d*[smh]", args.notary_timeout):
+        parser.error("Use a positive notarization timeout, such as 60m")
+    with signing_keychain(credentials) as (keychain, api_key, identity):
+        sign(args.app.resolve(), identity, Path(__file__).with_name("direct.entitlements"), keychain=keychain)
+        notarize(args.app.resolve(), args.output.resolve(), args.diagnostics.resolve(), credentials, api_key, args.notary_timeout)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, OSError):
+        # RuntimeError messages are authored above and do not contain secret argv.
+        error = sys.exc_info()[1]
+        if isinstance(error, RuntimeError):
+            sys.exit(f"macOS release failed: {error}")
+        sys.exit("macOS release failed: file or network operation failed")
+    except subprocess.CalledProcessError:
+        sys.exit("macOS release failed: code signing or bundle audit failed")

packaging/macos/smoke.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Run the relocated bundle with temporary settings and no IRC auto-connect."""
+from __future__ import annotations
+import argparse
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("app", type=Path)
+    args = parser.parse_args()
+    with tempfile.TemporaryDirectory(prefix="zoitechat-macos-smoke-") as directory:
+        # Include spaces to exercise dyld and GTK module-cache path handling.
+        app = Path(directory) / "Relocated App" / "ZoiteChat.app"
+        shutil.copytree(args.app.resolve(), app)
+        binary = app / "Contents/MacOS/zoitechat"
+        subprocess.run(["codesign", "--verify", "--deep", "--strict", str(app)], check=True)
+        subprocess.run([str(binary), "--version"], check=True, timeout=30)
+        config = Path(directory) / "test-config"
+        with (Path(directory) / "startup.log").open("w+") as log:
+            process = subprocess.Popen([str(binary), "--no-auto", "--cfgdir", str(config)], stdout=log, stderr=log)
+            try:
+                process.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                # Stop the isolated process after checking for early startup failure.
+                process.terminate()
+                try:
+                    process.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    process.kill()
+                    process.wait()
+                    raise RuntimeError("GUI startup process did not terminate")
+            else:
+                log.seek(0)
+                raise RuntimeError(f"GUI exited before smoke interval (code {process.returncode}):\n{log.read()}")
+            log.seek(0)
+            messages = log.read()
+            print(messages)
+            for failure in ("Library not loaded:", "Symbol not found:", "cannot open display", "Cannot load bundled HTTPS trust database", "Bundled emoji font is missing", "Cannot relocate", "Error loading plugin:"):
+                if failure.lower() in messages.lower():
+                    raise RuntimeError(f"Startup failure found: {failure}")
+        print("Relocated bundle stayed running for 10 seconds; manual interaction testing is still required.")
+
+
+if __name__ == "__main__":
+    main()

packaging/macos/store-experimental.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>com.apple.security.app-sandbox</key><true/>
+  <key>com.apple.security.network.client</key><true/>
+  <!-- DCC listening sockets and the optional ident service. -->
+  <key>com.apple.security.network.server</key><true/>
+  <key>com.apple.security.files.user-selected.read-write</key><true/>
+  <key>com.apple.security.files.downloads.read-write</key><true/>
+</dict></plist>

packaging/macos/tests/test_bundle.py

@@ -0,0 +1,125 @@
+"""Dependency parsing, relocation guards and release audit tests without a Mac SDK."""
+from pathlib import Path
+import shutil
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import bundle
+
+
+class BundleTests(unittest.TestCase):
+    @unittest.skipUnless(sys.platform == "darwin", "requires Apple's Mach-O tools")
+    def test_signed_binary_relocation_and_resigning(self):
+        with tempfile.TemporaryDirectory(prefix="zoitechat relocation ") as temporary:
+            directory = Path(temporary)
+            library_source = directory / "answer.c"
+            library_source.write_text("int answer(void) { return 42; }\n")
+            library = directory / "libanswer.dylib"
+            main_source = directory / "main.c"
+            main_source.write_text(
+                "#include <stdio.h>\n"
+                "extern int answer(void);\n"
+                "int main(void) { printf(\"%d\\n\", answer()); return 0; }\n"
+            )
+            executable = directory / "original"
+            bundle.run("xcrun", "clang", "-dynamiclib", "-Wl,-headerpad_max_install_names",
+                       "-Wl,-install_name," + str(library), library_source, "-o", library)
+            bundle.run("xcrun", "clang", "-Wl,-headerpad_max_install_names",
+                       "-Wl,-rpath," + str(directory), main_source, library, "-o", executable)
+            for binary in (library, executable):
+                bundle.run("codesign", "--force", "--sign", "-", binary)
+            app = directory / "Test.app"
+            target = app / "Contents/MacOS/zoitechat"
+            target.parent.mkdir(parents=True)
+            shutil.copy2(executable, target)
+            relocator = bundle.Relocator(app, executable)
+            relocator.relocate(executable, target)
+            # Remove the original dependency so execution proves relocation.
+            library.unlink()
+            for binary in (app / "Contents/Frameworks/libanswer.dylib", target):
+                bundle.run("codesign", "--force", "--sign", "-", binary)
+                bundle.run("codesign", "--verify", "--strict", binary)
+            self.assertEqual(bundle.run(target), "42")
+            self.assertEqual(len(bundle.audit(app)["mach_o"]), 2)
+
+    def test_otool_preserves_paths_with_spaces(self):
+        output = "app:\n\t/opt/Build Dependencies/lib/liba.dylib (compatibility version 1.0.0, current version 1.0.0)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1.0.0)"
+        with patch.object(bundle, "run", return_value=output):
+            self.assertEqual(bundle.dependencies(Path("app")), ["/opt/Build Dependencies/lib/liba.dylib", "/usr/lib/libSystem.B.dylib"])
+
+    def test_lc_rpaths_preserve_spaces(self):
+        with patch.object(bundle, "run", return_value="cmd LC_RPATH\n cmdsize 48\n path @loader_path/../Build Dependencies (offset 12)\n"):
+            self.assertEqual(bundle.rpaths(Path("app")), ["@loader_path/../Build Dependencies"])
+
+    def test_inherited_rpath_resolution(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            library = directory / "with spaces/libtest.dylib"
+            library.parent.mkdir()
+            library.write_bytes(b"library")
+            self.assertEqual(bundle.resolve_dependency("@rpath/libtest.dylib", directory / "libparent.dylib", directory / "app", [library.parent]), library.resolve())
+
+    def test_unresolved_rpath_fails(self):
+        with self.assertRaisesRegex(RuntimeError, "Cannot resolve"):
+            bundle.resolve_dependency("@rpath/missing.dylib", Path("/tmp/parent"), Path("/tmp/app"), [])
+
+    def test_conflicting_basename_fails(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            sources = [directory / name / "libtest.dylib" for name in ("one", "two")]
+            for source in sources:
+                source.parent.mkdir()
+                source.write_bytes(b"library")
+            relocator = bundle.Relocator(directory / "App.app", directory / "executable")
+            relocator.copy_dependency(sources[0])
+            with self.assertRaisesRegex(RuntimeError, "Conflicting library basename"):
+                relocator.copy_dependency(sources[1])
+
+    def test_audit_rejects_external_symlink(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            app.mkdir()
+            (app / "outside").symlink_to("/usr/lib")
+            with patch.object(bundle, "run", return_value="arm64"), self.assertRaisesRegex(RuntimeError, "External symlink"):
+                bundle.audit(app)
+
+    def test_audit_raises_minimum_for_dependencies(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            binary = app / "Contents/MacOS/zoitechat"
+            library = app / "Contents/Frameworks/libtest.dylib"
+            for path in (binary, library):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(bytes.fromhex("cffaedfe") + b"payload")
+            def fake_run(*args):
+                if args[0] == "lipo":
+                    return "arm64"
+                if args[1] == "-D":
+                    return str(args[2]) + ("\n@rpath/libtest.dylib" if args[2] == library else "")
+                if args[1] == "-L":
+                    name = "@loader_path/../Frameworks/libtest.dylib" if args[2] == binary else "@rpath/libtest.dylib"
+                    return f"{args[2]}:\n\t{name} (compatibility version 1.0.0, current version 1.0.0)"
+                return "cmd LC_BUILD_VERSION\n cmdsize 32\n platform 1\n minos " + ("15.0.1" if args[2] == library else "11.0")
+            with patch.object(bundle, "run", side_effect=fake_run):
+                report = bundle.audit(app)
+            self.assertEqual(report["minimum_macos"], "15.0.1")
+            self.assertEqual(report["architectures"], ["arm64"])
+            self.assertEqual(len(report["mach_o"]), 2)
+
+    def test_audit_rejects_wrong_architecture(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            binary = app / "Contents/MacOS/zoitechat"
+            library = app / "Contents/Frameworks/libtest.dylib"
+            for path in (binary, library):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(bytes.fromhex("cffaedfe"))
+            with patch.object(bundle, "run", side_effect=["arm64", "x86_64"]), self.assertRaisesRegex(RuntimeError, "Architecture mismatch"):
+                bundle.audit(app)
+
+
+if __name__ == "__main__":
+    unittest.main()

packaging/macos/tests/test_release.py

@@ -0,0 +1,153 @@
+"""Release failure gates, private-key handling and notarization result checks."""
+from contextlib import redirect_stdout
+import base64
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import release
+
+FINGERPRINT = "A" * 40
+IDENTITY = "Developer ID Application: Test Only (NOTAREALID)"
+SUBMISSION = "a8c9438a-b972-455e-aedc-278070349394"
+ENVIRONMENT = {
+    "MACOS_CERTIFICATE_P12_BASE64": base64.b64encode(b"not-a-real-certificate").decode(),
+    "MACOS_CERTIFICATE_PASSWORD": "unit-test-password",
+    "MACOS_SIGNING_IDENTITY": IDENTITY,
+    "APPLE_API_KEY_P8": "-----BEGIN PRIVATE KEY-----\nunit-test-only\n-----END PRIVATE KEY-----",
+    "APPLE_API_KEY_ID": "TESTKEY123",
+    "APPLE_API_ISSUER_ID": SUBMISSION,
+}
+
+
+class ReleaseTests(unittest.TestCase):
+    def credentials(self):
+        with patch.dict(os.environ, ENVIRONMENT, clear=True):
+            return release.Credentials.from_environment()
+
+    def test_config_reports_names_and_never_values(self):
+        with patch.dict(os.environ, {}, clear=True), self.assertRaisesRegex(RuntimeError, "MACOS_CERTIFICATE_P12_BASE64"):
+            release.Credentials.from_environment()
+
+    def test_config_accepts_multiline_certificate_base64(self):
+        env = ENVIRONMENT.copy()
+        text = env["MACOS_CERTIFICATE_P12_BASE64"]
+        env["MACOS_CERTIFICATE_P12_BASE64"] = text[:10] + "\n" + text[10:]
+        with patch.dict(os.environ, env, clear=True):
+            self.assertEqual(release.Credentials.from_environment().certificate, b"not-a-real-certificate")
+
+    def test_config_rejects_development_certificate(self):
+        env = {**ENVIRONMENT, "MACOS_SIGNING_IDENTITY": "Apple Development: Test"}
+        with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "Developer ID Application"):
+            release.Credentials.from_environment()
+
+    def test_config_rejects_base64_instead_of_plain_p8(self):
+        env = {**ENVIRONMENT, "APPLE_API_KEY_P8": "not-the-pem-contents"}
+        with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "complete, plain-text"):
+            release.Credentials.from_environment()
+
+    def test_execute_does_not_expose_secret_argv_or_stderr(self):
+        result = subprocess.CompletedProcess([], 1, stdout="", stderr="secret-password")
+        with patch.object(release.subprocess, "run", return_value=result):
+            with self.assertRaises(RuntimeError) as error:
+                release.execute(["security", "import", "-P", "secret-password"], "Import certificate")
+        self.assertNotIn("secret-password", str(error.exception))
+
+    def test_matching_identity_requires_developer_id_and_private_key(self):
+        output = f'  1) {FINGERPRINT} "{IDENTITY}"\n'
+        self.assertEqual(release.resolve_identity(output, IDENTITY), FINGERPRINT)
+        with self.assertRaisesRegex(RuntimeError, "no valid Developer ID"):
+            release.resolve_identity("0 valid identities found", IDENTITY)
+
+    def test_private_files_have_restricted_permissions(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "private.p8"
+            release.write_private(path, b"test-only")
+            self.assertEqual(path.stat().st_mode & 0o777, 0o600)
+
+    def test_keychain_and_private_files_are_cleaned_up_after_signing_failure(self):
+        calls = []
+        def fake_execute(args, operation, **kwargs):
+            calls.append([str(value) for value in args])
+            output = ''
+            if args[:3] == ["security", "list-keychains", "-d"] and len(args) == 4:
+                output = '"/tmp/original.keychain-db"\n'
+            if args[:2] == ["security", "create-keychain"]:
+                Path(args[-1]).touch()
+            if args[:2] == ["security", "find-identity"]:
+                output = f'  1) {FINGERPRINT} "{IDENTITY}"\n'
+            return subprocess.CompletedProcess(args, 0, output, "")
+        temporary_path = None
+        with patch.object(release, "execute", side_effect=fake_execute), patch.object(release.urllib.request, "urlopen", side_effect=lambda *args, **kwargs: io.BytesIO(b"public-test-ca")):
+            with self.assertRaisesRegex(RuntimeError, "test signing failed"):
+                with release.signing_keychain(self.credentials()) as (keychain, api_key, identity):
+                    temporary_path = keychain.parent
+                    self.assertEqual(identity, FINGERPRINT)
+                    self.assertTrue(api_key.is_file())
+                    raise RuntimeError("test signing failed")
+        self.assertFalse(temporary_path.exists())
+        self.assertIn(["security", "list-keychains", "-d", "user", "-s", "/tmp/original.keychain-db"], calls)
+        self.assertTrue(any(call[:2] == ["security", "delete-keychain"] for call in calls))
+
+    def run_notary(self, status, returncode=0):
+        calls = []
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        directory = Path(temporary.name)
+        app = directory / "ZoiteChat.app"
+        app.mkdir()
+        output = directory / "release.zip"
+        diagnostics = directory / "diagnostics"
+        def fake_execute(args, operation, **kwargs):
+            calls.append([str(value) for value in args])
+            text = ""
+            code = 0
+            if args[:3] == ["xcrun", "notarytool", "submit"]:
+                text = json.dumps({"id": SUBMISSION})
+            elif args[:3] == ["xcrun", "notarytool", "wait"]:
+                text = json.dumps({"id": SUBMISSION, "status": status})
+                code = returncode
+            elif args[:3] == ["xcrun", "notarytool", "log"]:
+                Path(args[-1]).write_text('{"issues": []}')
+            elif args[0] == "ditto":
+                Path(args[-1]).write_bytes(b"test-zip")
+            return subprocess.CompletedProcess(args, code, text, "")
+        with patch.object(release, "execute", side_effect=fake_execute), redirect_stdout(io.StringIO()):
+            if status == "Accepted" and not returncode:
+                release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
+            else:
+                with self.assertRaisesRegex(RuntimeError, "not accepted"):
+                    release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
+        return calls, output, diagnostics
+
+    def test_accepted_notarization_staples_and_checks_before_final_zip(self):
+        calls, output, diagnostics = self.run_notary("Accepted")
+        self.assertTrue(output.is_file())
+        staple = next(i for i, call in enumerate(calls) if call[:3] == ["xcrun", "stapler", "staple"])
+        assess = next(i for i, call in enumerate(calls) if call[0] == "spctl")
+        final_zip = max(i for i, call in enumerate(calls) if call[0] == "ditto")
+        self.assertLess(staple, assess)
+        self.assertLess(assess, final_zip)
+        self.assertEqual(json.loads((diagnostics / "status.json").read_text())["status"], "Accepted")
+
+    def test_rejected_notarization_never_staples_or_publishes(self):
+        calls, output, diagnostics = self.run_notary("Invalid")
+        self.assertFalse(output.exists())
+        self.assertTrue((diagnostics / "notary-log.json").is_file())
+        self.assertFalse(any(call[:2] == ["xcrun", "stapler"] for call in calls))
+
+    def test_timeout_retains_submission_id_and_never_publishes(self):
+        calls, output, diagnostics = self.run_notary("In Progress", 1)
+        self.assertFalse(output.exists())
+        self.assertEqual(json.loads((diagnostics / "submission.json").read_text())["id"], SUBMISSION)
+
+
+if __name__ == "__main__":
+    unittest.main()

src/common/cfgfiles.c

@@ -590,6 +590,7 @@ const struct prefs vars[] =
 	{"gui_gtk3_theme", P_OFFSET (hex_gui_gtk3_theme), TYPE_STR},
 	{"text_indent", P_OFFINT (hex_text_indent), TYPE_BOOL},
 	{"text_max_indent", P_OFFINT (hex_text_max_indent), TYPE_INT},
+	{"text_wrap_align", P_OFFINT (hex_text_wrap_align), TYPE_INT},
 	{"text_max_lines", P_OFFINT (hex_text_max_lines), TYPE_INT},
 	{"text_replay", P_OFFINT (hex_text_replay), TYPE_BOOL},
 	{"text_search_case_match", P_OFFINT (hex_text_search_case_match), TYPE_BOOL},
@@ -881,6 +882,7 @@ load_default_config(void)
 	prefs.hex_net_reconnect_delay = 10;
 	prefs.hex_notify_timeout = 15;
 	prefs.hex_text_max_indent = 256;
+	prefs.hex_text_wrap_align = 0;
 	prefs.hex_text_max_lines = 5000;
 	prefs.hex_url_grabber_limit = 100; 		/* 0 means unlimited */
 

src/common/ignore.c

@@ -271,7 +271,7 @@ ignore_read_next_entry (char *my_cfg, struct ignore *ignore)
 }
 
 void
-ignore_load ()
+ignore_load (void)
 {
 	struct ignore *ignore;
 	struct stat st;
@@ -302,7 +302,7 @@ ignore_load ()
 }
 
 void
-ignore_save ()
+ignore_save (void)
 {
 	char buf[1024];
 	int fh;

src/common/macos.c

@@ -0,0 +1,127 @@
+/* Relocate resources before GTK, Fontconfig, GIO or OpenSSL initialize.
+ * GPL-2.0-or-later; see COPYING. */
+#include "config.h"
+#include "macos.h"
+#include <gio/gio.h>
+#include <mach-o/dyld.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *locale_dir;
+
+static void
+set_path (const char *variable, const char *base, const char *relative)
+{
+    char *path = g_build_filename (base, relative, NULL);
+    g_setenv (variable, path, TRUE);
+    g_free (path);
+}
+
+static void
+relocate_cache (const char *resources, const char *name, const char *variable)
+{
+    char *input = g_build_filename (resources, name, NULL);
+    char *contents = NULL;
+    GError *error = NULL;
+
+    if (g_file_get_contents (input, &contents, NULL, &error))
+    {
+        /* GTK cache files require absolute module paths. Write only data to
+         * the user cache, never into the signed/read-only application bundle. */
+        char **parts = g_strsplit (contents, "@ZOITECHAT_RESOURCES@", -1);
+        char *escaped = g_strescape (resources, NULL);
+        char *relocated = g_strjoinv (escaped, parts);
+        g_free (escaped);
+        char *digest = g_compute_checksum_for_string (G_CHECKSUM_SHA256, relocated, -1);
+        char *directory = g_build_filename (g_get_user_cache_dir (), "zoitechat", "modules", digest, NULL);
+        char *output = g_build_filename (directory, name, NULL);
+        if (g_mkdir_with_parents (directory, 0700) == 0 &&
+            g_file_set_contents (output, relocated, -1, &error))
+            g_setenv (variable, output, TRUE);
+        else
+            g_warning ("Cannot relocate %s: %s", name, error ? error->message : "cannot create cache directory");
+        g_free (output);
+        g_free (directory);
+        g_free (digest);
+        g_free (relocated);
+        g_strfreev (parts);
+    }
+    else
+        g_warning ("Cannot read %s: %s", input, error->message);
+    g_clear_error (&error);
+    g_free (contents);
+    g_free (input);
+}
+
+void
+zoitechat_macos_init (void)
+{
+    uint32_t size = 0;
+    char *raw, *executable, *macos, *contents, *resources, *marker;
+    char *ca;
+    GTlsDatabase *database;
+    GError *error = NULL;
+
+    _NSGetExecutablePath (NULL, &size);
+    raw = g_malloc (size);
+    if (_NSGetExecutablePath (raw, &size) != 0)
+    {
+        g_free (raw);
+        return;
+    }
+    executable = realpath (raw, NULL);
+    g_free (raw);
+    if (!executable)
+        return;
+    macos = g_path_get_dirname (executable);
+    free (executable);
+    contents = g_path_get_dirname (macos);
+    resources = g_build_filename (contents, "Resources", NULL);
+    marker = g_build_filename (resources, "zoitechat-bundle", NULL);
+    g_free (macos);
+    g_free (contents);
+    if (!g_file_test (marker, G_FILE_TEST_IS_REGULAR))
+    {
+        g_free (marker);
+        g_free (resources);
+        return; /* Ordinary Meson installs and build-tree runs retain their paths. */
+    }
+    g_free (marker);
+    g_setenv ("GDK_BACKEND", "quartz", TRUE);
+    set_path ("ZOITECHAT_MACOS_SHARE", resources, "share");
+    set_path ("XDG_DATA_DIRS", resources, "share");
+    set_path ("GSETTINGS_SCHEMA_DIR", resources, "share/glib-2.0/schemas");
+    set_path ("FONTCONFIG_FILE", resources, "fonts.conf");
+    set_path ("GIO_EXTRA_MODULES", resources, "lib/gio/modules");
+    set_path ("GIO_MODULE_DIR", resources, "lib/gio/modules");
+    set_path ("ZOITECHAT_LIBDIR", resources, "lib/zoitechat/plugins");
+    set_path ("ZOITECHAT_EMOJI_FONT", resources, "share/fonts/zoitechat/NotoColorEmoji.ttf");
+    set_path ("ZOITECHAT_ENCHANT_LIBRARY", resources, "lib/libenchant-2.dylib");
+    g_setenv ("ZOITECHAT_ENCHANT_PREFIX", resources, TRUE);
+    set_path ("SSL_CERT_FILE", resources, "certs/ca-bundle.crt");
+    set_path ("OPENSSL_MODULES", resources, "lib/ossl-modules");
+    locale_dir = g_build_filename (resources, "share/locale", NULL);
+    relocate_cache (resources, "pixbuf-loaders.cache", "GDK_PIXBUF_MODULE_FILE");
+    relocate_cache (resources, "gtk-immodules.cache", "GTK_IM_MODULE_FILE");
+
+    /* HTTPS previews use GIO; IRC uses OpenSSL. Give both the same CA set. */
+    ca = g_build_filename (resources, "certs/ca-bundle.crt", NULL);
+    database = g_tls_file_database_new (ca, &error);
+    if (database)
+    {
+        g_tls_backend_set_default_database (g_tls_backend_get_default (), database);
+        g_object_unref (database);
+    }
+    else
+        g_warning ("Cannot load bundled HTTPS trust database: %s", error->message);
+    g_clear_error (&error);
+    g_free (ca);
+    g_free (resources);
+}
+
+const char *
+zoitechat_macos_locale_dir (void)
+{
+    return locale_dir ? locale_dir : LOCALEDIR;
+}

src/common/macos.h

@@ -0,0 +1,6 @@
+/* macOS bundle runtime; GPL-2.0-or-later, see COPYING. */
+#ifndef ZOITECHAT_MACOS_H
+#define ZOITECHAT_MACOS_H
+void zoitechat_macos_init (void);
+const char *zoitechat_macos_locale_dir (void);
+#endif

src/common/meson.build

@@ -29,6 +29,10 @@ common_sources = [
   'util.c'
 ]
 
+if host_machine.system() == 'darwin'
+  common_sources += 'macos.c'
+endif
+
 secretstore_sources = files('secretstore.c')
 
 common_sysinfo_deps = []
@@ -155,12 +159,19 @@ zoitechat_common = static_library('zoitechatcommon',
   pic: true
 )
 
+# zoitechat.h exposes OpenSSL types whenever TLS is enabled. Propagate its
+# header requirements even to standalone consumers that do not call OpenSSL.
+zoitechat_common_header_deps = [libgio_dep]
+if libssl_dep.found()
+  zoitechat_common_header_deps += libssl_dep.partial_dependency(compile_args: true, includes: true)
+endif
+
 zoitechat_common_dep = declare_dependency(
   sources: [textevents, public_suffix_data] + marshal,
   link_with: zoitechat_common,
   include_directories: common_includes,
   compile_args: common_cflags,
-  dependencies: libgio_dep,
+  dependencies: zoitechat_common_header_deps,
 )
 
 zoitechat_plugin_dep = declare_dependency(
@@ -176,7 +187,7 @@ gtk3_theme_service_tests = executable('gtk3_theme_service_tests',
     'gtk3-theme-service.c',
   ],
   include_directories: [config_h_include, include_directories('.')],
-  dependencies: [libgio_dep] + (libarchive_dep.found() ? [libarchive_dep] : []),
+  dependencies: zoitechat_common_header_deps + (libarchive_dep.found() ? [libarchive_dep] : []),
 )
 
 test('GTK3 Theme Service Tests', gtk3_theme_service_tests,

src/common/notify.c

@@ -662,7 +662,7 @@ notify_isnotify (struct session *sess, char *name)
 }
 
 void
-notify_cleanup ()
+notify_cleanup (void)
 {
 	GSList *list = notify_list;
 	GSList *nslist, *srvlist;

src/common/proto-irc.c

@@ -1288,6 +1288,11 @@ process_named_msg (session *sess, char *type, char *word[], char *word_eol[],
 					char *user = net && net->user ? net->user : prefs.hex_irc_user_name;
 
 					response = challengeauth_response (user, serv->password, word[5]);
+					if (response == NULL)
+					{
+						PrintTextf (serv->server_session, _("Error building CHALLENGEAUTH for %s"), user);
+						return;
+					}
 
 					tcp_sendf (serv, "PRIVMSG %s :CHALLENGEAUTH %s %s %s\r\n",
 						CHALLENGEAUTH_NICK,

src/common/text.c

@@ -1808,7 +1808,7 @@ pevent_check_all_loaded (void)
 }
 
 void
-load_text_events ()
+load_text_events (void)
 {
 	memset (&pntevts_text, 0, sizeof (char *) * (NUM_XP));
 	memset (&pntevts, 0, sizeof (char *) * (NUM_XP));
@@ -2488,7 +2488,7 @@ sound_load_event (char *evt, char *file)
 }
 
 void
-sound_load ()
+sound_load (void)
 {
 	int fd;
 	char buf[512];
@@ -2521,7 +2521,7 @@ sound_load ()
 }
 
 void
-sound_save ()
+sound_save (void)
 {
 	int fd, i;
 	char buf[512];

src/common/util.c

@@ -1453,7 +1453,7 @@ challengeauth_response (const char *username, const char *password, const char *
 	char *passhash;
 	char *key;
 	char *keyhash;
-	unsigned char *digest;
+	unsigned char digest[SHA256_DIGEST_LENGTH];
 	GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH * 2);
 
 	user = rfc_strlower (username); /* convert username to lowercase as per the RFC */
@@ -1469,7 +1469,12 @@ challengeauth_response (const char *username, const char *password, const char *
 	keyhash = str_sha256hash (key);
 	g_free (key);
 
-	digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);
+	if (HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), digest, NULL) == NULL)
+	{
+		g_free (keyhash);
+		g_string_free (buf, TRUE);
+		return NULL;
+	}
 	g_free (keyhash);
 
 	for (i = 0; i < SHA256_DIGEST_LENGTH; i++)

src/common/zoitechat.c

@@ -54,6 +54,9 @@
 #include "text.h"
 #include "url.h"
 #include "zoitechatc.h"
+#ifdef __APPLE__
+#include "macos.h"
+#endif
 
 #if ! GLIB_CHECK_VERSION (2, 36, 0)
 #include <glib-object.h>			/* for g_type_init() */
@@ -1172,6 +1175,10 @@ main (int argc, char *argv[])
 	int i;
 	int ret;
 
+#ifdef __APPLE__
+	zoitechat_macos_init ();
+#endif
+
 #ifdef WIN32
 	HRESULT coinit_result;
 #endif

src/common/zoitechat.h

@@ -306,6 +306,7 @@ struct zoitechatprefs
 	int hex_net_reconnect_delay;
 	int hex_notify_timeout;
 	int hex_text_max_indent;
+	int hex_text_wrap_align;
 	int hex_text_max_lines;
 	int hex_url_grabber_limit;
 

src/fe-gtk/fe-gtk.c

@@ -21,6 +21,9 @@
 #include <stdlib.h>
 
 #include "fe-gtk.h"
+#ifdef __APPLE__
+#include "../common/macos.h"
+#endif
 
 #ifdef GDK_WINDOWING_WIN32
 #include <gdk/gdkwin32.h>
@@ -372,7 +375,13 @@ fe_args (int argc, char *argv[])
 	g_free (locale_path);
 	g_free (base_path);
 #else
-	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
+	bindtextdomain (GETTEXT_PACKAGE,
+#ifdef __APPLE__
+		zoitechat_macos_locale_dir ()
+#else
+		LOCALEDIR
+#endif
+	);
 #endif
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
 	textdomain (GETTEXT_PACKAGE);
@@ -493,6 +502,15 @@ fe_args (int argc, char *argv[])
 #endif
 	gtk_init (&argc, &argv);
 
+#ifdef __APPLE__
+	if (g_getenv ("ZOITECHAT_MACOS_SHARE"))
+	{
+		char *icons = g_build_filename (g_getenv ("ZOITECHAT_MACOS_SHARE"), "icons", NULL);
+		gtk_icon_theme_prepend_search_path (gtk_icon_theme_get_default (), icons);
+		g_free (icons);
+	}
+#endif
+
 #ifdef WIN32
 	win32_configure_icon_theme ();
 #endif

src/fe-gtk/fkeys.c

@@ -426,7 +426,7 @@ key_binding_is_builtin (struct key_binding *kb)
 }
 
 void
-key_init ()
+key_init (void)
 {
 	if (key_load_kbs () == 1)
 	{
@@ -1219,7 +1219,7 @@ key_dialog_load (GtkListStore *store)
 }
 
 void
-key_dialog_show ()
+key_dialog_show (void)
 {
 	GtkWidget *vbox, *box, *pane, *scroll;
 	GtkWidget *view, *xtext, *delete_button;

src/fe-gtk/ignoregui.c

@@ -336,7 +336,7 @@ ignore_stats_entry (GtkWidget * box, char *label, int value)
 }
 
 void
-ignore_gui_open ()
+ignore_gui_open (void)
 {
 	GtkWidget *vbox, *box, *stat_box, *frame;
 	GtkWidget *view;

src/fe-gtk/maingui.c

@@ -297,40 +297,6 @@ mg_color_component_to_pango (double value)
 	return (guint16)(value * 65535.0 + 0.5);
 }
 
-static void
-mg_apply_font_css (GtkWidget *widget, const PangoFontDescription *desc,
-				   const char *class_name, const char *provider_key)
-{
-	GtkStyleContext *context;
-	GtkCssProvider *provider;
-	GString *css;
-
-	if (!widget || !desc)
-		return;
-
-	context = gtk_widget_get_style_context (widget);
-	if (!context)
-		return;
-
-	provider = g_object_get_data (G_OBJECT (widget), provider_key);
-	if (!provider)
-	{
-		provider = gtk_css_provider_new ();
-		g_object_set_data_full (G_OBJECT (widget), provider_key, provider, g_object_unref);
-	}
-
-	css = g_string_new (".");
-	g_string_append (css, class_name);
-	g_string_append (css, " {");
-	gtkutil_append_font_css (css, desc);
-	g_string_append (css, " }");
-	gtk_css_provider_load_from_data (provider, css->str, -1, NULL);
-	g_string_free (css, TRUE);
-
-	gtk_style_context_add_class (context, class_name);
-	theme_css_apply_widget_provider (widget, GTK_STYLE_PROVIDER (provider));
-}
-
 static void
 mg_set_label_alignment_start (GtkWidget *widget)
 {

src/fe-gtk/menu.c

@@ -1962,7 +1962,10 @@ menu_about (GtkWidget *wid, gpointer sess)
 	gtk_about_dialog_set_logo (dialog, pix_zoitechat);
 	gtk_about_dialog_set_copyright (dialog, "\302\251 1998-2010 Peter \305\275elezn\303\275\n\302\251 2009-2014 Berke Viktor\n\302\251 2015-2025 Patrick Griffis\n\302\251 2026 deepend");
 	gtk_about_dialog_set_comments (dialog, comment);
+	/* Preserve the About dialog's existing action-area button layout. */
+	G_GNUC_BEGIN_IGNORE_DEPRECATIONS
 	actions = gtk_dialog_get_action_area (GTK_DIALOG (dialog));
+	G_GNUC_END_IGNORE_DEPRECATIONS
 	children = gtk_container_get_children (GTK_CONTAINER (actions));
 	for (child = children; child; child = child->next)
 		gtk_widget_destroy (GTK_WIDGET (child->data));

src/fe-gtk/meson.build

@@ -53,6 +53,15 @@ zoitechat_gtk_deps = [
 
 gtk_dep = dependency('gtk+-3.0', version: '>= 3.22')
 
+# Standalone GTK tests also include the common application's headers.
+gtk_dep = declare_dependency(dependencies: [gtk_dep] + zoitechat_common_header_deps)
+
+# fe-gtk.h exposes GtkosxApplication to every GTK consumer when enabled.
+# Theme libraries and standalone UI tests need the same headers as the app.
+if host_machine.system() == 'darwin' and gtk_mac_dep.found()
+  gtk_dep = declare_dependency(dependencies: [gtk_dep, gtk_mac_dep])
+endif
+
 zoitechat_theme_deps = [gtk_dep, zoitechat_common_dep]
 
 if host_machine.system() != 'windows'
@@ -91,12 +100,18 @@ if host_machine.system() != 'windows'
 endif
 
 zoitechat_gtk_ldflags = []
+zoitechat_gtk_objcflags = []
 
 if host_machine.system() == 'windows'
   zoitechat_gtk_sources += 'notifications/notification-windows.c'
   zoitechat_gtk_deps += cc.find_library('dwmapi', required: true)
   zoitechat_theme_deps += cc.find_library('dwmapi', required: true)
 
+elif host_machine.system() == 'darwin'
+  add_languages('objc', required: true)
+  zoitechat_gtk_sources += 'notifications/notification-osx.m'
+  zoitechat_gtk_deps += dependency('appleframeworks', modules: ['Cocoa', 'UserNotifications'])
+  zoitechat_gtk_objcflags += '-fobjc-arc'
 else
   zoitechat_gtk_sources += 'notifications/notification-freedesktop.c'
 endif
@@ -137,6 +152,7 @@ executable('zoitechat',
   dependencies: zoitechat_gtk_deps,
   link_with: zoitechat_theme_lib,
   c_args: zoitechat_gtk_cflags,
+  objc_args: zoitechat_gtk_objcflags,
   link_args: zoitechat_gtk_ldflags,
   pie: true,
   install: true,

src/fe-gtk/notifications/notification-osx.m

@@ -1,54 +1,67 @@
-/* ZoiteChat
+/* Native macOS notifications; GPL-2.0-or-later, see COPYING. */
- * Copyright (C) 2015 Patrick Griffis.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
 #import <Cocoa/Cocoa.h>
-#include <gtkosxapplication.h>
+#import <UserNotifications/UserNotifications.h>
 
-void
+@interface ZoiteChatNotificationDelegate : NSObject <UNUserNotificationCenterDelegate>
-notification_backend_show (const char *title, const char *text)
+@end
+@implementation ZoiteChatNotificationDelegate
+- (void)userNotificationCenter:(UNUserNotificationCenter *)center
+      willPresentNotification:(UNNotification *)notification
+        withCompletionHandler:(void (^)(UNNotificationPresentationOptions))completionHandler
 {
-	NSString *str_title = [[NSString alloc] initWithUTF8String:title];
+    completionHandler(UNNotificationPresentationOptionBanner | UNNotificationPresentationOptionSound);
-	NSString *str_text = [[NSString alloc] initWithUTF8String:text];
+}
+@end
 
-	NSUserNotification *userNotification = [NSUserNotification new];
+static ZoiteChatNotificationDelegate *notification_delegate;
-	userNotification.title = str_title;
-	userNotification.informativeText = str_text;
 
-	NSUserNotificationCenter *center = [NSUserNotificationCenter defaultUserNotificationCenter];
+int
-	[center scheduleNotification:userNotification];
+notification_backend_supported (void)
-
+{
-	[str_title release];
+    return [[NSBundle mainBundle] bundleIdentifier] != nil;
-	[str_text release];
 }
 
 int
 notification_backend_init (const char **error)
 {
-	return 1;
+    if (!notification_backend_supported ())
+    {
+        *error = "macOS notifications require an application bundle";
+        return 0;
+    }
+    notification_delegate = [ZoiteChatNotificationDelegate new];
+    [UNUserNotificationCenter currentNotificationCenter].delegate = notification_delegate;
+    return 1;
+}
+
+void
+notification_backend_show (const char *title, const char *text)
+{
+    UNMutableNotificationContent *content = [UNMutableNotificationContent new];
+    content.title = [NSString stringWithUTF8String:title] ?: @"ZoiteChat";
+    content.body = [NSString stringWithUTF8String:text] ?: @"";
+    UNUserNotificationCenter *center = [UNUserNotificationCenter currentNotificationCenter];
+    /* Ask only when the user first needs a notification, without blocking GTK. */
+    [center requestAuthorizationWithOptions:UNAuthorizationOptionAlert | UNAuthorizationOptionSound
+        completionHandler:^(BOOL granted, NSError *error) {
+            if (granted)
+            {
+                UNNotificationRequest *request = [UNNotificationRequest
+                    requestWithIdentifier:[[NSUUID UUID] UUIDString] content:content trigger:nil];
+                [center addNotificationRequest:request withCompletionHandler:^(NSError *deliveryError) {
+                    if (deliveryError)
+                        NSLog(@"ZoiteChat notification failed: %@", deliveryError);
+                }];
+            }
+            else if (error)
+                NSLog(@"ZoiteChat notification authorization failed: %@", error);
+        }];
 }
 
 void
 notification_backend_deinit (void)
 {
-}
+    if (notification_delegate)
-
+        [UNUserNotificationCenter currentNotificationCenter].delegate = nil;
-int
+    notification_delegate = nil;
-notification_backend_supported (void)
-{
-	return gtkosx_application_get_bundle_id () != NULL;
 }

src/fe-gtk/setup.c

@@ -59,6 +59,8 @@ static struct zoitechatprefs setup_prefs;
 static GtkWidget *cancel_button;
 static GtkWidget *font_dialog = NULL;
 static GtkWidget *setup_topicbar_multiline_toggle = NULL;
+static GtkWidget *setup_wrap_align_label = NULL;
+static GtkWidget *setup_wrap_align_combo = NULL;
 
 enum
 {
@@ -157,6 +159,14 @@ static const char *const langsmenu[] =
 };
 #endif
 
+static const char *const wrapalignmenu[] =
+{
+        N_("Start of line (default)"),
+        N_("Prefix (nick name)"),
+        N_("Message"),
+        NULL
+};
+
 static const setting appearance_settings[] =
 {
         {ST_HEADER,     N_("General"),0,0,0},
@@ -172,6 +182,7 @@ static const setting appearance_settings[] =
         {ST_TOGGLR, N_("Indent nick names"), P_OFFINTNL(hex_text_indent), N_("Make nick names right-justified"),0,0},
         {ST_TOGGLE, N_ ("Show marker line"), P_OFFINTNL (hex_text_show_marker), N_ ("Insert a red line after the last read text."), 0, 0},
         {ST_TOGGLE, N_("Keep search position when closing"), P_OFFINTNL(hex_text_search_keep_position), 0, 0, 0},
+        {ST_MENU,   N_("Align wrapped lines under:"), P_OFFINTNL(hex_text_wrap_align), N_("Where wrapped lines start when nick names are not indented"), wrapalignmenu, 0},
 
         {ST_HEADER,     N_("Timestamps"),0,0,0},
         {ST_TOGGLE, N_("Enable timestamps"), P_OFFINTNL(hex_stamp_text),0,0,1},
@@ -857,6 +868,20 @@ setup_topicbar_inline_toggled_cb (GtkToggleButton *but, gpointer userdata)
                         !gtk_toggle_button_get_active (but));
 }
 
+static void
+setup_text_indent_toggled_cb (GtkToggleButton *but, gpointer userdata)
+{
+        gboolean sens = !gtk_toggle_button_get_active (but);
+
+        (void) userdata;
+
+        /* wrapped line alignment only applies without nick indentation */
+        if (setup_wrap_align_label)
+                gtk_widget_set_sensitive (setup_wrap_align_label, sens);
+        if (setup_wrap_align_combo)
+                gtk_widget_set_sensitive (setup_wrap_align_combo, sens);
+}
+
 static void
 setup_create_toggleR (GtkWidget *tab, int row, const setting *set)
 {
@@ -867,6 +892,9 @@ setup_create_toggleR (GtkWidget *tab, int row, const setting *set)
                                                                                         setup_get_int (&setup_prefs, set));
         g_signal_connect (G_OBJECT (wid), "toggled",
                                                         G_CALLBACK (setup_toggle_cb), (gpointer)set);
+        if (set->offset == STRUCT_OFFSET_INT (struct zoitechatprefs, hex_text_indent))
+                g_signal_connect (G_OBJECT (wid), "toggled",
+                                                        G_CALLBACK (setup_text_indent_toggled_cb), NULL);
         if (set->tooltip)
                 gtk_widget_set_tooltip_text (wid, _(set->tooltip));
         setup_table_attach (tab, wid, 4, 5, row, row + 1, TRUE, FALSE,
@@ -1279,6 +1307,16 @@ setup_create_menu (GtkWidget *table, int row, const setting *set)
 
         setup_table_attach (table, cbox, 3, 6, row, row + 1, TRUE, FALSE,
                             SETUP_ALIGN_FILL, SETUP_ALIGN_FILL, 0, 0);
+
+        if (set->offset == STRUCT_OFFSET_INT (struct zoitechatprefs, hex_text_wrap_align))
+        {
+                setup_wrap_align_label = wid;
+                setup_wrap_align_combo = cbox;
+                g_object_add_weak_pointer (G_OBJECT (wid), (gpointer *)&setup_wrap_align_label);
+                g_object_add_weak_pointer (G_OBJECT (cbox), (gpointer *)&setup_wrap_align_combo);
+                gtk_widget_set_sensitive (wid, !setup_prefs.hex_text_indent);
+                gtk_widget_set_sensitive (cbox, !setup_prefs.hex_text_indent);
+        }
 }
 
 static void

src/fe-gtk/sexy-spell-entry.c

@@ -215,7 +215,22 @@ initialize_enchant (void)
 #endif
     };
 
-    for (i = 0; i < G_N_ELEMENTS(libnames); ++i)
+#ifdef __APPLE__
+    const char *bundled_enchant = g_getenv ("ZOITECHAT_ENCHANT_LIBRARY");
+    if (bundled_enchant && *bundled_enchant)
+    {
+        enchant = g_module_open (bundled_enchant, 0);
+        if (enchant)
+        {
+            void (*set_prefix) (const char *) = NULL;
+            const char *prefix = g_getenv ("ZOITECHAT_ENCHANT_PREFIX");
+            if (prefix && g_module_symbol (enchant, "enchant_set_prefix_dir", (gpointer *) &set_prefix))
+                set_prefix (prefix);
+            have_enchant = TRUE;
+        }
+    }
+#endif
+    for (i = 0; !have_enchant && i < G_N_ELEMENTS(libnames); ++i)
     {
         enchant = g_module_open(libnames[i], 0);
         if (enchant)

src/fe-gtk/textgui.c

@@ -92,7 +92,7 @@ PrintTextLine (xtext_buffer *xtbuf, unsigned char *text, int len, int indent, ti
 			memcpy (new_text, stamp, stamp_size);
 			g_free (stamp);
 			memcpy (new_text + stamp_size, text, len);
-			gtk_xtext_append (xtbuf, new_text, len + stamp_size, timet);
+			gtk_xtext_append_wrap (xtbuf, new_text, len + stamp_size, timet, stamp_size);
 			g_free (new_text);
 		} else
 			gtk_xtext_append (xtbuf, text, len, timet);
@@ -486,7 +486,7 @@ pevent_hlist_treeview_new (GtkWidget *box)
 }
 
 void
-pevent_dialog_show ()
+pevent_dialog_show (void)
 {
 	GtkWidget *vbox, *hbox, *wid, *pane, *preview_pane;
 	XTextColor xtext_palette[XTEXT_COLS];

src/fe-gtk/theme/tests/test-theme-application-input-style.c

@@ -21,6 +21,7 @@
 #include "../../fe-gtk.h"
 
 #include "../theme-application.h"
+#include "../theme-css.h"
 #include "../theme-policy.h"
 #include "../../maingui.h"
 #include "../../../common/zoitechat.h"
@@ -45,6 +46,13 @@ fe_message (char *msg, int flags)
 	message_calls++;
 }
 
+/* This test isolates input styling from the application's toplevel CSS. */
+char *
+theme_css_build_toplevel_classes (void)
+{
+	return g_strdup ("");
+}
+
 void
 theme_css_reload_input_style (gboolean enabled, const PangoFontDescription *font_desc)
 {

src/fe-gtk/urlgrab.c

@@ -187,7 +187,7 @@ populate_cb (char *urltext, gpointer userdata)
 }
 
 void
-url_opengui ()
+url_opengui (void)
 {
 	GtkWidget *vbox, *hbox, *view;
 	char buf[128];

src/fe-gtk/xtext.c

@@ -81,6 +81,7 @@ struct textentry
 	gint16 mark_end;
 	int indent;
 	gint16 left_len;
+	gint16 stamp_len;	/* bytes of str taken by the timestamp (no-indent mode) */
 	GSList *slp;
 	GArray *sublines;	/* byte offsets at the end of each screen row */
 	int subline_count;
@@ -296,6 +297,7 @@ static void gtk_xtext_get_property (GObject *object, guint prop_id,
 static void gtk_xtext_render_ents (GtkXText * xtext, textentry *, textentry *);
 static void gtk_xtext_recalc_widths (xtext_buffer *buf, int);
 static void gtk_xtext_fix_indent (xtext_buffer *buf);
+static int gtk_xtext_text_width (GtkXText *xtext, unsigned char *text, int len);
 static int gtk_xtext_find_subline (GtkXText *xtext, textentry *ent, int line);
 /* For use by gtk_xtext_strip_color() and its callers -- */
 struct offlen_s {
@@ -1322,6 +1324,36 @@ gtk_xtext_selection_clear (xtext_buffer *buf)
 	return ret;
 }
 
+/* x position that the lines after the first of 'ent' start at */
+
+static int
+gtk_xtext_cont_indent (xtext_buffer *buf, textentry *ent)
+{
+	int w, off;
+
+	if (ent->left_len != -1 || prefs.hex_text_wrap_align < 1)
+		return buf->indent;
+
+	/* 1 = under the prefix (nick), 2 = under the message */
+	off = ent->stamp_len;
+	if (prefs.hex_text_wrap_align >= 2)
+	{
+		/* the nick (or "*") is the first word after the timestamp */
+		while (off < ent->str_len && ent->str[off] != ' ')
+			off++;
+		while (off < ent->str_len && ent->str[off] == ' ')
+			off++;
+	}
+	if (off <= 0 || off >= ent->str_len)
+		return buf->indent;
+
+	w = ent->indent + gtk_xtext_text_width (buf->xtext, ent->str, off);
+	/* leave room for the text, or just wrap normally */
+	if (w > (buf->window_width - MARGIN) / 2)
+		return buf->indent;
+	return w;
+}
+
 static int
 find_x (GtkXText *xtext, textentry *ent, int x, int subline, int indent)
 {
@@ -1414,7 +1446,7 @@ gtk_xtext_find_x (GtkXText * xtext, int x, textentry * ent, int subline,
 	if (subline < 1)
 		indent = ent->indent;
 	else
-		indent = xtext->buffer->indent;
+		indent = gtk_xtext_cont_indent (xtext->buffer, ent);
 
 	if (line > gtk_adjustment_get_page_size (xtext->adj) || line < 0)
 	{
@@ -4035,7 +4067,7 @@ gtk_xtext_render_line (GtkXText * xtext, textentry * ent, int line,
 			taken--;
 		}
 
-		indent = xtext->buffer->indent;
+		indent = gtk_xtext_cont_indent (xtext->buffer, ent);
 		line++;
 		taken++;
 		str += len;
@@ -4296,7 +4328,7 @@ gtk_xtext_lines_taken (xtext_buffer *buf, textentry *ent)
 			str += len;
 			end = str - ent->str;
 			g_array_append_val (ent->sublines, end);
-			indent = buf->indent;
+			indent = gtk_xtext_cont_indent (buf, ent);
 		}
 		while (str < ent->str + ent->str_len);
 	}
@@ -5376,6 +5408,7 @@ gtk_xtext_append_indent (xtext_buffer *buf,
 	prefix_width = gtk_xtext_text_width (buf->xtext, str, left_len + 1);
 
 	ent->left_len = left_len;
+	ent->stamp_len = 0;
 	ent->str = str;
 	ent->str_len = left_len + 1 + right_len;
 	ent->indent = buf->indent - prefix_width;
@@ -5421,6 +5454,14 @@ gtk_xtext_append_indent (xtext_buffer *buf,
 
 void
 gtk_xtext_append (xtext_buffer *buf, unsigned char *text, int len, time_t stamp)
+{
+	gtk_xtext_append_wrap (buf, text, len, stamp, 0);
+}
+
+/* stamp_len: how many bytes at the start of text are the timestamp */
+
+void
+gtk_xtext_append_wrap (xtext_buffer *buf, unsigned char *text, int len, time_t stamp, int stamp_len)
 {
 	textentry *ent;
 
@@ -5438,6 +5479,7 @@ gtk_xtext_append (xtext_buffer *buf, unsigned char *text, int len, time_t stamp)
 		memcpy (ent->str, text, len);
 	ent->indent = 0;
 	ent->left_len = -1;
+	ent->stamp_len = (stamp_len > 0 && stamp_len < ent->str_len) ? stamp_len : 0;
 
 	gtk_xtext_append_entry (buf, ent, stamp);
 }
@@ -5474,7 +5516,7 @@ gtk_xtext_lastlog (xtext_buffer *out, xtext_buffer *search_area)
 			}
 			else
 			{
-				gtk_xtext_append (out, ent->str, ent->str_len, 0);
+				gtk_xtext_append_wrap (out, ent->str, ent->str_len, 0, ent->stamp_len);
 			}
 
 			if (out->text_last)

src/fe-gtk/xtext.h

@@ -281,6 +281,7 @@ struct _GtkXTextClass
 
 GtkWidget *gtk_xtext_new (const XTextColor *palette, int separator);
 void gtk_xtext_append (xtext_buffer *buf, unsigned char *text, int len, time_t stamp);
+void gtk_xtext_append_wrap (xtext_buffer *buf, unsigned char *text, int len, time_t stamp, int stamp_len);
 void gtk_xtext_append_indent (xtext_buffer *buf,
 										unsigned char *left_text, int left_len,
 										unsigned char *right_text, int right_len,

src/fe-text/fe-text.c

@@ -43,6 +43,9 @@
 #include "../common/util.h"
 #include "../common/fe.h"
 #include "fe-text.h"
+#ifdef __APPLE__
+#include "../common/macos.h"
+#endif
 
 
 static int done = FALSE;
@@ -513,7 +516,13 @@ fe_args (int argc, char *argv[])
 	g_free (locale_path);
 	g_free (base_path);
 #else
-	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
+	bindtextdomain (GETTEXT_PACKAGE,
+#ifdef __APPLE__
+		zoitechat_macos_locale_dir ()
+#else
+		LOCALEDIR
+#endif
+	);
 #endif
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
 	textdomain (GETTEXT_PACKAGE);