7a59f0ffc5
Brings over the uncommitted agent-mei work (Mac checkout, Sep 22) plus box follow-ups (Oct 17: agent_mei action namespace in keymap/zed.rs, MEI_BRIDGE.md, RENAME_AGENT_MEI.md, unmetered receipts report 0 uJ). joule_core, JOULE_CODE_* and JouleDB names unchanged. *.bak.* scratch files excluded.
411 lines
18 KiB
Shell
Executable file
411 lines
18 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
source script/lib/blob-store.sh
|
|
|
|
build_flag="--release"
|
|
target_dir="release"
|
|
open_result=false
|
|
local_install=false
|
|
can_code_sign=false
|
|
|
|
# This must match the team in the provisioning profile.
|
|
IDENTITY="${APPLE_SIGN_IDENTITY:-Zed Industries, Inc.}"
|
|
APPLE_NOTARIZATION_TEAM="${APPLE_NOTARIZATION_TEAM:-MQ55VZLNZQ}"
|
|
|
|
# Function for displaying help info
|
|
help_info() {
|
|
echo "
|
|
Usage: ${0##*/} [options] [architecture=host]
|
|
Build the application bundle for macOS.
|
|
|
|
Options:
|
|
-d Compile in debug mode
|
|
-o Open dir with the resulting DMG or launch the app itself in local mode.
|
|
-i Install the resulting DMG into /Applications.
|
|
-h Display this help and exit.
|
|
"
|
|
}
|
|
|
|
while getopts 'dloih' flag
|
|
do
|
|
case "${flag}" in
|
|
o) open_result=true;;
|
|
d)
|
|
export CARGO_INCREMENTAL=true
|
|
export CARGO_BUNDLE_SKIP_BUILD=true
|
|
build_flag="";
|
|
target_dir="debug"
|
|
;;
|
|
i) local_install=true;;
|
|
h)
|
|
help_info
|
|
exit 0
|
|
;;
|
|
esac
|
|
done
|
|
|
|
shift $((OPTIND-1))
|
|
|
|
|
|
# Get release channel
|
|
pushd crates/zed
|
|
channel=$(<RELEASE_CHANNEL)
|
|
export ZED_RELEASE_CHANNEL="${channel}"
|
|
popd
|
|
|
|
export ZED_BUNDLE=true
|
|
|
|
cargo_bundle_version=$(cargo -q bundle --help 2>&1 | head -n 1 || echo "")
|
|
if [ "$cargo_bundle_version" != "cargo-bundle v0.6.1-zed" ]; then
|
|
cargo install cargo-bundle --git https://github.com/zed-industries/cargo-bundle.git --branch zed-deploy
|
|
fi
|
|
|
|
# Deal with versions of macOS that don't include libstdc++ headers
|
|
export CXXFLAGS="-stdlib=libc++"
|
|
|
|
version_info=$(rustc --version --verbose)
|
|
host_line=$(echo "$version_info" | grep host)
|
|
target_triple=${host_line#*: }
|
|
if [[ $# -gt 0 && -n "$1" ]]; then
|
|
target_triple="$1"
|
|
fi
|
|
arch_suffix=""
|
|
|
|
if [[ "$target_triple" = "x86_64-apple-darwin" ]]; then
|
|
arch_suffix="x86_64"
|
|
elif [[ "$target_triple" = "aarch64-apple-darwin" ]]; then
|
|
arch_suffix="aarch64"
|
|
else
|
|
echo "Unsupported architecture $target_triple"
|
|
exit 1
|
|
fi
|
|
|
|
# Generate the licenses first, so they can be baked into the binaries
|
|
script/generate-licenses
|
|
|
|
rustup target add $target_triple
|
|
|
|
echo "Compiling zed binaries"
|
|
cargo build ${build_flag} --package zed --package cli --target $target_triple
|
|
# Build remote_server in separate invocation to prevent feature unification from other crates
|
|
# from influencing dynamic libraries required by it.
|
|
cargo build ${build_flag} --package remote_server --target $target_triple
|
|
|
|
echo "Creating application bundle"
|
|
pushd crates/zed
|
|
cp Cargo.toml Cargo.toml.backup
|
|
sed \
|
|
-i.backup \
|
|
"s/package.metadata.bundle-${channel}/package.metadata.bundle/" \
|
|
Cargo.toml
|
|
|
|
app_path=$(cargo bundle ${build_flag} --target $target_triple --select-workspace-root | xargs)
|
|
|
|
mv Cargo.toml.backup Cargo.toml
|
|
popd
|
|
echo "Bundled ${app_path}"
|
|
|
|
# DocumentTypes.plist references CFBundleTypeIconFile "Document", so the bundle must contain Document.icns.
|
|
# We use the app icon as a placeholder document icon for now.
|
|
document_icon_source="crates/zed/resources/Document.icns"
|
|
document_icon_target="${app_path}/Contents/Resources/Document.icns"
|
|
if [[ -f "${document_icon_source}" ]]; then
|
|
mkdir -p "$(dirname "${document_icon_target}")"
|
|
cp "${document_icon_source}" "${document_icon_target}"
|
|
else
|
|
echo "cargo::warning=Missing ${document_icon_source}; macOS document icons may not appear in Finder."
|
|
fi
|
|
|
|
if [[ -n "${MACOS_CERTIFICATE:-}" && -n "${MACOS_CERTIFICATE_PASSWORD:-}" && -n "${APPLE_NOTARIZATION_KEY:-}" && -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER_ID:-}" ]]; then
|
|
can_code_sign=true
|
|
|
|
echo "Setting up keychain for code signing..."
|
|
security create-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain || echo ""
|
|
security default-keychain -s zed.keychain
|
|
security unlock-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
|
|
# Calling set-keychain-settings without `-t` disables the auto-lock timeout
|
|
security set-keychain-settings zed.keychain
|
|
echo "$MACOS_CERTIFICATE" | base64 --decode > /tmp/zed-certificate.p12
|
|
security import /tmp/zed-certificate.p12 -k zed.keychain -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
rm /tmp/zed-certificate.p12
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
|
|
|
|
function cleanup() {
|
|
echo "Cleaning up keychain"
|
|
security default-keychain -s login.keychain
|
|
security delete-keychain zed.keychain
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
elif [[ -n "${APPLE_NOTARY_PROFILE:-}" || ( -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER_ID:-}" && ( -n "${APPLE_NOTARIZATION_KEY_PATH:-}" || -n "${APPLE_NOTARIZATION_KEY:-}" ) ) ]]; then
|
|
# Self-hosted signing: the runner already holds the Developer ID in its
|
|
# login keychain, so there is no p12 to inject — sign with that identity
|
|
# directly. Notarization uses an App Store Connect API key when provided
|
|
# (launchd-safe), else the stored notarytool profile (best-effort).
|
|
local_identity="${APPLE_SIGN_IDENTITY:-$(security find-identity -v -p codesigning 2>/dev/null \
|
|
| awk -F'"' '/Developer ID Application/{print $2; exit}')}"
|
|
if [[ -n "$local_identity" ]]; then
|
|
can_code_sign=true
|
|
local_signing=true
|
|
IDENTITY="$local_identity"
|
|
echo "Signing with local keychain identity: $IDENTITY (notary profile ${APPLE_NOTARY_PROFILE})"
|
|
else
|
|
echo "APPLE_NOTARY_PROFILE is set but no 'Developer ID Application' identity is in the keychain; falling back to ad-hoc"
|
|
fi
|
|
fi
|
|
|
|
GIT_VERSION="v2.43.3"
|
|
GIT_VERSION_SHA="fa29823"
|
|
|
|
function download_and_unpack() {
|
|
local url=$1
|
|
local path_to_unpack=$2
|
|
local target_path=$3
|
|
|
|
temp_dir=$(mktemp -d)
|
|
|
|
if ! command -v curl &> /dev/null; then
|
|
echo "curl is not installed. Please install curl to continue."
|
|
exit 1
|
|
fi
|
|
|
|
curl --silent --fail --location "$url" | tar -xvz -C "$temp_dir" -f - $path_to_unpack
|
|
|
|
mv "$temp_dir/$path_to_unpack" "$target_path"
|
|
|
|
rm -rf "$temp_dir"
|
|
}
|
|
|
|
function download_git() {
|
|
local architecture=$1
|
|
local target_binary=$2
|
|
|
|
tmp_dir=$(mktemp -d)
|
|
pushd "$tmp_dir"
|
|
|
|
case "$architecture" in
|
|
aarch64-apple-darwin)
|
|
download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-arm64.tar.gz" bin/git ./git
|
|
;;
|
|
x86_64-apple-darwin)
|
|
download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-x64.tar.gz" bin/git ./git
|
|
;;
|
|
*)
|
|
echo "Unsupported architecture: $architecture"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
popd
|
|
|
|
mv "${tmp_dir}/git" "${target_binary}"
|
|
rm -rf "$tmp_dir"
|
|
}
|
|
|
|
function sign_app_binaries() {
|
|
rm -rf "${app_path}/Contents/Frameworks"
|
|
mkdir -p "${app_path}/Contents/Frameworks"
|
|
|
|
echo "Downloading git binary"
|
|
download_git "${target_triple}" "${app_path}/Contents/MacOS/git"
|
|
|
|
# Note: The app identifier for our development builds is the same as the app identifier for nightly.
|
|
cp crates/zed/contents/$channel/embedded.provisionprofile "${app_path}/Contents/"
|
|
|
|
if [[ ${local_signing:-false} = true ]]; then
|
|
# Developer ID (direct distribution) under our own team: the upstream
|
|
# provisioning profile belongs to another team and its associated-domains
|
|
# entitlement is bound to that team, so both must go — codesign would
|
|
# reject the entitlement, and the profile would be inert regardless.
|
|
# Universal links are the only thing given up; notarization is what
|
|
# matters for a downloadable build.
|
|
rm -f "${app_path}/Contents/embedded.provisionprofile"
|
|
entitlements_path="${app_path}/Contents/Resources/zed.entitlements"
|
|
mkdir -p "$(dirname "$entitlements_path")"
|
|
sed '/com.apple.developer.associated-domains/,+1d' crates/zed/resources/zed.entitlements > "$entitlements_path"
|
|
|
|
echo "Code signing binaries with $IDENTITY"
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/cli" -v
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/git" -v
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --entitlements "$entitlements_path" --sign "$IDENTITY" "${app_path}/Contents/MacOS/agent-mei" -v
|
|
/usr/bin/codesign --force --timestamp --options runtime --entitlements "$entitlements_path" --sign "$IDENTITY" "${app_path}" -v
|
|
elif [[ $can_code_sign = true ]]; then
|
|
echo "Code signing binaries"
|
|
# sequence of codesign commands modeled after this example: https://developer.apple.com/forums/thread/701514
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/cli" -v
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/git" -v
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}/Contents/MacOS/agent-mei" -v
|
|
/usr/bin/codesign --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}" -v
|
|
else
|
|
echo "One or more of the following variables are missing: MACOS_CERTIFICATE, MACOS_CERTIFICATE_PASSWORD, APPLE_NOTARIZATION_KEY, APPLE_NOTARIZATION_KEY_ID, APPLE_NOTARIZATION_ISSUER_ID"
|
|
|
|
echo "====== WARNING ======"
|
|
echo "This bundle is being signed without all entitlements, some features (e.g. universal links) will not work"
|
|
echo "====== WARNING ======"
|
|
|
|
# NOTE: if you need to test universal links you have a few paths forward:
|
|
# - create a PR and tag it with the `run-bundling` label, and download the .dmg file from there.
|
|
# - get a signing key for the MQ55VZLNZQ team from Nathan.
|
|
# - create your own signing key, and update references to MQ55VZLNZQ to your own team ID
|
|
# then comment out this line.
|
|
cat crates/zed/resources/zed.entitlements | sed '/com.apple.developer.associated-domains/,+1d' > "${app_path}/Contents/Resources/zed.entitlements"
|
|
|
|
codesign --force --deep --entitlements "${app_path}/Contents/Resources/zed.entitlements" --sign ${MACOS_SIGNING_KEY:- -} "${app_path}" -v
|
|
fi
|
|
|
|
bundle_name=$(basename "$app_path")
|
|
|
|
if [ "$local_install" = true ]; then
|
|
rm -rf "/Applications/$bundle_name"
|
|
mv "$app_path" "/Applications/$bundle_name"
|
|
echo "Installed application bundle: /Applications/$bundle_name"
|
|
if [ "$open_result" = true ]; then
|
|
echo "Opening /Applications/$bundle_name"
|
|
open "/Applications/$bundle_name"
|
|
fi
|
|
elif [ "$open_result" = true ]; then
|
|
open "$app_path"
|
|
fi
|
|
|
|
if [[ "$target_dir" = "debug" ]]; then
|
|
echo "Debug build detected - skipping DMG creation and signing"
|
|
if [ "$local_install" = false ]; then
|
|
echo "Created application bundle:"
|
|
echo "$app_path"
|
|
fi
|
|
else
|
|
dmg_target_directory="target/${target_triple}/${target_dir}"
|
|
dmg_source_directory="${dmg_target_directory}/dmg"
|
|
dmg_file_path="${dmg_target_directory}/Agent-Mei-${arch_suffix}.dmg"
|
|
xcode_bin_dir_path="$(xcode-select -p)/usr/bin"
|
|
|
|
rm -rf ${dmg_source_directory}
|
|
mkdir -p ${dmg_source_directory}
|
|
mv "${app_path}" "${dmg_source_directory}"
|
|
notarization_key_file=$(mktemp)
|
|
|
|
echo "Adding symlink to /Applications to ${dmg_source_directory}"
|
|
ln -s /Applications ${dmg_source_directory}
|
|
|
|
echo "Creating final DMG at ${dmg_file_path} using ${dmg_source_directory}"
|
|
hdiutil create -volname "Agent Mei" -srcfolder "${dmg_source_directory}" -ov -format UDZO "${dmg_file_path}"
|
|
|
|
# If someone runs this bundle script locally, a symlink will be placed in `dmg_source_directory`.
|
|
# This symlink causes CPU issues with Zed if the Zed codebase is the project being worked on, so we simply remove it for now.
|
|
echo "Removing symlink to /Applications from ${dmg_source_directory}"
|
|
rm ${dmg_source_directory}/Applications
|
|
|
|
echo "Adding license agreement to DMG"
|
|
npm install --global dmg-license minimist
|
|
dmg-license script/terms/terms.json "${dmg_file_path}"
|
|
|
|
if [[ $can_code_sign = true ]]; then
|
|
echo "Notarizing DMG with Apple"
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "$(pwd)/${dmg_file_path}" -v
|
|
if [[ ${local_signing:-false} = true ]]; then
|
|
# Prefer an App Store Connect API key when one is provided — either
|
|
# a path to the .p8 already on the runner (APPLE_NOTARIZATION_KEY_PATH)
|
|
# or its PEM contents (APPLE_NOTARIZATION_KEY). The API key is a FILE
|
|
# credential, so unlike the notarytool keychain profile it IS readable
|
|
# in a launchd session — which is exactly why self-hosted notarization
|
|
# failed before (the profile lives in the data-protection keychain,
|
|
# invisible to a locked launchd session even though code-signing, which
|
|
# reads the file keychain, still succeeds).
|
|
local_api_key=""
|
|
if [[ -n "${APPLE_NOTARIZATION_KEY_PATH:-}" && -f "${APPLE_NOTARIZATION_KEY_PATH}" ]]; then
|
|
local_api_key="${APPLE_NOTARIZATION_KEY_PATH}"
|
|
elif [[ -n "${APPLE_NOTARIZATION_KEY:-}" ]]; then
|
|
echo "$APPLE_NOTARIZATION_KEY" > "$notarization_key_file"
|
|
local_api_key="$notarization_key_file"
|
|
fi
|
|
|
|
if [[ -n "$local_api_key" && -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER_ID:-}" ]]; then
|
|
echo "Notarizing with App Store Connect API key ${APPLE_NOTARIZATION_KEY_ID} (launchd-safe)"
|
|
if ! "${xcode_bin_dir_path}/notarytool" submit --wait --key "$local_api_key" --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER_ID" "${dmg_file_path}"; then
|
|
echo "WARNING: notarization via API key failed — DMG is Developer ID code-signed but NOT notarized."
|
|
notarization_ok=false
|
|
fi
|
|
[[ "$local_api_key" = "$notarization_key_file" ]] && rm -f "$notarization_key_file"
|
|
else
|
|
# No API key on the runner: fall back to the keychain profile.
|
|
# Best-effort — that profile lives in the data-protection keychain,
|
|
# unreadable in a locked launchd session, so don't fail the release
|
|
# over it (the DMG is still Developer ID code-signed, un-notarized).
|
|
if ! "${xcode_bin_dir_path}/notarytool" submit --wait --keychain-profile "${APPLE_NOTARY_PROFILE}" "${dmg_file_path}"; then
|
|
echo "WARNING: notarization skipped - keychain profile '${APPLE_NOTARY_PROFILE}' not readable in this session."
|
|
echo " DMG is Developer ID code-signed but NOT notarized."
|
|
notarization_ok=false
|
|
fi
|
|
fi
|
|
else
|
|
echo "$APPLE_NOTARIZATION_KEY" > "$notarization_key_file"
|
|
"${xcode_bin_dir_path}/notarytool" submit --wait --key "$notarization_key_file" --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER_ID" "${dmg_file_path}"
|
|
rm "$notarization_key_file"
|
|
fi
|
|
if [[ ${notarization_ok:-true} = true ]]; then
|
|
"${xcode_bin_dir_path}/stapler" staple "${dmg_file_path}"
|
|
fi
|
|
fi
|
|
|
|
if [ "$open_result" = true ]; then
|
|
open $dmg_target_directory
|
|
fi
|
|
fi
|
|
}
|
|
|
|
function sign_binary() {
|
|
local binary_path=$1
|
|
|
|
if [[ $can_code_sign = true ]]; then
|
|
echo "Code signing executable $binary_path"
|
|
/usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${binary_path}" -v
|
|
fi
|
|
}
|
|
|
|
function upload_debug_symbols() {
|
|
if [ "$local_install" = true ]; then
|
|
echo "local install; skipping sentry upload."
|
|
elif [[ -n "${SENTRY_AUTH_TOKEN:-}" ]]; then
|
|
echo "Uploading zed debug symbols to sentry..."
|
|
exe_path="target/${target_triple}/release/Zed"
|
|
if ! dsymutil --flat "target/${target_triple}/${target_dir}/zed" 2> target/dsymutil.log; then
|
|
echo "dsymutil failed"
|
|
cat target/dsymutil.log
|
|
exit 1
|
|
fi
|
|
if ! dsymutil --flat "target/${target_triple}/${target_dir}/remote_server" 2> target/dsymutil.log; then
|
|
echo "dsymutil failed"
|
|
cat target/dsymutil.log
|
|
exit 1
|
|
fi
|
|
# note: this uploads the unstripped binary which is needed because it contains
|
|
# .eh_frame data for stack unwinding. see https://github.com/getsentry/symbolic/issues/783
|
|
# Try uploading up to 3 times
|
|
for attempt in 1 2 3; do
|
|
echo "Sentry upload attempt $attempt..."
|
|
if sentry-cli debug-files upload --include-sources --wait -p zed -o zed-dev \
|
|
"target/${target_triple}/${target_dir}/zed.dwarf" \
|
|
"target/${target_triple}/${target_dir}/remote_server.dwarf"; then
|
|
break
|
|
else
|
|
echo "Sentry upload failed on attempt $attempt"
|
|
if [ $attempt -eq 3 ]; then
|
|
echo "All sentry upload attempts failed"
|
|
exit 1
|
|
fi
|
|
fi
|
|
done
|
|
else
|
|
echo "missing SENTRY_AUTH_TOKEN. skipping sentry upload."
|
|
fi
|
|
}
|
|
|
|
upload_debug_symbols
|
|
|
|
cp target/${target_triple}/${target_dir}/agent-mei "${app_path}/Contents/MacOS/agent-mei"
|
|
cp target/${target_triple}/${target_dir}/cli "${app_path}/Contents/MacOS/cli"
|
|
sign_app_binaries
|
|
|
|
sign_binary "target/$target_triple/release/remote_server"
|
|
gzip -f --stdout --best target/$target_triple/release/remote_server > target/zed-remote-server-macos-$arch_suffix.gz
|