Refactor notarization process and enhance build scripts for macOS
This commit updates the build_sign_notarize.sh script to improve the notarization process by introducing a conditional stapling option. It also cleans up temporary files and clears macOS provenance metadata to prevent issues during builds. The Dmg.cmake script is modified to remove the reliance on environment variables for codesigning, streamlining the build process. Additionally, the build_app.sh script is enhanced with heartbeat logging for long-running commands and improved cleanup procedures for build directories.
This commit is contained in:
@@ -7,6 +7,87 @@ lower() { echo "$1" | tr '[:upper:]' '[:lower:]'; }
|
||||
script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
||||
repo_root="$(cd -- "${script_dir}/../.." && pwd)"
|
||||
|
||||
current_cmd_pid=""
|
||||
current_hb_pid=""
|
||||
|
||||
kill_tree() {
|
||||
local pid="$1"
|
||||
[[ -z "${pid}" ]] && return 0
|
||||
# Recurse into children first (best-effort).
|
||||
local child
|
||||
for child in $(pgrep -P "$pid" 2>/dev/null || true); do
|
||||
kill_tree "$child"
|
||||
done
|
||||
kill -TERM "$pid" >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
# Never fail cleanup on errors.
|
||||
set +e
|
||||
if [[ -n "${current_hb_pid}" ]]; then
|
||||
kill "${current_hb_pid}" >/dev/null 2>&1 || true
|
||||
wait "${current_hb_pid}" >/dev/null 2>&1 || true
|
||||
current_hb_pid=""
|
||||
fi
|
||||
if [[ -n "${current_cmd_pid}" ]]; then
|
||||
# If still running, terminate process tree.
|
||||
kill -0 "${current_cmd_pid}" >/dev/null 2>&1 && kill_tree "${current_cmd_pid}"
|
||||
current_cmd_pid=""
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
trap 'cleanup' EXIT
|
||||
|
||||
run_with_heartbeat() {
|
||||
local desc="$1"
|
||||
shift
|
||||
|
||||
local start now elapsed hb_pid
|
||||
start="$(date +%s)"
|
||||
|
||||
echo "==> [$(ts)] ${desc}"
|
||||
|
||||
# Run the command in the background so we can reliably clean it up on Ctrl-C.
|
||||
set +e
|
||||
"$@" &
|
||||
local cmd_pid=$!
|
||||
set -e
|
||||
current_cmd_pid="$cmd_pid"
|
||||
|
||||
(
|
||||
while kill -0 "$cmd_pid" >/dev/null 2>&1; do
|
||||
sleep 20
|
||||
now="$(date +%s)"
|
||||
elapsed="$((now - start))"
|
||||
echo " [$(ts)] ... still working (${elapsed}s elapsed) ..."
|
||||
done
|
||||
) &
|
||||
hb_pid="$!"
|
||||
current_hb_pid="$hb_pid"
|
||||
|
||||
set +e
|
||||
wait "$cmd_pid"
|
||||
local rc=$?
|
||||
set -e
|
||||
|
||||
# Clear globals before stopping heartbeat to avoid cleanup double-kill.
|
||||
current_cmd_pid=""
|
||||
kill "$hb_pid" >/dev/null 2>&1 || true
|
||||
wait "$hb_pid" >/dev/null 2>&1 || true
|
||||
current_hb_pid=""
|
||||
|
||||
now="$(date +%s)"
|
||||
elapsed="$((now - start))"
|
||||
|
||||
if [[ $rc -ne 0 ]]; then
|
||||
echo "Error: '${desc}' failed after ${elapsed}s (exit $rc)." >&2
|
||||
return "$rc"
|
||||
fi
|
||||
|
||||
echo "==> [$(ts)] Done: ${desc} (${elapsed}s)"
|
||||
}
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage:
|
||||
@@ -87,11 +168,41 @@ echo "==> [$(ts)] Config: ${config}"
|
||||
|
||||
if [[ "$do_clean" -eq 1 ]]; then
|
||||
echo "==> [$(ts)] Cleaning build dir"
|
||||
rm -rf "$build_dir"
|
||||
# macOS 26+ can apply provenance metadata that blocks deletion even when permissions look normal.
|
||||
# Clear common xattrs and immutable flags before deleting.
|
||||
xattr -dr com.apple.provenance "$build_dir" >/dev/null 2>&1 || true
|
||||
xattr -dr com.apple.quarantine "$build_dir" >/dev/null 2>&1 || true
|
||||
chflags -R nouchg,noschg "$build_dir" >/dev/null 2>&1 || true
|
||||
rm -rf "$build_dir" || {
|
||||
echo "Error: failed to remove build dir: $build_dir" >&2
|
||||
echo "This is usually due to macOS provenance/flags. Try:" >&2
|
||||
echo " xattr -dr com.apple.provenance \"$build_dir\"" >&2
|
||||
echo " chflags -R nouchg,noschg \"$build_dir\"" >&2
|
||||
echo " rm -rf \"$build_dir\"" >&2
|
||||
exit 1
|
||||
}
|
||||
fi
|
||||
|
||||
mkdir -p "$build_dir"
|
||||
|
||||
# If you've run a previously-built app directly from the build directory, macOS can apply provenance
|
||||
# metadata that makes the bundle effectively immutable (even when permissions look normal).
|
||||
# That breaks CMake because it needs to update strawberry.app/Contents/Info.plist during configure/build.
|
||||
app_bundle="${build_dir}/strawberry.app"
|
||||
if [[ -d "${app_bundle}/Contents" ]]; then
|
||||
# Try to clear provenance/quarantine metadata first (best effort).
|
||||
xattr -dr com.apple.provenance "${app_bundle}" >/dev/null 2>&1 || true
|
||||
xattr -dr com.apple.quarantine "${app_bundle}" >/dev/null 2>&1 || true
|
||||
|
||||
# If the bundle is still not writable, remove it so CMake can recreate it.
|
||||
if ! ( : > "${app_bundle}/Contents/.cmake_write_test" ) 2>/dev/null; then
|
||||
echo "==> [$(ts)] Existing ${app_bundle} is not writable (likely macOS provenance). Removing it."
|
||||
rm -rf "${app_bundle}"
|
||||
else
|
||||
rm -f "${app_bundle}/Contents/.cmake_write_test" >/dev/null 2>&1 || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# Make pkg-config more reliable with Homebrew.
|
||||
export PKG_CONFIG_PATH="${brew_prefix}/lib/pkgconfig:${brew_prefix}/share/pkgconfig:${PKG_CONFIG_PATH:-}"
|
||||
|
||||
@@ -100,7 +211,6 @@ export MACOSX_DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-12.0}"
|
||||
|
||||
cmake_prefix_path="${qt_prefix};${brew_prefix}"
|
||||
|
||||
echo "==> [$(ts)] Configuring (CMAKE_PREFIX_PATH=${cmake_prefix_path})"
|
||||
cmake_extra_args=()
|
||||
|
||||
# Optional: override Sparkle update feed / key for your own published builds.
|
||||
@@ -114,16 +224,17 @@ if [[ -n "${SPARKLE_PUBLIC_ED25519_KEY:-}" ]]; then
|
||||
cmake_extra_args+=("-DSPARKLE_PUBLIC_ED25519_KEY=${SPARKLE_PUBLIC_ED25519_KEY}")
|
||||
fi
|
||||
|
||||
cmake -S "$repo_root" -B "$build_dir" -G Ninja \
|
||||
-DCMAKE_BUILD_TYPE="$config" \
|
||||
-DCMAKE_PREFIX_PATH="$cmake_prefix_path" \
|
||||
-DCMAKE_FRAMEWORK_PATH="${brew_prefix}/Frameworks;${brew_prefix}/opt/sparkle-framework/Frameworks" \
|
||||
-DOPTIONAL_COMPONENTS_MISSING_DEPS_ARE_FATAL=OFF \
|
||||
${cmake_extra_args+"${cmake_extra_args[@]}"} \
|
||||
${icu_prefix:+-DICU_ROOT="$icu_prefix"}
|
||||
run_with_heartbeat "Configuring (CMAKE_PREFIX_PATH=${cmake_prefix_path})" \
|
||||
cmake -S "$repo_root" -B "$build_dir" -G Ninja \
|
||||
-DCMAKE_BUILD_TYPE="$config" \
|
||||
-DCMAKE_PREFIX_PATH="$cmake_prefix_path" \
|
||||
-DCMAKE_FRAMEWORK_PATH="${brew_prefix}/Frameworks;${brew_prefix}/opt/sparkle-framework/Frameworks" \
|
||||
-DOPTIONAL_COMPONENTS_MISSING_DEPS_ARE_FATAL=OFF \
|
||||
${cmake_extra_args+"${cmake_extra_args[@]}"} \
|
||||
${icu_prefix:+-DICU_ROOT="$icu_prefix"}
|
||||
|
||||
echo "==> [$(ts)] Building"
|
||||
cmake --build "$build_dir" --parallel
|
||||
run_with_heartbeat "Building" \
|
||||
cmake --build "$build_dir" --parallel
|
||||
|
||||
if [[ "$do_deploy" -eq 1 ]]; then
|
||||
echo "==> [$(ts)] Preparing env for 'deploy' target (GIO/GStreamer)"
|
||||
@@ -140,13 +251,13 @@ if [[ "$do_deploy" -eq 1 ]]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "==> [$(ts)] Running: deploy"
|
||||
cmake --build "$build_dir" --target deploy
|
||||
run_with_heartbeat "Running: deploy" \
|
||||
cmake --build "$build_dir" --target deploy
|
||||
fi
|
||||
|
||||
if [[ "$do_dmg" -eq 1 ]]; then
|
||||
echo "==> [$(ts)] Running: dmg"
|
||||
cmake --build "$build_dir" --target dmg
|
||||
run_with_heartbeat "Running: dmg" \
|
||||
cmake --build "$build_dir" --target dmg
|
||||
fi
|
||||
|
||||
echo "==> [$(ts)] Done"
|
||||
|
||||
Reference in New Issue
Block a user