forked from spesmilo/electrum
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
mac build: conform to macOS 10.15 Gatekeeper requirements
fixes spesmilo#6128 some of this is based on: https://github.com/metabrainz/picard/blob/e1354632d2db305b7a7624282701d34d73afa225/scripts/package/macos-notarize-app.sh Electron-Cash@1eb8b71 Electron-Cash@24e44e9 Electron-Cash@5abec73
- Loading branch information
1 parent
d3fb685
commit 29a14ea
Showing
5 changed files
with
175 additions
and
71 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,42 +1,53 @@ | ||
| Building Mac OS binaries | ||
| ======================== | ||
| Building macOS binaries | ||
| ======================= | ||
|
|
||
| ✗ _This script does not produce reproducible output (yet!). | ||
| Please help us remedy this._ | ||
|
|
||
| This guide explains how to build Electrum binaries for macOS systems. | ||
|
|
||
|
|
||
| ## 1. Building the binary | ||
| ## Building the binary | ||
|
|
||
| This needs to be done on a system running macOS or OS X. We use El Capitan (10.11.6) as building it | ||
| on High Sierra (or later) | ||
| makes the binaries [incompatible with older versions](https://github.com/pyinstaller/pyinstaller/issues/1191). | ||
| This needs to be done on a system running macOS or OS X. | ||
|
|
||
| Another factor for the minimum supported macOS version is the | ||
| [bundled Qt version](https://github.com/spesmilo/electrum/issues/3685). | ||
| Notes about compatibility with different macOS versions: | ||
| - In general the binary is not guaranteed to run on an older version of macOS | ||
| than what the build machine has. This is due to bundling the compiled Python into | ||
| the [PyInstaller binary](https://github.com/pyinstaller/pyinstaller/issues/1191). | ||
| - The [bundled version of Qt](https://github.com/spesmilo/electrum/issues/3685) also | ||
| imposes a minimum supported macOS version. | ||
| - If you want to build binaries that conform to the macOS "Gatekeeper", so as to | ||
| minimise the warnings users get, the binaries need to be codesigned with a | ||
| certificate issued by Apple, and starting with macOS 10.15 the binaries also | ||
| need to be notarized by Apple's central server. The catch is that to be able to build | ||
| binaries that Apple will notarise (due to the requirements on the binaries themselves, | ||
| e.g. hardened runtime) the build machine needs at least macOS 10.14. | ||
| See [#6128](https://github.com/spesmilo/electrum/issues/6128). | ||
|
|
||
| We currently build the release binaries on macOS 10.14.6, and these seem to run on | ||
| 10.13 or newer. | ||
|
|
||
| Before starting, make sure that the Xcode command line tools are installed (e.g. you have `git`). | ||
|
|
||
| #### 1.1a Get Xcode | ||
| #### 1.a Get Xcode | ||
|
|
||
| Building the QR scanner (CalinsQRReader) requires full Xcode (not just command line tools). | ||
|
|
||
| The last Xcode version compatible with El Capitan is Xcode 8.2.1 | ||
|
|
||
| Get it from [here](https://developer.apple.com/download/more/). | ||
|
|
||
| Unfortunately, you need an "Apple ID" account. | ||
|
|
||
| (note: the last Xcode that runs on macOS 10.14.6 is Xcode 11.3.1) | ||
|
|
||
| After downloading, uncompress it. | ||
|
|
||
| Make sure it is the "selected" xcode (e.g.): | ||
|
|
||
| sudo xcode-select -s $HOME/Downloads/Xcode.app/Contents/Developer/ | ||
|
|
||
| #### 1.1b Build QR scanner separately on newer Mac | ||
| #### 1.b Build QR scanner separately on another Mac | ||
|
|
||
| Alternatively, you can try building just the QR scanner on newer macOS. | ||
| Alternatively, you can try building just the QR scanner on another Mac. | ||
|
|
||
| On newer Mac, run: | ||
|
|
||
|
|
@@ -46,27 +57,17 @@ On newer Mac, run: | |
| Move `prebuilt_qr` to El Capitan: `contrib/osx/CalinsQRReader/prebuilt_qr`. | ||
|
|
||
|
|
||
| #### 1.2 Build Electrum | ||
| #### 2. Build Electrum | ||
|
|
||
| cd electrum | ||
| ./contrib/osx/make_osx | ||
|
|
||
| This creates both a folder named Electrum.app and the .dmg file. | ||
|
|
||
|
|
||
| ## 2. Building the image deterministically (WIP) | ||
| The usual way to distribute macOS applications is to use image files containing the | ||
| application. Although these images can be created on a Mac with the built-in `hdiutil`, | ||
| they are not deterministic. | ||
|
|
||
| Instead, we use the toolchain that Bitcoin uses: genisoimage and libdmg-hfsplus. | ||
| These tools do not work on macOS, so you need a separate Linux machine (or VM). | ||
|
|
||
| Copy the Electrum.app directory over and install the dependencies, e.g.: | ||
| This creates both a folder named Electrum.app and the .dmg file. | ||
|
|
||
| apt install libcap-dev cmake make gcc faketime | ||
|
|
||
| Then you can just invoke `package.sh` with the path to the app: | ||
| If you want the binaries codesigned for MacOS and notarised by Apple's central server, | ||
| provide these env vars to the `make_osx` script: | ||
|
|
||
| cd electrum | ||
| ./contrib/osx/package.sh ~/Electrum.app/ | ||
| CODESIGN_CERT="Developer ID Application: Electrum Technologies GmbH (L6P37P7P56)" \ | ||
| APPLE_ID_USER="[email protected]" \ | ||
| APPLE_ID_PASSWORD="1234" \ | ||
| ./contrib/osx/make_osx | ||
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| <plist version="1.0"> | ||
| <dict> | ||
| <!-- These are required for binaries built by PyInstaller --> | ||
| <!-- see pyinstaller/pyinstaller#4629 --> | ||
| <key>com.apple.security.cs.allow-unsigned-executable-memory</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.disable-library-validation</key> | ||
| <true/> | ||
|
|
||
| <!-- These are required for USB HID access (hw wallets). --> | ||
| <!-- see https://github.com/Electron-Cash/Electron-Cash/commit/5abec73eee0cdeb725e3c5a989621ec4ccfb92a0 --> | ||
| <key>com.apple.security.cs.allow-dyld-environment-variables</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.allow-jit</key> | ||
| <true/> | ||
| </dict> | ||
| </plist> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| #!/usr/bin/env bash | ||
| # from https://github.com/metabrainz/picard/blob/e1354632d2db305b7a7624282701d34d73afa225/scripts/package/macos-notarize-app.sh | ||
|
|
||
|
|
||
| if [ -z "$1" ]; then | ||
| echo "Specify app bundle as first parameter" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "$APPLE_ID_USER" ] || [ -z "$APPLE_ID_PASSWORD" ]; then | ||
| echo "You need to set your Apple ID credentials with \$APPLE_ID_USER and \$APPLE_ID_PASSWORD." | ||
| exit 1 | ||
| fi | ||
|
|
||
| APP_BUNDLE=$(basename "$1") | ||
| APP_BUNDLE_DIR=$(dirname "$1") | ||
|
|
||
| cd "$APP_BUNDLE_DIR" || exit 1 | ||
|
|
||
| # Package app for submission | ||
| echo "Generating ZIP archive ${APP_BUNDLE}.zip..." | ||
| ditto -c -k --rsrc --keepParent "$APP_BUNDLE" "${APP_BUNDLE}.zip" | ||
|
|
||
| # Submit for notarization | ||
| echo "Submitting $APP_BUNDLE for notarization..." | ||
| RESULT=$(xcrun altool --notarize-app --type osx \ | ||
| --file "${APP_BUNDLE}.zip" \ | ||
| --primary-bundle-id org.electrum.electrum \ | ||
| --username $APPLE_ID_USER \ | ||
| --password @env:APPLE_ID_PASSWORD \ | ||
| --output-format xml) | ||
|
|
||
| if [ $? -ne 0 ]; then | ||
| echo "Submitting $APP_BUNDLE failed:" | ||
| echo "$RESULT" | ||
| exit 1 | ||
| fi | ||
|
|
||
| REQUEST_UUID=$(echo "$RESULT" | xpath \ | ||
| "//key[normalize-space(text()) = 'RequestUUID']/following-sibling::string[1]/text()" 2> /dev/null) | ||
|
|
||
| if [ -z "$REQUEST_UUID" ]; then | ||
| echo "Submitting $APP_BUNDLE failed:" | ||
| echo "$RESULT" | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "$(echo "$RESULT" | xpath \ | ||
| "//key[normalize-space(text()) = 'success-message']/following-sibling::string[1]/text()" 2> /dev/null)" | ||
|
|
||
| # Poll for notarization status | ||
| echo "Submitted notarization request $REQUEST_UUID, waiting for response..." | ||
| sleep 60 | ||
| while : | ||
| do | ||
| RESULT=$(xcrun altool --notarization-info "$REQUEST_UUID" \ | ||
| --username "$APPLE_ID_USER" \ | ||
| --password @env:APPLE_ID_PASSWORD \ | ||
| --output-format xml) | ||
| STATUS=$(echo "$RESULT" | xpath \ | ||
| "//key[normalize-space(text()) = 'Status']/following-sibling::string[1]/text()" 2> /dev/null) | ||
|
|
||
| if [ "$STATUS" = "success" ]; then | ||
| echo "Notarization of $APP_BUNDLE succeeded!" | ||
| break | ||
| elif [ "$STATUS" = "in progress" ]; then | ||
| echo "Notarization in progress..." | ||
| sleep 20 | ||
| else | ||
| echo "Notarization of $APP_BUNDLE failed:" | ||
| echo "$RESULT" | ||
| exit 1 | ||
| fi | ||
| done | ||
|
|
||
| # Staple the notary ticket | ||
| xcrun stapler staple "$APP_BUNDLE" |